pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir

NestedSecretsSettingsSource in pydantic-settings follows symbolic links pointing outside the configured secrets_dir, bypassing the secrets_dir_max_size protection and allowing unintended local file reads into settings values.

Applications using NestedSecretsSettingsSource with secrets_nested_subdir=True and a secrets_dir whose entries can be influenced by an attacker or lower-privileged component.

Upgrade to pydantic-settings 2.14.2 or ensure the configured secrets_dir is fully controlled and avoid secrets_nested_subdir=True if upgrading is not possible.