Replace no longer maintained DotNetZip

Expected Behavior

The QuantConnect.Compression project should use secure, actively maintained compression libraries without known security vulnerabilities. When building the Lean solution, no security warnings should be raised regarding vulnerable dependencies.

Actual Behavior

The build process fails with a security error when TreatWarningsAsErrors is enabled:

error NU1903: Warning As Error: Package 'DotNetZip' 1.16.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-xhg6-9j5j-w4vf

The QuantConnect.Compression project currently depends on DotNetZip 1.16.0, which has:

• CVE-2024-48510: Directory Traversal vulnerability with HIGH severity (CVSS 8.6)
• Attack Vector: Remote attackers can execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component
• Package Status: No longer maintained by the original author

Potential Solution

Replace the vulnerable DotNetZip dependency with secure alternatives:

Option 1 (Recommended): Use System.IO.Compression

• Built into .NET runtime, no external dependencies
• Actively maintained by Microsoft
• Provides comprehensive ZIP functionality
• Better performance and reliability

Option 2: Use SharpCompress

• Modern, actively maintained compression library
• Supports multiple formats beyond ZIP
• Clean, well-designed API
• Current stable version: 0.39.0

Option 3: Use ProDotNetZip

• Fork of DotNetZip with security fixes applied
• Drop-in replacement with same API
• .NET Standard 2.0 compatible

Reproducing the Problem

1. Clone the Lean repository
2. Ensure .NET SDK 9.0 is installed
3. Navigate to the Compression project directory
4. Run vulnerability scan:

   dotnet list package --vulnerable
   

5. Attempt to build with warnings as errors:

   dotnet build --configuration Release -p:TreatWarningsAsErrors=true
   

6. Observe the NU1903 error regarding DotNetZip vulnerability

Affected File: Compression/QuantConnect.Compression.csproj

<PackageReference Include="DotNetZip" Version="1.16.0" />

System Information

• Affected Versions: All current Lean versions using DotNetZip 1.16.0
• Operating Systems: All (Windows, Linux, macOS) - this is a package-level vulnerability
• .NET Version: All supported versions (the vulnerability is in the DotNetZip package itself)
• Vulnerability Database: GitHub Security Advisory GHSA-xhg6-9j5j-w4vf
• CVE: CVE-2024-48510
• CVSS Score: 8.6 (High)
• CWE: CWE-22 (Path Traversal)

Additional Context

This vulnerability affects any production deployment using the Compression library and poses a significant security risk for:

• Systems processing user-uploaded ZIP files
• Applications handling ZIP archives from external sources
• Production trading systems requiring security compliance

The DotNetZip maintainer has explicitly recommended transitioning to System.IO.Compression as stated in the project repository.

Checklist

• I have completely filled out this template
• I have confirmed that this issue exists on the current master branch
• I have confirmed that this is not a duplicate issue by searching [issues](https://github.com/QuantConnect/Lean/issues)
• I have provided detailed steps to reproduce the issue

Start with Compression/QuantConnect.Compression.csproj and inspect how DotNetZip 1.16.0 is referenced and used by the Compression project. Run dotnet list package --vulnerable and the Release build with TreatWarningsAsErrors enabled while evaluating the listed replacement options. Done means the vulnerable dependency is removed, the project builds without NU1903, and the vulnerability scan reports no affected package.