onnxruntime-node: bump adm-zip to >=0.6.0 to resolve GHSA-xcpc-8h2w-3j85 #30125

Problem

Current onnxruntime-node releases, including 1.27.0 and the latest 1.29.0-dev builds, declare adm-zip: ^0.5.16. All adm-zip versions below 0.6.0 are affected by GHSA-xcpc-8h2w-3j85 / CVE-2026-39244 (crafted ZIP metadata can trigger an approximately 4 GB allocation and process OOM).

Because ^0.5.16 cannot resolve to 0.6.0, downstream libraries cannot remediate this by widening their own direct adm-zip range: npm installs a nested vulnerable adm-zip@0.5.x under onnxruntime-node. Library-level overrides also do not propagate to consumers.

Reproduction

npm init -y
npm install onnxruntime-node@1.27.0 adm-zip@^0.6.0
npm ls adm-zip
npm audit

The tree contains both top-level adm-zip@0.6.0 and nested onnxruntime-node/node_modules/adm-zip@0.5.x; npm reports the high-severity advisory through onnxruntime-node.

Requested change

Please update the onnxruntime-node dependency to adm-zip >=0.6.0 (ideally ^0.6.0) and publish a patched stable release. adm-zip 0.6.0 is the first patched version. Its documented extraction behavior changes should be checked against the package-install extraction path.

This currently forces downstreams that need Intel macOS support to choose between an older ONNX Runtime release without the vulnerable dependency or carrying a native-package fork/consumer override.