v10.2.2

Security

10.x backport of the 11.1.4 path-traversal fix (bypass of GHSA-mp2f-45pm-3cg9) - a symlink chain could write/read files outside the output directory, potentially leading to RCE.

Affected: <= 10.2.1

• Resolve link/directory targets with realpath before the containment check
• Re-validate created symlinks resolve inside the output dir (catches self-referential chains)
• Refuse hardlinks that target a symlink
• Write files with O_NOFOLLOW
• Reject duplicate entry paths

Full changelog: v10.2.1...v10.2.2