pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement (CVE-2026-50016) | HOL Guard CVE