HTTrack / WinHTTrack 3.50 Alpha (2026) ====================================== Build: WinHTTrack e1ffeeb, engine 3.49-14 (nothing is tagged yet) Baseline: everything below is new since 3.49-2 (20 May 2017), the release offered on https://www.httrack.com/page/2/en/index.html These builds are ALPHA and UNSIGNED. CI produces them on every commit to master; they are not a release and have had no release testing. Windows SmartScreen will warn about them. They need Windows 7 SP1 or later, so Windows XP and Vista users must stay on 3.49-2. Report anything you find at https://github.com/xroche/httrack/issues (engine) or https://github.com/xroche/httrack-windows/issues (Windows interface). WinHTTrack (Windows interface), since 3.49-2 -------------------------------------------- + New: a "Write WARC archive" option, with the log, index and cache options regrouped on their own tab + New: the interface exposes the engine options added since 3.49-2: a cookies.txt to preload, a random pause between files, query-key stripping, the individual URL-hack toggles and the CONNECT-tunnel proxy mode + New: the About box names the selected language, and the wizard's question dialog shows the whole link + Fixed: a crash when a mirror ended with the Options or View-transfers panel open + Fixed: use-after-free on the option-page tab titles after a language change, and in the Transfers dialog reading the engine's live state + Fixed: non-ASCII arguments reached the engine in the ANSI codepage instead of UTF-8, so accented paths mirrored into mojibake directories + Fixed: DBCS trail bytes containing 0x5C were corrupted on their way to the display + Fixed: a stale language index bricked startup instead of being rebuilt + Fixed: the directory tree missed entries in large directories and re-read them needlessly + Fixed: deleting a mirror descended into reparse points instead of unlinking them + Fixed: dial-up (RAS) gave up after a failed dial + Fixed: bounded the input-driven buffer writes in the URL, filter and log paths + Fixed: the crash reporter now unwinds properly and names the faulting call + Changed: rebuilt with Visual Studio 2022 and OpenSSL 3.x; the Windows floor is now Windows 7 SP1 + Changed: the installer only ever associated .whtt, and now says so + Changed: retired the Internet Explorer toolbar and the dead Java/Flash parser targets + Changed: releases will be signed through SignPath Foundation once the project's application is accepted; these preview builds are not signed Engine (httrack), since 3.49-2 ------------------------------ 3.49-14 + New: WARC/1.1 archive output (--warc), with a sorted CDXJ index (--warc-cdx) and WACZ packaging (--wacz), also available from webhttrack (#668) + New: -%F takes named footer fields such as {url}, {lastmodified}, {mime}, {charset} and {status} instead of a fixed layout (#667) + New: a command-line guide organized by task ships with the offline documentation (#649) + Fixed: on Windows, paths beyond MAX_PATH truncated files, and mirroring into a long or non-ASCII directory silently failed (#133) + Fixed: the top index showed mojibake for non-ASCII project names and categories on Windows (#216) + Fixed: webhttrack handed the engine the web form's charset rather than UTF-8, so a non-ASCII path mirrored into a mojibake directory (#629) + Fixed: a non-ASCII single -O left the logs and the cache in a mangled twin directory on Windows (#630) + Fixed: a path-ceiling truncation dropped the .delayed marker, losing the file (#623) + Fixed: an oversized -%F footer aborted the crawl instead of being skipped (#669) + Fixed: a rejected 206 resume could loop and lose the file rather than refetch it whole (#581) + Fixed: default-port stripping was scheme-blind and dropped explicit ports from https and ftp URLs, and a :80 written with leading zeros mangled the host (#627, #638) + Fixed: -K silently reset the -c socket count (#650) + Fixed: signed-shift undefined behaviour in the zip-repair local-header read (#639) + Changed: the offline documentation drops stale facts, gains an Android help page, and documents the filter wildcards and the real long option forms + Changed: multiple internal hardening, test and CI improvements 3.49-13 + New: SOCKS5 proxy support, with scheme-aware -P URLs (socks5://, socks5h://, connect://) and plain HTTP tunneled through a CONNECT-only proxy (#563, #564) + New: decode brotli and zstd content codings, advertised over TLS only as browsers do (#556) + New: webhttrack exposes the engine options added since 3.49-2, among them --cookies-file, --pause and --strip-query (#587) + Fixed: files of 2 GB or more were mishandled on Windows and on every 32-bit build (#569) + Fixed: --update destroyed a good local copy when the re-fetch returned an HTTP error, was aborted by -M/-E, failed to decode, or