In spite of what the code comment says, a path dependency declared inside a nested package's build.zig.zon can currently use .. to walk outside the project directory, and zig build is able to happily fetch, compile, and link that external code without any error.
Fixes this:
- When the parent has a manifest, check directly that the resolved path is within the parent package's sub_path.
- For a parent at the root of its root_dir, any sub_path that begins with ".." is rejected
- For deeper parents, a separator must follow the common prefix.
In spite of what the code comment says, a path dependency declared inside a nested package's `build.zig.zon` can currently use `..` to walk outside the project directory, and `zig build` is able to happily fetch, compile, and link that external code without any error.
Fixes this:
- When the parent has a manifest, check directly that the resolved path is within the parent package's sub_path.
- For a parent at the root of its root_dir, any sub_path that begins with ".." is rejected
- For deeper parents, a separator must follow the common prefix.