chore(trading-converter): bump SharpCompress 0.34.2 -> 0.48.0 (security GHSA-6c8g-7p36-r338) — Closes #7807

[jsboige]

Summary

Bumps SharpCompress 0.34.2 → 0.48.0 in MyIA.Trading.Converter, fixing the known MEDIUM-severity decompression-bomb/crash vulnerability GHSA-6c8g-7p36-r338 (the 0.34.2 baseline emitted NU1902 on every build). Closes #7807.

This is NOT a drop-in bump. SharpCompress 0.48.0 ships a breaking API change: the ReaderFactory.Open / WriterFactory.Open static factory methods were removed (they became OpenReader / OpenWriter, and OpenReader now requires an explicit ReaderOptions). Verified firsthand — bumping the version alone produces two CS0117 ("does not contain a definition for 'Open'") errors at the two SharpCompress call sites. This PR migrates both call sites, so the bump is genuinely verified (not an unverified version-string change).

Why this is stacked on #7813

The project did not compile on origin/main (an unrelated System.Linq.Dynamic.Core interface-rename build break). #7813 fixes that break. This PR is based on #7813's branch so the bump can be build-verified on a compiling tree (the whole point — H.1 forbids shipping an unverified bump). GitHub will auto-retarget this PR to main once #7813 merges; no manual rebase needed.

The migration (CompressionHelper.cs)

The two SharpCompress call sites, migrated to the 0.48.0 API:

// Decompress (line 181): Open(stream) -> OpenReader(stream, ReaderOptions)
using var reader = ReaderFactory.OpenReader(entryStream, new ReaderOptions());

// Compress (line 289): Open(stream, type, opts) -> OpenWriter(stream, type, opts)
using var writer = WriterFactory.OpenWriter(archiveFileStream, objArchiveType, new WriterOptions(objCompressionType));

The entry API (reader.MoveToNextEntry(), reader.Entry.IsDirectory/.Key/.Size, reader.WriteEntryTo(...), writer.Write(...)) is unchanged in 0.48.0 — the build reported ONLY the two Open-rename errors, confirming no further migration is needed.

Validation (H.1 firsthand, isolated worktree stacked on #7813)

$ dotnet build MyIA.Trading.Converter.csproj -c Release   (after migration + 0.48.0)
  3 Avertissement(s)   0 Erreur(s)     Temps écoulé 00:00:01.98

• 0 errors (baseline pre-fix(trading-converter): repair System.Linq.Dynamic.Core build break (unblocks #7807) #7813 had 1 unrelated error; this PR adds 0).
• NU1902 (SharpCompress vuln) warning is GONE — GHSA-6c8g-7p36-r338 remediated.
• 0.48.0 API surface verified firsthand via reflection: ReaderFactory.OpenReader(Stream, ReaderOptions), WriterFactory.OpenWriter(Stream, ArchiveType, IWriterOptions), ReaderOptions() ctor, WriterOptions(CompressionType) ctor, IReader/IWriter/IReaderEntry members — all present. net9.0 TFM available.
• CRLF: 0 CR (LF-only) on both files.

Scope (anti-regression)

• +3/-3 across 2 files: csproj (version 0.34.2→0.48.0) + CompressionHelper.cs (2 API-call renames). No logic change.
• No other file touched. Stacked on fix(trading-converter): repair System.Linq.Dynamic.Core build break (unblocks #7807) #7813 (build-break fix) — the two PRs are independent subjects.

Closes #7807 (the dependency bump is delivered + verified).

Grain: MED/chore-security-bump — lane po-2026:CoursIA — prev: MED/fix-functional-bug (c.622 #7813). [Genre change fix-functional-bug→chore-security-bump (G-VAR-3 OK); family .NET/Trading-Converter consecutive (#7813→this) but R6 bans 4×family, 2× OK; distinct sub-systems — LINQ interface rename (#7813) vs SharpCompress dep version+API (this).]

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

[jsboige]

[Hermes] COMMENT -- SHA e7c1282

Security bump verify : SharpCompress 0.34.2 -> 0.48.0 remedie GHSA-6c8g-7p36-r338 (decompression-bomb). Ce n'est PAS un bump drop-in -- la PR migre correctement les 2 breaking API changes :

• ReaderFactory.Open -> OpenReader(stream, ReaderOptions) OK
• WriterFactory.Open -> OpenWriter(stream, type, WriterOptions) OK

Build verifie firsthand (stacked sur #7813) : 0 erreurs, NU1902 gone. Pas de changement de logique, entry API inchangee. +3/-3 surgical. Security : clean.

Note : #7807 (dependabot) couvrait le bump de version seul ; cette PR est la vraie delivery car elle inclut la migration API requise pour compiler. Stacking sur #7813 OK (sujets independants).