jjjake/internetarchive v5.12.1

Version 5.12.1

on GitHub

Security

• The published ia pex binary for 5.12.0 bundled certifi 2026.7.22, which
  still trusts the emSign root CAs whose intermediate keys were compromised
  (GHSA-6q48-6c7w-9gw2). This release rebuilds the binary with certifi
  2026.10.19. certifi>=2026.10.19 is now also a declared dependency, so
  pip install -U internetarchive carries the fix into existing environments.
• Development and CI dependencies updated past their open advisories:
  urllib3 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689) and
  virtualenv 21.14.12 (sixteen activation-script and seed-wheel advisories).
• ia --insecure now prints a warning to stderr on every invocation that the
  request, including S3 keys and cookies, goes over unencrypted HTTP, and its
  --help text says the same. A SECURITY.md documents how to report
  vulnerabilities privately.
• The ia pex binary is now built from the versions pinned in uv.lock,
  with every bundled wheel verified against the lockfile's sha256, instead of
  from a hand-maintained list of version floors that took whatever PyPI served
  on build day. The build fails if any dependency lacks a universal wheel, so
  the binary stays platform-independent.

What's Changed

Other Changes

• Update dependencies past their open security advisories by @jjjake in #830
• Warn on every ia --insecure invocation and add SECURITY.md by @jjjake in #832
• Pin GitHub Actions to commit SHAs and add a weekly dependency audit by @jjjake in #831
• Build the pex from uv.lock with hash-checked wheels by @jjjake in #833
• Install tox in CI from a locked dependency group by @jjjake in #834
• Date the 5.12.1 changelog section by @jjjake in #835

Full Changelog: v5.12.0...v5.12.1