5.2.2

• Fixed: Improve control character rejection, fixes GHSA-6v7q-wjvx-w8wg.

5.2.1

• Fixed: Reject control character injection attempts using paths. See GHSA-chqc-8p9q-pq6q.

5.2.0

• Changed: Skip files with invalid name in downloadToDir.

5.1.0

• Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

5.0.5

• Fixed: Memory leak described in #250 by @everhardt, @martijnimhoff

5.0.4

• Fixed: Handle relative paths in Client.removeDir()

5.0.3

• Fixed: Improve closing sequence for control socket. (#224, #228)
• Fixed: Avoid deprecation error. (#221)
• Fixed: Set default settings before login in case there are non-ascii characters in user or password. (#229, @lgpseu)

5.0.2

• Fixed: Use existing code path to close control socket when replacing it.
• Fixed: Destroy sockets explicitly on timeouts only.

5.0.1

• Fixed: Don't trust FEAT response of servers regarding EPSV. (#213)
• Fixed: Include original error message when client reports as closed.

5.0.0

• Breaking change: Library requires at least Node version 10.
• Changed: Use feature set as reported by server to determine transfer strategy.
• Changed: Test suite improvements to better reflect behaviour of an FTP server.
• Fixed: Issues around incomplete upload described in #205.
• Fixed: Variation of empty directory listing described in #206.
• Fixed: List parsing for specific Unix flavor described in #193.
• Fixed: Prevent late internal exceptions from sockets.
• Fixed: Stop explicitly destroying sockets, too early in rare cases.