v1.1.1

Security

• Manifest signature is now enforced on restore. When signing is enabled
  (a Signer is bound), restore refuses any backup whose manifest signature is
  missing or invalid instead of trusting the checksum alone — closing a gap where
  a tampered manifest, or one with its signature stripped, could still be
  restored. Environments without signing keep the checksum-only behaviour, so
  unsigned backups still restore there; --no-verify remains the explicit
  opt-out.
• Database dump path now goes through the traversal guard. RestoreManager
  resolves each manifest-declared database dump path with Support\SafePath, so
  a hostile archived_path (../../…) can no longer make restore read and pipe
  an arbitrary host file into the database client.
• backup:upgrade keeps the licence token off the process argv. Credentials
  are written straight into auth.json (merging any existing entries, mode
  0600) rather than via composer config --auth, so the token is no longer
  visible to other local users through ps//proc.

Fixed

• Corrected the Pro package name to nyoncode/laravel-backup-manager-pro
  throughout config, the backup:upgrade command, runtime messages and docs so
  activation targets the actually-published package.