v11.1.4

Security

Fixes a path-traversal escape (bypass of GHSA-mp2f-45pm-3cg9) where a chain of symlink entries lets an archive write/read files outside the output directory, potentially leading to RCE.

Affected: <= 11.1.3

• Resolve link/directory targets with realpath before the containment check
• Re-validate created symlinks resolve inside the output dir (catches self-referential chains)
• Refuse hardlinks that target a symlink
• Write files with O_NOFOLLOW
• Reject duplicate entry paths

Full changelog: v11.1.3...v11.1.4