Found during review of PR #320 (pre-existing, not introduced there): docs/dev-server.js lacks the ROOT-prefix path-traversal guard that test-server.js applies to its general file-serving path (resolved path must stay within ROOT, else 403). Since dev-server now mirrors test-server's Elements handling (NOJS_ELEMENTS_PATH, #317), bring its file-serving path up to the same guard for parity. Dev-only server, low severity, but cheap to fix.
Found during review of PR #320 (pre-existing, not introduced there): docs/dev-server.js lacks the ROOT-prefix path-traversal guard that test-server.js applies to its general file-serving path (resolved path must stay within ROOT, else 403). Since dev-server now mirrors test-server's Elements handling (NOJS_ELEMENTS_PATH, #317), bring its file-serving path up to the same guard for parity. Dev-only server, low severity, but cheap to fix.