Ghost FTP 0.95.53 Preview

Ghost FTP 0.95.53

Scope

• Version 0.95.53 is a Preview, never stable or FINAL. The six verified source CI gate families remain mandatory.
• Correct legacy v0.95.51 release metadata only after verifying the pinned 21 artifacts and original tag. Future edition retention keeps ten most recently published, verified release packages, removing older release entries and their matching tags as requested.
• Keep exact native WebView2 screenshot provenance (current latest published version 0.95.52), independent of historical source tag pruning.
• Expanded cross-platform security and full dead-code audit: Rust/React, Kotlin, Swift, Go, release/security scripts, profile/secret stores and OS file operations. Static scans cannot substitute for independent penetration tests, physical hardware runs, >4GiB transfer checks or signing.

Open production gates

• Native macOS FTPS (TLS control and data certificate validation) and SFTP (SSH host-key verification) are not production-complete in this release.
• Windows Authenticode, Android Play signing/data-preserving upgrade and macOS notarization remain absent.
• Offline/physical macOS and Fedora native installation acceptance, all 75 reference screen parity and vendor-authenticated cloud transfers remain unverified.

Corrected npm security dependency before first public 0.95.53 release

• GitHub Actions detected an unexpected high/critical advisory in Vite 8.3.1 during post-merge 0.95.53 quality checks. The original 0.95.53 commit was never published.
• The rescue rebuild pins Vite 8.3.4, regenerates the complete npm lockfile through npm, and re-runs npm audit, TypeScript and frontend build. All other platform tests and SHA-256 release asset validation remain mandatory.
• Do not re-tag any existing source SHA or skip a failed audit. Release is permitted only from the exact corrected commit after six successful CI workflow families.