v4.1.7

Fixes

• Validate decoded paths before directory listings to prevent encoded traversal paths.
• Keep the default 127.0.0.1 / localhost bind local instead of exposing the server on all interfaces.
• Use resolved path containment for served-file URL resolution instead of string prefix checks.
• Trigger reloads when new watched files are created.
• Fix live reload script injection so closing tags are preserved and the injected template does not add an extra </body>.

Verification

• python3 -B -m unittest tests.test_regressions
• Syntax compile check for touched Python files