switchback 0.6.0__tar.gz → 0.6.1__tar.gz

{switchback-0.6.0 → switchback-0.6.1}/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to this project are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/); this project uses semantic-ish
 versioning while pre-1.0.
 
+## [0.6.1] - 2026-10-14
+
+### Fixed
+- **camoufox geoip on fresh installs.** camoufox 0.5 swapped `geoip2` for
+  `maxminddb` in its `[geoip]` extra, so tier_5 decided geoip was missing and ran
+  proxied sessions without matching locale/timezone. It now asks camoufox's own
+  flag, which works on 0.4 and 0.5.
+
+### Changed
+- **Newer Chrome TLS fingerprints in tier_2** (`chrome142`, `chrome145`,
+  `chrome146` instead of `chrome131`, `chrome136`, `chrome142`); two-year-old
+  Chrome versions are a fingerprint tell. Needs `curl_cffi>=0.15`, now the floor.
+- **Security floors:** `pypdf>=6.19` (older releases have DoS CVEs on crafted
+  PDFs, which this library parses from the web) and `requests>=2.33`
+  (CVE-2024-35195, CVE-2024-47081, CVE-2026-25645).
+- **arXiv calls no longer send the maintainer's email.** tier_1's arXiv
+  User-Agent named a fixed contact address on every install; it now names the
+  project URL, and `SCRAPER_ARXIV_CONTACT` adds your own address if you want one.
+
 ## [0.6.0] - 2026-10-14
 
 ### Added

{switchback-0.6.0 → switchback-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: switchback
-Version: 0.6.0
+Version: 0.6.1
 Summary: One cost-ordered scrape cascade (HTTP → stealth browser → paid), shared by every tool.
 Author-email: Akash Kodavuru <akash@theaklabs.com>
 License: MIT
@@ -27,9 +27,9 @@ License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: markdownify
 Requires-Dist: beautifulsoup4
-Requires-Dist: pypdf
-Requires-Dist: requests
-Requires-Dist: curl_cffi
+Requires-Dist: pypdf>=6.19
+Requires-Dist: requests>=2.33
+Requires-Dist: curl_cffi>=0.15
 Provides-Extra: cloudflare
 Requires-Dist: cloudscraper; extra == "cloudflare"
 Provides-Extra: browser
@@ -398,6 +398,7 @@ export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
 - `SCRAPER_PROXY` — route *all* tiers/URLs through a proxy
 - `SCRAPER_EGRESS_PROXY` — route only walled hosts through a proxy (see [Cost-scoped residential egress](#cost-scoped-residential-egress))
 - `SEARXNG_URL` — defaults to `http://localhost:8888`
+- `SCRAPER_ARXIV_CONTACT` — optional email added to the User-Agent of arXiv API calls (arXiv asks clients to identify themselves; the default names only the project URL)
 - `SCRAPER_STATE_DIR` — where the botwall DB/event log + session cache live
 - `SCRAPER_COOKIES_FILE` — Netscape `cookies.txt` to scrape login-gated hosts (injected into the HTTP and browser tiers)
 - `SCRAPER_CAPTCHA_PROVIDER` + `SCRAPER_CAPTCHA_API_KEY` — opt-in, off by default: wire a third-party solver (2captcha/capsolver/capmonster/anticaptcha/deathbycaptcha/9kw) into tier_3 for Turnstile/reCAPTCHA/hCaptcha on CF hosts. **Paid**, billed per solve by the provider.

{switchback-0.6.0 → switchback-0.6.1}/README.md

@@ -333,6 +333,7 @@ export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
 - `SCRAPER_PROXY` — route *all* tiers/URLs through a proxy
 - `SCRAPER_EGRESS_PROXY` — route only walled hosts through a proxy (see [Cost-scoped residential egress](#cost-scoped-residential-egress))
 - `SEARXNG_URL` — defaults to `http://localhost:8888`
+- `SCRAPER_ARXIV_CONTACT` — optional email added to the User-Agent of arXiv API calls (arXiv asks clients to identify themselves; the default names only the project URL)
 - `SCRAPER_STATE_DIR` — where the botwall DB/event log + session cache live
 - `SCRAPER_COOKIES_FILE` — Netscape `cookies.txt` to scrape login-gated hosts (injected into the HTTP and browser tiers)
 - `SCRAPER_CAPTCHA_PROVIDER` + `SCRAPER_CAPTCHA_API_KEY` — opt-in, off by default: wire a third-party solver (2captcha/capsolver/capmonster/anticaptcha/deathbycaptcha/9kw) into tier_3 for Turnstile/reCAPTCHA/hCaptcha on CF hosts. **Paid**, billed per solve by the provider.

