...) to API
functions are no longer forwarded to httr::GET()/httr::POST() — they
are ignored. Configure requests with options instead:
virustotal.timeout (seconds, default 60), virustotal.max_tries
(default 3), virustotal.requests_per_minute (default 4) and
virustotal.throttle (default TRUE).$response
instead of an httr one. The condition classes themselves are unchanged.VIRUSTOTAL_API_KEY into
VirustotalToken. Both variables still work for this package, and
set_key() sets both. But code that reads VirustotalToken directly no
longer sees a key set only under the canonical name — including
rdomains::virustotal_cat(), which reports "VirusTotal API key not found"
in that case. Setting VirustotalToken, or passing the key to that
function directly, works as before.Retry-After header.httr2::req_throttle(); the "Rate limit reached. Waiting..." message is
gone (httr2 waits silently), and premium keys can finally raise the pace
via options(virustotal.requests_per_minute=).download_file(), get_behaviour_html(), get_behaviour_evtx(),
get_behaviour_pcap() and get_behaviour_memdump() now go through the
shared HTTP core: they gain rate limiting, retries and the package's
error classes, none of which applied to them before.VIRUSTOTAL_API_KEY is the
canonical environment variable and wins when both are set;
VirustotalToken remains honored, and set_key() sets both. Loading the
package no longer mutates environment variables.virustotal_auth_error instead of a bare
stop().Network failures (DNS, refused connections, timeouts) now raise a
virustotal_error instead of escaping as a raw httr2 condition, so
tryCatch(virustotal_error = ) covers them as documented.
A 200 response with an empty or non-JSON body (a CDN interstitial during an
incident, say) raises a virustotal_error carrying the status code, rather
than a bare jsonlite parse error.
A server's Retry-After is capped at 60 seconds by default
(options(virustotal.max_retry_wait=)). A Retry-After: 3600 would
otherwise have blocked the session for an hour before raising.
Extra arguments passed to API functions now warn instead of vanishing
silently, so a typo such as cursors = cannot leave a caller paginating
the first page forever.
virustotal_info() reports usage against the configured pace; it showed
"used 10/4, remaining -6" for anyone who raised
virustotal.requests_per_minute. Requests that reached the API and failed
(404, 429) are now counted, since they spend quota.
print() on a domain report showed the vendors who categorized the
domain under the heading "Categories" — google.com reported
"Categories: BitDefender, Forcepoint ThreatSeeker, Sophos, ..." The API
keys that field by vendor and stores the category as the value, so it now
prints the distinct categories ("search engines", ...), capped at five.
CRAN-RELEASE/CRAN-SUBMISSION files, a Travis-era
encrypted API key with no decryption code, covrpage leftovers that
shipped in the tarball, and a permanently-skipped integration test
(replaced by one gated on VT_INTEGRATION=true).inst/CITATION no longer reads a Date field the DESCRIPTION never had.message()/warning() chatter during
normal operation.virustotal2_GET(), virustotal2_POST()) and deprecated functions (add_comments()). The package now exclusively uses VirusTotal API v3.0.Analysis Endpoint: Added get_analysis() to retrieve analysis results by ID.
File Behaviour Endpoints: New functions for sandbox analysis:
get_file_behaviour_summary(): Summary of all behaviour reportsget_file_behaviour_mitre_trees(): MITRE ATT&CK technique mappingsget_file_behaviours(): All behaviour reports for a fileSandbox Report Endpoints: Access individual sandbox artifacts:
get_behaviour_report(): JSON behaviour reportget_behaviour_html(): HTML report from sandboxget_behaviour_evtx(): Windows Event Log fileget_behaviour_pcap(): Network capture fileget_behaviour_memdump(): Memory dump fileUsers upgrading from versions that used v2.0 functions should ensure their code uses the equivalent v3.0 functions.
Structured Error Handling: New S3 error classes (virustotal_error, virustotal_auth_error, virustotal_validation_error, virustotal_rate_limit_error) provide detailed error information and better debugging.
S3 Response Classes: All API responses now return structured S3 objects (virustotal_file_report, virustotal_domain_report, etc.) with custom print() and summary() methods for better user experience.
Modern Rate Limiting: Replaced environment variable-based rate limiting with a sliding window implementation that properly manages the 4 requests/minute VirusTotal API limit.
Comprehensive Input Validation: Added robust input validation using the checkmate package with security-focused sanitization functions.
Enhanced Security Utilities: New security functions for safe file operations and input sanitization to prevent common security issues.
Updated CI/CD: Migrated from Travis CI/AppVeyor to GitHub Actions with comprehensive testing matrix (R oldrel-1, release, devel).
Modern Dependencies: Updated minimum R version to 4.0.0, migrated from plyr to dplyr, added modern packages (checkmate, jsonlite, rlang).
Enhanced Documentation: Improved documentation with roxygen2 markdown support and comprehensive examples.
Test Coverage: Expanded test suite with proper mocking support and comprehensive error handling validation.
Improved Domain Processing: Enhanced domain cleaning logic that properly handles URLs with protocols, www prefixes, and paths.
Better Error Messages: More informative error messages with parameter context and suggested fixes.
Response Formatting: Rich response formatting with detection summaries, file metadata, and threat intelligence display.
virustotal_info() function for package configuration diagnosticsget_rate_limit_status()file_report(), scan_file(), rescan_file(), url_report(), scan_url(), domain_report(), ip_report()virustotal2_* function calls from user-facing functionsip_report()base64enc for URL encoding support