GHSA-q9mq-245r-4g93

Description

## Summary `@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project. ## Details The build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it. `quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation. ## Impact Running a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins. ## Remediation Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.