{switchback-0.6.0 → switchback-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "switchback"
-version = "0.6.0"
+version = "0.6.1"
 description = "One cost-ordered scrape cascade (HTTP → stealth browser → paid), shared by every tool."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -37,9 +37,9 @@ classifiers = [
 dependencies = [
     "markdownify",
     "beautifulsoup4",
-    "pypdf",
-    "requests",
-    "curl_cffi",      # tier1: TLS-impersonating HTTP
+    "pypdf>=6.19",    # older releases hang or blow up memory on crafted PDFs (DoS CVEs)
+    "requests>=2.33", # CVE-2024-35195, CVE-2024-47081, CVE-2026-25645
+    "curl_cffi>=0.15",  # tier_2: TLS-impersonating HTTP (chrome145/146 targets)
 ]
 
 [project.optional-dependencies]

{switchback-0.6.0 → switchback-0.6.1}/switchback/tiers/tier_1.py

@@ -64,9 +64,11 @@ def _arxiv(arxiv_id: str, url: str) -> str:
     # arxiv wants plain requests + an identifying UA (their published guidance);
     # impersonating Chrome triggers aggressive 429s from their Akamai front-end.
     import requests
+    # The contact is the operator's to give, so it's opt-in; the project URL identifies the client.
+    contact = os.getenv("SCRAPER_ARXIV_CONTACT", "").strip()
+    ua = f"switchback/1.0 (+https://github.com/akash-kr/switchback{'; mailto:' + contact if contact else ''})"
     r = requests.get(f"https://export.arxiv.org/api/query?id_list={arxiv_id}",
-                     timeout=_TIMEOUT_S,
-                     headers={"User-Agent": "switchback/1.0 (mailto:akash@theaklabs.com)"})
+                     timeout=_TIMEOUT_S, headers={"User-Agent": ua})
     r.raise_for_status()
     ns = {"atom": "http://www.w3.org/2005/Atom"}
     entry = ET.fromstring(r.text).find("atom:entry", ns)

{switchback-0.6.0 → switchback-0.6.1}/switchback/tiers/tier_2.py

@@ -37,7 +37,7 @@ _TIMEOUT_S = float(os.getenv("SCRAPER_TIER_2_TIMEOUT_S", "15"))
 
 # Recent Chrome JA3 targets available in curl_cffi 0.15.x. A small spread of real
 # versions mirrors how live traffic is distributed across Chrome releases.
-_IMPERSONATE_TARGETS = ("chrome131", "chrome136", "chrome142")
+_IMPERSONATE_TARGETS = ("chrome142", "chrome145", "chrome146")
 
 
 def _impersonate_for(url: str) -> str:

{switchback-0.6.0 → switchback-0.6.1}/switchback/tiers/tier_5.py

@@ -13,6 +13,7 @@ before the paid Firecrawl tier.
 """
 from __future__ import annotations
 
+import importlib
 import logging
 import os
 
@@ -43,14 +44,15 @@ def disabled() -> bool:
 
 
 def _geoip_available() -> bool:
-    """camoufox's geoip matching needs the `geoip2` package (the camoufox[geoip]
-    extra). Without it, requesting geoip raises and kills the whole tier — so we
-    probe and degrade gracefully instead."""
-    try:
-        import geoip2  # noqa: F401
-        return True
-    except Exception:
-        return False
+    """camoufox's geoip matching needs its camoufox[geoip] extra (`geoip2` before
+    0.5, `maxminddb` from 0.5). Without it, requesting geoip raises and kills the
+    whole tier — so we ask camoufox itself and degrade gracefully instead."""
+    for module in ("camoufox.geolocation", "camoufox.locale"):  # 0.5+, then 0.4
+        try:
+            return bool(importlib.import_module(module).ALLOW_GEOIP)
+        except (ImportError, AttributeError):
+            continue
+    return False
 
 
 def _launch_opts() -> dict:

{switchback-0.6.0 → switchback-0.6.1}/switchback.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: switchback
-Version: 0.6.0
+Version: 0.6.1
 Summary: One cost-ordered scrape cascade (HTTP → stealth browser → paid), shared by every tool.
 Author-email: Akash Kodavuru <akash@theaklabs.com>
 License: MIT
@@ -27,9 +27,9 @@ License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: markdownify
 Requires-Dist: beautifulsoup4
-Requires-Dist: pypdf
-Requires-Dist: requests
-Requires-Dist: curl_cffi
+Requires-Dist: pypdf>=6.19
+Requires-Dist: requests>=2.33
+Requires-Dist: curl_cffi>=0.15
 Provides-Extra: cloudflare
 Requires-Dist: cloudscraper; extra == "cloudflare"
 Provides-Extra: browser
@@ -398,6 +398,7 @@ export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
 - `SCRAPER_PROXY` — route *all* tiers/URLs through a proxy
 - `SCRAPER_EGRESS_PROXY` — route only walled hosts through a proxy (see [Cost-scoped residential egress](#cost-scoped-residential-egress))
 - `SEARXNG_URL` — defaults to `http://localhost:8888`
+- `SCRAPER_ARXIV_CONTACT` — optional email added to the User-Agent of arXiv API calls (arXiv asks clients to identify themselves; the default names only the project URL)
 - `SCRAPER_STATE_DIR` — where the botwall DB/event log + session cache live
 - `SCRAPER_COOKIES_FILE` — Netscape `cookies.txt` to scrape login-gated hosts (injected into the HTTP and browser tiers)
 - `SCRAPER_CAPTCHA_PROVIDER` + `SCRAPER_CAPTCHA_API_KEY` — opt-in, off by default: wire a third-party solver (2captcha/capsolver/capmonster/anticaptcha/deathbycaptcha/9kw) into tier_3 for Turnstile/reCAPTCHA/hCaptcha on CF hosts. **Paid**, billed per solve by the provider.

{switchback-0.6.0 → switchback-0.6.1}/switchback.egg-info/requires.txt

@@ -1,8 +1,8 @@
 markdownify
 beautifulsoup4
-pypdf
-requests
-curl_cffi
+pypdf>=6.19
+requests>=2.33
+curl_cffi>=0.15
 
 [all]
 cloudscraper