came in short (#176, #521, #557, #562) + Fixed: a self-redirect cookie wall was dropped instead of being re-fetched with the cookie (#15) + Fixed: a stalled TLS handshake ignored --timeout, and synchronous DNS resolution could wedge a crawl past --max-time (#607, #613) + Fixed: -M metered saved bytes rather than received volume, and overshot its cap under a slow server (#77, #520) + Fixed: several network-facing overflows and denial-of-service paths in the Content-Range, chunked-transfer, cookie, filter and ProxyTrack cache parsers + Fixed: a failed connect did not fall back to the next address on Windows (#579) + Fixed: -P took an out-of-range port as a garbage port, and scanned past an IPv6 literal's closing bracket (#598, #602) + Fixed: reject a port outside 1..65535 wherever one is parsed (a crawled URL, the htsserver and proxytrack listen arguments, an ftp:// URL), instead of letting a bare sscanf wrap a huge value into a plausible port and silently use it (#614, #626) + Fixed: a configured proxy still resolved and dialed the origin itself (#592) + Fixed: ~/ in the -O base path was never expanded (#270) + Fixed: a non-ASCII -O output path was double-encoded on Windows once argv became UTF-8 (#621) + Fixed: files under a non-ASCII project path were saved to a mangled directory on Windows (#217) + Fixed: --build-top-index (-%i) and --protocol (-@i) were taken for the -i continue flag, wiping the URL list and exiting on the usage screen (#615) + Fixed: webhttrack ignored LC_ALL/LC_MESSAGES and picked the wrong Chinese and Portuguese (#95) + Fixed: webhttrack wrote its base path and httrack.ini to the filesystem root when $HOME was empty (#625) + Fixed: crawls on a non-default port were slowed by a per-request pre-resolve (#181) + Changed: Windows builds moved to Visual Studio 2022 and OpenSSL 3.x, the VS2008 project files are retired, and the binaries carry a version resource + Changed: removed the obsolete Java-applet (.class) parser and the dead SWF module remnants + Changed: multiple internal hardening, test and CI improvements (Windows and macOS crawl suites, HTML-parser fuzzing, parallel make check) 3.49-12 + New: --why explains which filter rule accepts or rejects a given URL, then exits (#505) + Fixed: links carrying raw UTF-8 bytes were fetched double-encoded and 404'd (#516) + Fixed: an uncompressed body mislabeled as gzip no longer loses the page (#515) + Fixed: remote stack overflow and uninitialized read in Content-Type/-Encoding parsing (#506) + Fixed: several over-reads and a leak in the filter, URL and IDNA parsers (#499) + Fixed: bound the cache-index (.ndx) parser to its buffer (#507) + Fixed: catastrophic backtracking on '*'-heavy filter patterns (#513) + Fixed: cookies.txt was created world-readable (#511) + Fixed: a single corrupt cache entry no longer aborts the whole mirror (#494) + Fixed: cache-reconcile policy was broken for zip caches (#491, #493, #495) + Fixed: cancelling a crawl mid type-check no longer orphans .delayed placeholders (#496) + Fixed: detect URLs after the first inline script and in mid-tag attributes (#497) + Changed: build with _FORTIFY_SOURCE and -fstack-protector-strong (#504) + Changed: removed the pre-3.31 (.dat/.ndx) cache import (#512) + Changed: multiple internal hardening and build improvements (libFuzzer harnesses, CodeQL, dead-code removal) 3.49-11 + New: parse robots.txt Allow rules and path wildcards per RFC 9309 (#452) + New: advertise deflate in Accept-Encoding and decode deflate responses (#450) + New: follow and media elements as embedded links (#451) + New: added modern web MIME types to the type/extension table (#448) + Fixed: enforce the -E time limit during a slow transfer instead of only between files (#481) + Fixed: sniff the leading bytes of a download so a misdeclared Content-Type no longer renames a correct URL extension + Fixed: fast transfers could be saved under their temporary .delayed placeholder name (#5, #107) + Fixed: follow a redirect that maps to the same saved file instead of writing a self-pointing stub (#159) + Fixed: several network-facing buffer overflows in the FTP, Java and HTML parsers + Fixed: the htsjava plugin could not be loaded (hidden entry points, stale library name) + Fixed: HTML-escape truncation and a cache-buffer leak in the parser + Changed: modernized the default User-Agent to an honest HTTrack identifier (#449) + Changed: decode the full WHATWG set of HTML named character references (#443) + Changed: refreshed stale HTTP status, proxy-port and TLS-floor constants (#453) + Changed: multiple internal hardening, build, test and CI improvements 3.49-10 + New: --cookies-file to preload a Netscape cookies.txt before crawling (#215) + New: --pause to space out file downloads by a random delay (#185) + New: --strip-query to