chore(release): 0.0.15 - filesystem containment security fix

Synchronize workspace packages and retained documentation for the filesystem
security fix. Keep versioned configuration recipes consistent with their paths
and cover generation across supported documentation languages.

Author: Vidigal-code

CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to Git Page Docs are documented here. Versions follow semver and count from the
 0.0.1 baseline below.
 
+## 0.0.15 - 2026-10-22 - filesystem containment security fix
+
+- Check both lexical and canonical filesystem paths before reading, listing or writing project files. Reject existing symlinks and junctions that resolve outside the project root, and skip unsafe linked files during search.
+- Validate the nearest existing parent before creating directories and reject symbolic links at write destinations, including internal and dangling links. Preserve supported internal directory aliases, project-root aliases and ordinary filenames beginning with two dots.
+- Make `update_documentation` create a new document only when the existing file is missing. Propagate containment and access errors before calling a provider or writing output.
+- Add filesystem and MCP regression coverage for linked paths, directory creation, aliases and error handling. Document the boundary against concurrent path replacement and the separate configuration and provider-selection paths.
+- Update the CLI, shared tools and MCP packages to 0.0.15. Register documentation versions 0.0.15 through 0.0.9, preserve older folders and synchronize the English, Portuguese and Spanish guides.
+- Keep configuration recipe IDs, documentation versions and paths consistent with each retained documentation folder while preserving package installation commands and the version history.
+
 ## 0.0.14 - 2026-10-18 - paginated containers and Markdown markers
 
 - Paginate Markdown, HTML, video, audio and PDF files inside individual containers with ordered route references and localized titles/descriptions. Configure shared defaults through `site.containerPagination` and override them per route; the default is four icon controls and a page counter below the content, aligned right.

CONTRIBUTING.md

@@ -35,7 +35,7 @@ This is a pnpm + turbo monorepo: `frontend/` (Next.js viewer), `cli/` (the publi
 ### User references
 
 The generated documentation includes 35 Markdown pages per language: focused references plus complete configuration recipes, migration/compatibility, troubleshooting, contributing/testing and HTML-container guides. All pages are available in English, Portuguese and Spanish; Markdown filenames stay in English while titles and content preserve UTF-8 accents and special characters.
-The scaffold registers documentation versions 0.0.14, 0.0.13, 0.0.12, 0.0.11, 0.0.10 and 0.0.9 in descending order with the current examples; the npm package version is 0.0.14. Paths and version badges match each generated documentation version. Existing older version folders are preserved.
+The scaffold registers documentation versions 0.0.15, 0.0.14, 0.0.13, 0.0.12, 0.0.11, 0.0.10 and 0.0.9 in descending order with the current examples; the npm package version is 0.0.15. Paths and version badges match each generated documentation version. Existing older version folders are preserved.
 
 The scaffold has real nested sections: Guides → Configure your site / Read and explore / Automate and integrate → documents, plus Operations and development and Git/GitHub groups. Getting Started and Project overview remain the first destinations. Every parent section has its own localized Markdown overview: click its title to read it, or use the separate arrow to expand children. Breadcrumb ancestors such as Guides → Configure your site remain navigable. Recursive `submenus` can extend the hierarchy without a fixed depth limit; `site.nestedMenusEnabled: false` keeps every destination in a flat presentation.
 
@@ -72,7 +72,7 @@ Read or download the [GitPageDocs project guide (PDF, English)](cli/content/asse
 Configure `site.pdf` with `enabled`, `previewEnabled`, `downloadEnabled` and `openInNewTabEnabled` (all default to `true`). The version config uses `routes-pdf`, `pdf.pathPdf` per language and `menus-header-pdf` with `page:23` for the bundled example. Route-level preview/download/new-tab options go inside `pdf`; `hierarchyPage.pdf` and `hierarchyMenu.pdf` order the content and menu sections.
 
 ```json
-{ "id": 23, "pdf": { "pathPdf": { "en": "gitpagedocs/docs/versions/0.0.14/en/gitpagedocs-project-guide.pdf", "pt": "gitpagedocs/docs/versions/0.0.14/en/gitpagedocs-project-guide.pdf", "es": "gitpagedocs/docs/versions/0.0.14/en/gitpagedocs-project-guide.pdf" }, "previewEnabled": true, "downloadEnabled": true, "openInNewTabEnabled": true } }
+{ "id": 23, "pdf": { "pathPdf": { "en": "gitpagedocs/docs/versions/0.0.15/en/gitpagedocs-project-guide.pdf", "pt": "gitpagedocs/docs/versions/0.0.15/en/gitpagedocs-project-guide.pdf", "es": "gitpagedocs/docs/versions/0.0.15/en/gitpagedocs-project-guide.pdf" }, "previewEnabled": true, "downloadEnabled": true, "openInNewTabEnabled": true } }
 ```
 
 The native browser viewer handles PDF previews and new tabs through validated `application/pdf` Blob URLs. Preview, download and new-tab actions all require CORS permission for external files. Opening a new tab does not navigate to the raw repository URL, so that server's Content-Type/Content-Disposition does not force a download. Browser PDF support and user preferences still apply. With preview disabled, the first download or new-tab action loads the PDF; cached bytes are reused. File/network errors and blocked pop-ups are reported without silently falling back to the raw URL.
@@ -110,13 +110,13 @@ Keep both `routes-html` and `menus-header-html` in the version configuration. Me
     "title": { "en": "DOOM: HTML example", "pt": "DOOM: exemplo HTML", "es": "DOOM: ejemplo HTML" },
     "description": { "en": "Load an interactive HTML demo", "pt": "Carregue uma demonstração HTML interativa", "es": "Carga una demostración HTML interactiva" },
     "titleIsVisible": true, "descriptionIsVisible": true, "container": "full",
-    "path": { "en": "gitpagedocs/docs/versions/0.0.14/en/doom.html", "pt": "gitpagedocs/docs/versions/0.0.14/pt/doom.html", "es": "gitpagedocs/docs/versions/0.0.14/es/doom.html" }
+    "path": { "en": "gitpagedocs/docs/versions/0.0.15/en/doom.html", "pt": "gitpagedocs/docs/versions/0.0.15/pt/doom.html", "es": "gitpagedocs/docs/versions/0.0.15/es/doom.html" }
   }],
   "menus-header-html": [{
     "id": 29,
-    "en": { "title": "DOOM: HTML example", "path-click": "gitpagedocs/docs/versions/0.0.14/en/doom.html" },
-    "pt": { "title": "DOOM: exemplo HTML", "path-click": "gitpagedocs/docs/versions/0.0.14/pt/doom.html" },
-    "es": { "title": "DOOM: ejemplo HTML", "path-click": "gitpagedocs/docs/versions/0.0.14/es/doom.html" }
+    "en": { "title": "DOOM: HTML example", "path-click": "gitpagedocs/docs/versions/0.0.15/en/doom.html" },
+    "pt": { "title": "DOOM: exemplo HTML", "path-click": "gitpagedocs/docs/versions/0.0.15/pt/doom.html" },
+    "es": { "title": "DOOM: ejemplo HTML", "path-click": "gitpagedocs/docs/versions/0.0.15/es/doom.html" }
   }]
 }
 ```