What's Changed
- Symlink containment completed (#2342, #2343, #2344, #2346) — closes both path-security bypasses for convert CLI output paths, including the remaining case disclosed in the v2.0.37 release notes:
- Output directories that do not exist yet are vetted through their nearest existing ancestor (#2343).
- Canonical containment (#2346): relative outputs — including the default — must truly resolve inside the working directory, even when a symlink (or a symlink whose target already contains matching subdirectories) tries to redirect them. Explicit outside destinations disclose their real location when a symlink diverts them, and writes always use the vetted canonical path.
No known path-security issues remain open.
Full Changelog: v2.0.37...v2.0.38