Vulnerability: CWE-409 (zip-bomb)

Describe the bug
Mitigate vulnerability CWE-409, commonly known as 'zip-bomb'.
See CWE-409 for a longer description and more context.

Since we implement compressed file handling in gctoolkit, and handle .zip and .tar.gz files, we are susceptible to this particular vulnerability (and thus, all consuming applications are too). Note that standard Java libraries do not handle this vulnerability today.

We have provided a change that mitigates the vulnerability, but @johnoliver and I both agree it's too complicated (and very likely too brittle) to incorporate into this library. We would like feedback to decide what to do, and we will make our choice in late Sept/early Oct 2026.

Alternatives we are considering:

• Remove IO handling from gctoolkit (shifts IO responsibility)
  • Enforce wrapping application handling for IO
  • gctoolkit accepts stream data only
• Reduce handling to just .zip - Apache compression lib mitigates (reduced functionality)
• Shell out to the system OS - responsibility on the deployment dependencies.
• Do not mitigate at all, provide guidance for consuming services/applications.