CVE-2024-22207: Default swagger-ui configuration exposes all files in the module

The vulnerability stems from the unconditional registration of fastify-static and the wildcard route handler in lib/routes.js. The original code: 1) Registered fastify-static with root=opts.baseDir || __dirname/.. (module directory) 2) Created a /* route that served any file via sendFile(). When baseDir wasn't set, this combination allowed access to all files in the module directory. The patch moved both the static registration and route creation inside an if (opts.baseDir) block, making them conditional. The handler function in the wildcard route is specifically vulnerable as it directly serves files from the uncontrolled root directory when baseDir is missing.