v1.2.1-minor changes

Full Changelog: v1.2.1...v1.2.1

v1.2.0 — OIDC Trusted Publishing & CI improvements

What's changed

CI/CD

• Switched npm publish to OIDC Trusted Publishing (no static token required)
• Fixed FTP pre-cleanup using lftp with SSL cert bypass for shared hosting
• Fixed stale .deploy-sync-state causing "bad object" errors on CI
• Added workflow_dispatch for manual publish re-runs

v1.1.1 — Security & Reliability Patch

What's changed

Security fixes

• FTPS: Certificate validation is now enabled by default. Self-signed cert support requires explicit insecure: true in config (previously always disabled)
• Config: Warns when password is read from the YAML file instead of .env

Bug fixes

• Deleted files now correctly respect exclude glob patterns
• Filenames with spaces or special characters no longer break uploads (null-terminated git output)
• Private key paths starting with ~ are now correctly expanded
• Remote sync state hash is validated before use — corrupted state files now give a clear, actionable error
• Temp files moved to os.tmpdir() with PID suffix to prevent race conditions on parallel runs

Improvements

• Connection timeouts added for both FTP and SFTP
• engines field added — requires Node.js >=16
• Protocol validation: unsupported protocols now fail with a clear error