v1.6.0

Fixes a cookie-handling bug that has been corrupting authenticated requests in the Node SDK, bounds how far a response body may expand in both ports, raises dependency floors past known advisories, and removes the deprecated FlightRadar24 import alias.

⚠️ Breaking changes — read before upgrading

The FlightRadar24 import alias is gone (Python). It was kept after the package was renamed and had been emitting a DeprecationWarning announcing its removal.

from FlightRadar24 import FlightRadar24API   # no longer works
from FlightRadarAPI import FlightRadar24API  # use this

engines.node is now >=18.17 (Node). That is undici 6.28's real floor. On Node 18.0–18.16 with engine-strict=true, npm install will refuse; without it you get an EBADENGINE warning.

Fixed

The Node SDK was truncating your session token. Set-Cookie was split on every =, so a _frPl value containing one was stored half-cut — and that half is what getAirportDetails sent as token and getFlights as enc. If you use the Node port authenticated, those calls have been sending a broken credential. This is the fix most likely to change behaviour you can observe.

Also in the Node cookie jar, which was rewritten to honour cookie scope:

• Cookies set by one FR24 host are no longer replayed to the others (Domain, Path and Secure were previously ignored outright)
• Max-Age=0 deletes the cookie instead of storing an empty one
• A cookie whose Domain does not cover the request host is discarded rather than narrowed (RFC 6265 §5.3.6)
• Cookies are credited to the host that ended a redirect chain
• Cookies handed out by a blocked response are kept — a Cloudflare 403 is what carries cf_clearance, and discarding it made RetryPolicy replay the same blocked request

And in the Node transport:

• timeout now covers reading the response body, not just time-to-headers; a trickled response could previously hold a call open long past its deadline
• Error responses no longer abandon the body, which was forcing a fresh TCP+TLS connection on every non-2xx

Security

Response bodies are now bounded. A compressed body could expand without limit: measured, ~500 bytes on the wire reaches 300 MB, ~1.7 KB reaches 1 GB. Both ports refuse anything past a 64 MiB budget, and the cost tracks the budget rather than the payload. FR24's largest real payload uses about 2% of it.

Dependency floors now exclude known-vulnerable versions:

undici ^6.28.0	the old floor admitted 15 advisories, including request smuggling
curl_cffi>=0.15.0	GHSA-qw2m-4pqf-rmpp — redirect-based SSRF, CVSS 7.4
Brotli>=1.2.0	required for the bounded-decompression API
beautifulsoup4>=4.12.0	baseline, no advisory behind it

These were also the only three packages in the dependency graph without a resolved version, so Dependabot had never been able to report a Python finding.

CI hardening: every GitHub Action is pinned to a commit SHA, the dependency audits are enforced rather than advisory — the npm one had been silently failing to run at all — and the docs deploy no longer holds a token that can write to the repository.

Added

• DecompressionLimitError (both ports)
• max_response_bytes and max_download_bytes per request (Python)
• CloudflareError.body, carrying the challenge page (Node)
• rawCookies and url on the request result (Node)

Notes

Python users unaffected by the import rename need change nothing: the SDK now performs the gzip/deflate/brotli decoding libcurl used to do, with identical results, so the budget above can be enforced before a body expands.

Full changelog: v1.5.3...v1.6.0