5.19.1

Security release. Fixes a path-traversal issue in the file-serving
path. See GHSA-72g6-wgrg-vhm7
for the advisory, including affected versions and workarounds.

Security

• Resolved file paths are now confined to the directory they were
  resolved against. The file-serving fallback built a path from the
  request URL and joined it onto the configured response directory,
  checking only that the result existed — never that it stayed inside
  that directory. A request carrying an un-normalised .. segment could
  therefore read files outside it.

  The same missing check applied to a rule's respond.file_path and to
  a path returned by a Rhai middleware script. Both are
  operator-authored rather than request-derived, so neither was
  reachable by a client, but both could reference locations outside the
  response directory.

  Every resolved path is now canonicalised and checked against the
  canonicalised base directory for its site. Anything outside is refused
  with a bare 404, indistinguishable from an ordinary not-found, so a
  prober learns nothing about whether the target exists. As a second,
  independent control, .. segments are stripped from the request path
  before file resolution.

  Affected: 4.0.0 through 5.19.0. Also fixed in 4.8.1, for users on the
  v4 line — there is no requirement to change major version.