diff --git a/Cargo.lock b/Cargo.lock
index edc16485a1..6e93134ff0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -599,7 +599,7 @@ dependencies = [
  "arrow-select",
  "flatbuffers",
  "lz4_flex 0.14.0",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -1899,7 +1899,7 @@ dependencies = [
  "arrayvec",
  "cc",
  "cfg-if",
- "constant_time_eq",
+ "constant_time_eq 0.4.2",
  "cpufeatures 0.3.0",
 ]
 
@@ -2696,8 +2696,8 @@ dependencies = [
  "flate2",
  "liblzma",
  "memchr",
- "zstd",
- "zstd-safe",
+ "zstd 0.13.3",
+ "zstd-safe 7.2.4",
 ]
 
 [[package]]
@@ -2903,6 +2903,15 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
+[[package]]
+name = "constant_time_eq"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.4.0"
@@ -3377,7 +3386,7 @@ dependencies = [
  "tokio",
  "url",
  "uuid",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -3501,7 +3510,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "url",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -6804,9 +6813,9 @@ dependencies = [
 
 [[package]]
 name = "lzma-rust2"
-version = "0.16.5"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+checksum = "fde178a3caf126c440fa15628147772d8ee590a39477d711353fbe2e58a73a5b"
 dependencies = [
  "sha2 0.11.0",
 ]
@@ -6980,7 +6989,7 @@ dependencies = [
  "serde_json",
  "tempfile",
  "tokio",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -7975,8 +7984,8 @@ dependencies = [
  "web",
  "webpki-roots 1.0.9",
  "x509-parser",
- "zip 8.6.0",
- "zstd",
+ "zip 9.0.3",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -8105,7 +8114,7 @@ dependencies = [
  "url",
  "utoipa",
  "utoipa-swagger-ui",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -8193,7 +8202,7 @@ dependencies = [
  "usage_reporting",
  "utoipa",
  "uuid",
- "zip 8.6.0",
+ "zip 9.0.3",
 ]
 
 [[package]]
@@ -8517,7 +8526,7 @@ dependencies = [
  "sourcemap",
  "tokio",
  "tonic",
- "zip 8.6.0",
+ "zip 9.0.3",
 ]
 
 [[package]]
@@ -8843,7 +8852,7 @@ dependencies = [
  "snap",
  "tokio",
  "twox-hash",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -12705,7 +12714,7 @@ dependencies = [
  "tantivy-bitpacker",
  "tantivy-common",
  "tantivy-fst",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -12751,7 +12760,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "vortex",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -13133,7 +13142,7 @@ dependencies = [
  "tower-service",
  "tracing",
  "webpki-roots 1.0.9",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -14497,7 +14506,7 @@ dependencies = [
  "vortex-error",
  "vortex-mask",
  "vortex-session",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -14610,7 +14619,7 @@ dependencies = [
  "webbrowser",
  "woothee",
  "xxhash-rust",
- "zstd",
+ "zstd 0.13.3",
 ]
 
 [[package]]
@@ -15535,13 +15544,13 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "c2d98561b612a84ae525331a7a094429ef8a5772514ed507ff6db5f54badc971"
 dependencies = [
  "aes 0.9.2",
  "bzip2",
- "constant_time_eq",
+ "constant_time_eq 0.6.1",
  "crc32fast",
  "deflate64",
  "flate2",
@@ -15550,6 +15559,7 @@ dependencies = [
  "indexmap 2.14.0",
  "lzma-rust2",
  "memchr",
+ "nix 0.31.3",
  "pbkdf2",
  "ppmd-rust",
  "sha1 0.11.0",
@@ -15557,7 +15567,7 @@ dependencies = [
  "typed-path",
  "zeroize",
  "zopfli",
- "zstd",
+ "zstd 0.14.2",
 ]
 
 [[package]]
@@ -15590,7 +15600,16 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
 dependencies = [
- "zstd-safe",
+ "zstd-safe 7.2.4",
+]
+
+[[package]]
+name = "zstd"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "057cfd910cfac363a0ada849592624b4c9ff2e10bef504c3433810d78ed96f93"
+dependencies = [
+ "zstd-safe 8.1.0",
 ]
 
 [[package]]
@@ -15603,10 +15622,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+name = "zstd-safe"
+version = "8.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "bdd44c6a7284e91f3717755b24315a302edd9153a01f753c3cba3d765e8eafac"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.1.1+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 0c3447d2b6..df1c679884 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -627,7 +627,7 @@ vrl = { version = "0.31", features = [
     "test",
 ] }
 x509-parser = "0.18.0"
-zip = "8.0"
+zip = "9.0"
 zstd = "0.13"
 
 [patch.crates-io]
diff --git a/src/sourcemaps/src/lib.rs b/src/sourcemaps/src/lib.rs
index 7a391977d6..76b79d5eaf 100644
--- a/src/sourcemaps/src/lib.rs
+++ b/src/sourcemaps/src/lib.rs
@@ -97,6 +97,8 @@ pub async fn process_zip(
 
     // first filter out the js and .map files from teh archive
     for name in archive.file_names() {
+        let name = name.context("invalid file name in zip")?;
+        let name = name.as_ref();
         if name.ends_with(".js") {
             let (_, file_name) = name.rsplit_once("/").unwrap_or(("", name));
             minified.insert(file_name.to_string());
@@ -1025,7 +1027,7 @@ mod tests {
         let err = process_zip(org, None, None, None, zip).await.unwrap_err();
         assert!(
             err.to_string()
-                .contains("exceeds maximum allowed file size"),
+                .contains("larger than its declared uncompressed size"),
             "{err}"
         );
         assert!(stored_files(org).await.is_empty());