Ghost FTP 0.95.19 — FileZilla import and XML safety

Implemented development source behavior

• Preserve nested FileZilla Site Manager folder paths in existing Ghost FTP Sites grouping; nested hierarchies are represented as a flat breadcrumb group label, not a nested tree UI.
• Parse real-style FileZilla exported site display names as trailing Server text when no explicit Name exists.
• Limit XML source to 8 MiB, 2,048 imported sites and 32 nested folders; reject DTDs, malformed XML escapes and truncated folder/server records.
• Imported credentials remain blank and implicit FTPS is safely skipped; FileZilla optional TLS never silently downgrades to plaintext.
• Regression tests cover grouping into persisted ConnectionProfile, export name forms and rejected inputs.

Required acceptance

All six CI workflows must pass on one exact SHA: Ghost FTP quality, protocol E2E, native build (including Windows screenshot QA and packaged lifecycle), Android, macOS, and Validate Windows hardening. No release before checks and required approval. Live multi-vendor FTP compatibility, real-device Android SAF issue #127, account-based OAuth #128, macOS secure FTPS/SFTP and 75-screen 1:1 visual acceptance remain open.

Previous published version: v0.95.18. This document is an unreleased candidate, not publication proof.