A fresh Node.js library flaw shows how a fix for one symlink problem can still be outmaneuvered when filesystem reality diverges from a path string.