1.0.128

Security: fixes GHSA-r3r9-3mrh-x966 — the debug log captured httpx's request logging, which prints the full Graph API URL including the access_token query parameter, so every API call wrote the operator's token in full into a 0644 file that is never rotated.

Upgrading does not clean existing logs. Delete any meta_ads_debug.log written by an earlier version, and if logs were shipped anywhere or the host is shared, rotate the token at https://developers.facebook.com/tools/debug/accesstoken/.

What's changed

• fix(security): the log handler is attached to this package's logger with propagate = False instead of the root logger, so third-party records are no longer captured; httpx and httpcore are held at WARNING so the URL line is not emitted into host-configured logging either (#168).
• The default log level is now INFO rather than DEBUG. Set META_ADS_LOG_LEVEL=DEBUG to restore the previous verbosity.
• The log file is created 0600 inside a 0700 directory, and both are narrowed on startup if an earlier version left them wider.
• Credential prefixes (token[:10]) in log lines and in the get_login_link response are replaced by a redaction that reports the length only.

Full changelog: 1.0.127...1.0.128