Andrew Nesbitt

A flaw exists where a new transfer utilizing STARTTLS to upgrade the connection may incorrectly reuse an existing live connection despite a mismatch in the TLS configuration.

A directory traversal issue exists where a `.install` field containing a destination filepath can use `../` to reach a parent directory.