GHSA-vr5f-w35q-98jp Perses's unvalidated project parameter enables filesystem path traversal

• Go github.com/perses/perses: < 0.54.0-rc.0 → fixed in 0.54.0-rc.0

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). The path is then used to retrieve files in the database directly. Attacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to get access to other resources contained in the file database. For example `https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of the project while it must not return anything. Patches _Has the problem been patched? What versions should users upgrade to?_ Workarounds Avoid using the file system database in production. Use SQL database instead.