Update rubyzip requirement from ~> 2.3 to ~> 3.6

[dependabot]

Updates the requirements on rubyzip to permit the latest version.

Release notes

Sourced from rubyzip's releases.

v3.6.0

Version 3.6.0

The 3.6.x line lazy-loads OpenSSL only when really needed (for faster start-up times) and clamps internal (DOS-based) dates and times to the allowed range. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

Changelog

Sourced from rubyzip's changelog.

3.6.0 (2026-09-01)

• Forward options from OutputStream.open without a block. #674
• Clamp DOS date and time to the range the fields can hold. #671

Tooling/internal:

• Unix owner ids no longer default to 0 (root).
• Legacy Unix owner ids no longer default to 0 (root).
• Handle short reads in copy_stream_n. #675
• Retain required Zip64 offset fields. #676
• Load openssl only when AES encryption is used. #672

3.5.0 (2026-08-18)

• Fix the link to Ruby doc in README to the latest version. #670
• Support passing decrypter to encrypted entry via get_input_stream. #667

3.4.1 (2026-06-27)

• Fixed DecryptedIo to only perform integrity once. #665

3.4.0 (2026-06-14)

• Prevent entries from being extracted outside specified directory. #664. Thanks to @​connorshea for additional reporting on this.
• Use SecureRandom in place of insecure Random.
• Stop reading the central directory on first error.
• Add a check on number of declared entries in a zip file. Thanks to @​connorshea for reporting this.
• Add note to README re reporting security issues privately.
• Add lib/rubyzip.rb for Bundler auto-require. #660

Tooling/internal:

• Replace the test Excel spreadsheet fixture.
• Use assert_silent shorthand when expecting no output from a test.
• Clean up CentralDirectory instance variables.
• Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
• List ZIP docs that we store here and link to online versions. #657

3.3.1 (2026-05-30)

• Reinstate default param for InputStream#sysread. #663

3.3.0 (2026-05-02)

• Refactor InputStream and AbstractInputStream. #661

Tooling/internal:

... (truncated)

Commits

• a31f40c Update Changelog for release.
• defb7bf Unix owner ids no longer default to 0 (root).
• bb755dd Legacy Unix owner ids no longer default to 0 (root).
• abc248c Handle short reads in copy_stream_n
• 045062d Retain required Zip64 offset fields
• c2ea155 Test blockless output stream options
• 0600350 Forward options from OutputStream.open without a block
• 096d2f4 Bump minor version number due to latest changes.
• 17474a1 Clamp DOS date and time to the range the fields can hold
• 6362d8a Stop RUBYOPT leaking into the require test subprocesses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)