4.2.0

Fixes

• Closed an open-redirect in the admin FileStorageController::delete() action: the ?redirect= query string was forwarded straight into Controller::redirect(), allowing a 302 to any absolute URL after the destructive action. The handler now only honours relative internal paths (and the existing redirect=ref referer mode).
• Hardened Filesystem\Folder::realpath() against path traversal. After canonicalization the resolved path must stay under the folder's pwd(); absolute paths and .. walks that escape the seeded directory now return false. Behaviour change: external callers that previously relied on realpath() to resolve arbitrary out-of-tree paths will need to construct a fresh Folder for each base.
• Utility\StorageUtils::fileToUploadedFile{Object,Array}() now throw InvalidArgumentException when the source path is not a readable regular file, instead of silently producing a corrupted upload entity from filesize() === false.
• Command\ImageVariantGenerateCommand::getTransformer() no longer drops a configured dataTransformer. The previous logic only assigned the default branch and ignored any configured implementation, leaving the field null and tripping the internal assert().

Improvements

• New allow-list helpers on Model\Validation\UploadValidationTrait:
  • hasAllowedExtension(array $extensions) — case-insensitive, leading-dot tolerant, accepts both UploadedFileInterface and array shapes.
  • hasAllowedMimeType(array $mimes, bool $sniff = true) — sniffs server-side via finfo against the actual file contents by default, so the client-supplied Content-Type header cannot be spoofed. Pass $sniff = false for tests when you need to fall back to the client header.
• Command\CleanupCommand::removeOrphanedFiles() allowlist is now an O(1) hash set keyed by absolute path. The previous in_array() walk was O(n*m) and could time out part-way through cleanup on directories with many thousand files, leaving the storage tree inconsistent.
• Admin UI is fully CSP-compatible — no inline scripts or styles (#21).
• Renamed the shadowing entity loop variable in FileAssociationBehavior::findAndRemovePreviousFile() to existing so the outer parameter is no longer clobbered after the loop.

Full Changelog: 4.1.1...4.2.0