basic-ftp

• Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
• Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.

• Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.

• Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).

• Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)

• Breaking change: This library does not allow separate transfer hosts by default anymore. This provides security by default against FTP bounce attacks. This FTP feature is used very rarely, there is a good chance you don't actually have to change anything in your code. You can allow separate transfer hosts by using allowSeparateTransferHost: true when instantiating a Client. (Thanks, @Jvr2022)

• Fixed: Protect against unbounded control response, fixes GHSA-rpmf-866q-6p89.

• Changed: Introduced an upper bound for total bytes of directory listing, fixes GHSA-rp42-5vxx-qpwr.
• Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.

• Fixed: Improve control character rejection, fixes GHSA-6v7q-wjvx-w8wg.

• Fixed: Reject control character injection attempts using paths. See GHSA-chqc-8p9q-pq6q.

• Changed: Skip files with invalid name in downloadToDir.

• Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

• Fixed: Memory leak described in #250 by @everhardt, @martijnimhoff

• Fixed: Handle relative paths in Client.removeDir()

• Fixed: Improve closing sequence for control socket. (#224, #228)
• Fixed: Avoid deprecation error. (#221)
• Fixed: Set default settings before login in case there are non-ascii characters in user or password. (#229, @lgpseu)

• Fixed: Use existing code path to close control socket when replacing it.
• Fixed: Destroy sockets explicitly on timeouts only.

• Fixed: Don't trust FEAT response of servers regarding EPSV. (#213)
• Fixed: Include original error message when client reports as closed.

• Breaking change: Library requires at least Node version 10.
• Changed: Use feature set as reported by server to determine transfer strategy.
• Changed: Test suite improvements to better reflect behaviour of an FTP server.
• Fixed: Issues around incomplete upload described in #205.
• Fixed: Variation of empty directory listing described in #206.
• Fixed: List parsing for specific Unix flavor described in #193.
• Fixed: Prevent late internal exceptions from sockets.
• Fixed: Stop explicitly destroying sockets, too early in rare cases.

• Fixed: Log reason why transfer modes fail when testing.

• Fixed: Only use MLSD after querying support for feature. (#187)

• Fixed: Hostname doesn't match certificates altnames for data connection. (#166, #179, @alandoherty)

• Improved: Continue trying transfer strategies even after unexpected errors. (#164)

• Fixed: Allow directory names ending with space in client.list(). (#149, @inithink)
• Fixed: Don't trim incoming message chunks.
• Fixed: Reference Node.js types in tsconfig settings.

• Fixed: Missing StringEncoding in export. (#144)

• Added: Support for implicit FTPS. (#121, @sparebytes)
• Fixed: Detection of stream being finished early. (#143)

• Fixed: Catch server closing connection without error. (#138)

• Fixed: Allow 'undefined' to be passed to trackProgress. (#125, @FabianMeul)

• Fixed: Try next available list command after any FTP error. (#117)

• Fixed: Remove eager check for remoteAddress of a socket. (#106)

• Added: Directory listings are included in transfer progress tracking.
• Fixed: Possible edge case where socket is disconnected but client still says it's open.

• Fixed: Return to former working directory also after error when calling directory-related methods.

• Changed: Current API uploadDir and downloadDir has been deprecated, use uploadFromDir and downloadToDir.
• Added: You can specifiy a custom remote directory with downloadToDir.

• Fixed regression at 4.3.0: File descriptor closed too early. (#103)

• Fixed: When downloading to a local file and an error occurs, only remove it if no data has been downloaded so far.

• Added: More explicit API uploadFrom, appendFrom and downloadTo. upload and download are still available but deprecated.
• Added: Handle file downloads and uploads directly by supporting local file paths in uploadFrom and downloadTo.
• Added: Make it easier to resume a download of a partially downloaded file. See documentation of downloadTo for more details.

• Fixed: Don't rely on MLSD types 'cdir' and 'pdir', consider names as well. (#99)

• Added: Support uploading a local directory to any specific remote directory instead of just the working directory.

• Added: Support symbolic links in MLSD listings.

• Fixed: Make MLSD listing detection more general. (#95)
• Fixed: Handle MLSD facts 'sizd', 'UNIX.gid' and 'UNIX.uid'. (#95)

• Fixed: Describe client as closed before first connection (#94)

This release contains the following breaking changes:

• Changed: The permissions property of FileInfo is now undefined if no Unix permissions are present. This is the case if for example the FTP server does not actually run on Unix. Before, permissions would have been set to 000. If permissions are present there is a good chance that a command like SITE CHMOD will work for the current server.
• Changed: MLSD is now the default directory listing command. If the connected server doesn't support it, the library will continue using the LIST command. This might have an impact on reported permissions for a file. It is possible although rare that a server running on Unix would have reported permissions with LIST but doesn't do so with MLSD.
• Changed: If you've been parsing date of FileInfo, you might have to consider a new ISO format coming with MLSD listings, e.g. 2018-10-25T12:04:59.000Z. Better yet, use the parsed date directly with modifiedAt and only use date if it is undefined. Be aware that parsing dates reported by the LIST command is likely unreliable.

Non-breaking changes:

• Added: Support for MLSD directory listing. This is a machine-readable directory listing format that provides modification dates that can be reliably parsed. Listings by the older command LIST have not been designed to be machine-readable and are notoriously hard to parse.
• Added: The property modifiedAt of FileInfo may hold a parsed date if the FTP server supports the MLSD command. Note that the property date is not parsed but only a human-readable string coming directly from the original listing response.
• Added: New API sendIgnoringError to send an FTP command and ignoring a resulting FTP error. Using the boolean flag as the second argument of send has been deprecated.
• Added: Sending OPTS UTF8 ON when accessing a server.

No changes, republishing because of bug on npmjs.com.

• Fixed: Fall back to LIST command if LIST -a is not supported. (#91)

• Fixed: Support non-standard response to EPSV by IBM i or z/OS servers. (#87)
• Fixed: Make unit tests for failing streams less dependent on platform. (#86)
• Fixed: Improve marking protected methods for JS compilation output.

• Added: Use client.append() to append to an existing file on the FTP server. (#83)

• Fixed: Use ESLint instead of TSLint.

• Added: Users can access internal transfer modes to force a specific one. (#77)
• Fixed: Handle stream error events for upload and download. (#78)

• Added: Make parseList public API. (#75, @xnerhu)
• Changed: Update Typescript 3.5.1

• Added: Client list method supports optional path argument. (#69, @ThatOdieGuy)
• Changed: Updated Typescript 3.4.4

• Fixed: Reject failing connection for passive transfer with Error instance. (#65)

• Fixed: Handle multline response message closing without message. (#63)
• Fixed: Track timeout during connect. (#64)

• Fixed: Unix directory listing in some cases interpreted as DOS listing. (#61)

• Fixed: Close the current control connection when connect creates a new one that is not an upgrade.

• Added: access and connect can reopen a closed Client.
• Fixed: access can be called again after failed login. (#56)

No changes, republishing to fix some issue on NPM.