Followup-For: Bug #1054290 Updates on some other codebases where minizip appears vendored in Debian source packages:
* gdal - the fix for minizip is included in upstream version 3.8.0 and a packaged version of that release has been accepted into Debian unstable. * mupen64plus-core - this appears unaffected in Debian; it declares a build-time dependency on libminizip-dev, and the build system uses this when available. I've verified that by recompiling it successfully with the 'minizip' subproject directory deleted from the filesystem. * orthanc - appears unaffected due to the nature of the inputs to the filename parameter. * widelands - appears unaffected in Debian; similar to mupen64plus-core, it declares a dependecy on libminizip-dev, and the build system for the codebase uses system-provided minizip in preference to the vendored copy.