🚀 ytdl-material 1.3.1

Safer downloads, logs and media paths.

🛠️ Fixes

Debug logs hide credentials even when downloader options use short names, abbreviations or attached values. #634
Media path checks follow symbolic links and .. the way the operating system does, so a stored path cannot use them to read outside the media folders. Files whose names start with two dots are accepted again. #634
Saved subscriptions have their custom arguments and output templates checked each time they run, including older records and subscriptions restored from a backup. #634
Custom downloader options keep their values when arguments are combined or filtered. Options missing a value are skipped, and repeated options and options taking several values are handled correctly. #634

New security checks scan dependencies, committed credentials, workflows, the running app and container images. CodeQL findings now fail CI, and a release waits for its image to pass a vulnerability scan. Fuzz tests exercise download arguments, paths, request handling and log redaction. #634
The container drops an unused service manager and updates its bundled npm to address known vulnerabilities. #634
HTTP hardening adds X-Content-Type-Options: nosniff and removes X-Powered-By. #634
The Vite development server is updated to fix editor-launch vulnerabilities. #631
Backend test jobs fetch ffmpeg from BtbN's current master build. #629
Dependency refreshes; both package trees audit clean. #627 #628 #630 #632 #633

A saved subscription with a disallowed custom argument now logs the problem and runs with its ordinary arguments. An output template that escapes the download folder falls back to the default. Check older or restored subscriptions if they rely on these settings. #634

Full Changelog: v1.3.0...v1.3.1

Changes by @voc0der.