Skip to content

3.16.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 14:30
· 91 commits to main since this release
3.16.7
b209ff8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Cache entries are read as plain data only (CVE-2025-69872): the API cache could run code from an entry planted in the cache folder, in both cache modes. Cached entries are now read with no classes or functions allowed, so existing caches still work and a planted entry is ignored and logged. #399, #401
  • Packages with known vulnerabilities updated: urllib3, soupsieve, anyio, certifi, h2, hpack, idna, pygments and setuptools are on fixed versions. #400

Scripts

  • Scripts get their whole input: the task that sends a skip-download, naming or after-download script its data could be cleaned up before it finished, and the script then waited until the timeout. #385, fixes #381
  • A script's answer is used as soon as it exits: if a script started a program that keeps running in the background, ofscraper waited for that program and on Python 3.11 reported a timeout even though the script worked. It now waits a moment for the rest of the output, uses the script's answer and logs a warning. Same on every Python version. #393, fixes #391
  • Stopping ofscraper stops its scripts: a running script, or ffmpeg, kept running when ofscraper was stopped or the call was cancelled. It's now killed, along with programs it started, including when you press Ctrl+C just as a script starts. #388 #394 #395, fixes #387
  • A killed script no longer holds things up: after a timeout or cancel, ofscraper no longer waits for programs the script started in the background. #392, fixes #389

Check commands

  • A failed download refreshes only its own creator: in post_check, msg_check, paid_check and story_check, one failed download made the retry re-scrape every creator in the check. #383, fixes #382

Logs

  • More auth values are masked: session cookies OnlyFans sends back, x-bc values not from auth.json, auth_id, user-id and the cookies whose names hold your user ID are now masked by name. The start of the TLS fingerprint seed is no longer logged. #397
  • The home folder is masked only as a whole name: with a home folder called dan, "danger" no longer turns into {home_directory}ger. #397

Other

  • --before / --after accept "1 hour ago", as they already accepted "2 hours ago". #398
  • The status line says "Couldn't check" when a network problem stops the check, instead of showing DOWN as if the auth were bad. #398

Upgrade: uv tool upgrade ofscraper-community, pipx upgrade ofscraper-community or pip install -U ofscraper-community.

Full list: 3.16.6...3.16.7

Assets 10
Loading