...) to API functions are no longer forwarded to
httr::GET()/httr::POST() — they are ignored.
Configure requests with options instead: virustotal.timeout
(seconds, default 60), virustotal.max_tries (default 3),
virustotal.requests_per_minute (default 4) and
virustotal.throttle (default TRUE).$response instead of an httr one. The condition classes
themselves are unchanged.VIRUSTOTAL_API_KEY
into VirustotalToken. Both variables still work for this
package, and set_key() sets both. But code that reads
VirustotalToken directly no longer sees a key set only
under the canonical name — including
rdomains::virustotal_cat(), which reports “VirusTotal API
key not found” in that case. Setting VirustotalToken, or
passing the key to that function directly, works as before.Retry-After header.httr2::req_throttle(); the “Rate limit
reached. Waiting…” message is gone (httr2 waits silently), and premium
keys can finally raise the pace via
options(virustotal.requests_per_minute=).download_file(), get_behaviour_html(),
get_behaviour_evtx(), get_behaviour_pcap() and
get_behaviour_memdump() now go through the shared HTTP
core: they gain rate limiting, retries and the package’s error classes,
none of which applied to them before.VIRUSTOTAL_API_KEY is the canonical environment variable
and wins when both are set; VirustotalToken remains
honored, and set_key() sets both. Loading the package no
longer mutates environment variables.virustotal_auth_error
instead of a bare stop().Network failures (DNS, refused connections, timeouts) now raise a
virustotal_error instead of escaping as a raw httr2
condition, so tryCatch(virustotal_error = ) covers them as
documented.
A 200 response with an empty or non-JSON body (a CDN interstitial
during an incident, say) raises a virustotal_error carrying
the status code, rather than a bare jsonlite parse error.
A server’s Retry-After is capped at 60 seconds by
default (options(virustotal.max_retry_wait=)). A
Retry-After: 3600 would otherwise have blocked the session
for an hour before raising.
Extra arguments passed to API functions now warn instead of
vanishing silently, so a typo such as cursors = cannot
leave a caller paginating the first page forever.
virustotal_info() reports usage against the
configured pace; it showed “used 10/4, remaining -6” for anyone who
raised virustotal.requests_per_minute. Requests that
reached the API and failed (404, 429) are now counted, since they spend
quota.
print() on a domain report showed the
vendors who categorized the domain under the heading
“Categories” — google.com reported “Categories:
BitDefender, Forcepoint ThreatSeeker, Sophos, …” The API keys that field
by vendor and stores the category as the value, so it now prints the
distinct categories (“search engines”, …), capped at five.
CRAN-RELEASE/CRAN-SUBMISSION files, a
Travis-era encrypted API key with no decryption code, covrpage leftovers
that shipped in the tarball, and a permanently-skipped integration test
(replaced by one gated on VT_INTEGRATION=true).inst/CITATION no longer reads a Date field
the DESCRIPTION never had.message()/warning() chatter during normal
operation.virustotal2_GET(),
virustotal2_POST()) and deprecated functions
(add_comments()). The package now exclusively uses
VirusTotal API v3.0.Analysis Endpoint: Added
get_analysis() to retrieve analysis results by ID.
File Behaviour Endpoints: New functions for sandbox analysis:
get_file_behaviour_summary(): Summary of all behaviour
reportsget_file_behaviour_mitre_trees(): MITRE ATT&CK
technique mappingsget_file_behaviours(): All behaviour reports for a
fileSandbox Report Endpoints: Access individual sandbox artifacts:
get_behaviour_report(): JSON behaviour reportget_behaviour_html(): HTML report from sandboxget_behaviour_evtx(): Windows Event Log fileget_behaviour_pcap(): Network capture fileget_behaviour_memdump(): Memory dump fileUsers upgrading from versions that used v2.0 functions should ensure their code uses the equivalent v3.0 functions.
Structured Error Handling: New S3 error classes
(virustotal_error, virustotal_auth_error,
virustotal_validation_error,
virustotal_rate_limit_error) provide detailed error
information and better debugging.
S3 Response Classes: All API responses now
return structured S3 objects (virustotal_file_report,
virustotal_domain_report, etc.) with custom
print() and summary() methods for better user
experience.
Modern Rate Limiting: Replaced environment variable-based rate limiting with a sliding window implementation that properly manages the 4 requests/minute VirusTotal API limit.
Comprehensive Input Validation: Added robust
input validation using the checkmate package with
security-focused sanitization functions.
Enhanced Security Utilities: New security functions for safe file operations and input sanitization to prevent common security issues.
Updated CI/CD: Migrated from Travis CI/AppVeyor to GitHub Actions with comprehensive testing matrix (R oldrel-1, release, devel).
Modern Dependencies: Updated minimum R version
to 4.0.0, migrated from plyr to dplyr, added
modern packages (checkmate, jsonlite,
rlang).
Enhanced Documentation: Improved documentation with roxygen2 markdown support and comprehensive examples.
Test Coverage: Expanded test suite with proper mocking support and comprehensive error handling validation.
Improved Domain Processing: Enhanced domain cleaning logic that properly handles URLs with protocols, www prefixes, and paths.
Better Error Messages: More informative error messages with parameter context and suggested fixes.
Response Formatting: Rich response formatting with detection summaries, file metadata, and threat intelligence display.
virustotal_info() function for package
configuration diagnosticsget_rate_limit_status()file_report(),
scan_file(), rescan_file(),
url_report(), scan_url(),
domain_report(), ip_report()virustotal2_* function calls from
user-facing functionsip_report()base64enc for URL encoding support