[GHSA-p9cv-8g75-4xcg] - Symlink swap after validation lets read_text_file return files outside allowedDirectories #5513

Tracked the public fix for two published @modelcontextprotocol/server-filesystem security advisories:

• GHSA-p9cv-8g75-4xcg: Symlink swap after validation lets read_text_file return files outside allowedDirectories
• GHSA-7m4x-rv66-mxhh: server-filesystem: move_file's same-device rename leaves the source unpinned — a swapped source parent moves an outside file into the allowed directories, where it becomes readable

Fixed by #5516, shipped in @modelcontextprotocol/server-filesystem 2.3.0 in the v2.4.0 release. The advisories carry the details, the affected versions and the credits.