drop selected query keys from the dedup naming (#112) + Changed: split the -%u URL hacks into independent --keep-www-prefix, --keep-double-slashes and --keep-query-order toggles (#271) + Fixed: follow a redirect Location after dropping its #fragment, instead of requesting the fragment and polluting the saved name (#204) + Fixed: escaped brackets inside a *[...] filter character class (#148) + Fixed: honor the server's Content-Range when resuming a partial download, instead of appending overlapping bytes (#198) + Fixed: abort the download as soon as the response type is excluded by -mime:, instead of fetching then discarding the body (#58) + Fixed: keep size-based filter rules neutral until the file size is known (#143) + Fixed: stop the mirror with a clean fatal error on a cache write failure, instead of crashing (#174, #219) + Fixed: stop the 412/416 partial re-get loop on --continue and --update (#206) + Fixed: keep an unrecognized URL tail instead of mangling it to .html (#115) + Fixed: honor --tolerant (-%B) on a broken Content-Length, and fix an out-of-bounds read it exposed (#32, #41) + Fixed: fall back to the next resolved address when a connection fails or stalls, instead of hanging on a dead IPv6 address + Fixed: report why a -%L URL list could not be loaded (#49) + Changed: multiple internal hardening, build and CI improvements 3.49-9 + Fixed: file-type detection from the Content-Type header: trust a declared type over a binary URL extension, honor --assume under the delayed type check, and keep a known extension against a bogus or empty Content-Type (#267, #29, #56) + Fixed: an uninitialized-buffer read when the Content-Type is empty (#411) + Fixed: restored C++ source-compatibility of the installed headers so reverse dependencies (httraqt) build again (#413) + Changed: multiple internal build, packaging and test-harness improvements 3.49-8 + New: tunnel HTTPS downloads through the configured HTTP proxy via CONNECT (#85) + New: parse every candidate URL in and srcset lists (#326) + Changed: dropped the obsolete OpenSSL linking exception (OpenSSL 3.0+ is Apache-2.0 and GPL-compatible); httrack is now plain GPLv3-or-later + Fixed: several out-of-bounds reads in the HTML/CSS parser on hostile input (#94, #396) + Fixed: stored XSS via an unescaped URL in the generated page footer (#165) + Fixed: hardened buffer copies throughout the engine against overflow + Fixed: capture conditional CSS @import URLs (#94) + Fixed: don't crawl xmlns namespace declarations as links (#191) + Fixed: don't mistake the method argument of XMLHttpRequest.open for a URL (#218) + Fixed: percent-encode parentheses when rewriting CSS url() targets (#163) + Fixed: collapse ../ in file:// URLs and widen relative-link handling (#137, #162) + Fixed: drop the obsolete $Version/$Path attributes from the request Cookie header, per RFC 6265 (#151) + Fixed: keep empty quoted arguments when reloading doit.log for --update/--continue (#106) + Fixed: raise the User-Agent and custom-header length limits (#152) + Fixed: abort on a long log path (lock-file buffer too small) (#183) + Fixed: race in lazy mutex initialization (#297) + Fixed: sub-second mtime precision when comparing local files on POSIX (#383) + Fixed: modernize OpenSSL TLS initialization for the 3.x to 4.x transition (#308) + Fixed: in-place changes made by the postprocess callback were not applied (Roman Sęk) + Fixed: "preffered" typo in the help text and man page (yosinn1-blip) + Fixed: corrections and updates of the Russian translation (German Aizek) + Fixed: corrections and updates of the Danish translation (scootergrisen) + Fixed: link libhtsjava and the libtest examples directly against libc + New: documented the public library API headers and typed the option fields as named enums + Fixed: numerous build, packaging, CI and test-coverage improvements (out-of-tree builds, sanitizer/distcheck CI, shell and Python linting, AppStream metainfo) 3.49-7 + Fixed: keep generated config.h architecture-independent (Debian #1133728) + Fixed: man page rendered the -%! warning as bogus options (Debian #1061053) 3.49-6 + Fixed: puny_decode CVE-2017-14062 3.49-5 + Fixed: MiniZip CVE-2023-45853 + Lintian fixes, multiple build fixes 3.49-4 + New: Push default bandwidth to 100kiB/s, max to 10MiB/s + Fixed: Multiple packaging and build fixes, added security flags 3.49-3 + Fixed: Corrections and updates of the Brazilian Portuguese translations (Paulo Neto) + Fixed: Fixed for Android + Fixed: Add mimetypes for documents (Pablo Castellano) + Fixed: Add firefox-developer-edition (sickcodes) + New: Support data-src and data-srcset for img (Brian 'Redbeard' Harrington) + Fixed: When using the '%N' structure naming key, separate the filename and extension with a dot (Steve Mokris) + Fixed: Multiple build updates