pypi / gdown
gdown
What changed in gdown 5 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-13.
19 breaking3 security11 new APIs and options7 behavior and defaults1 tooling24 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initgdown 655 changes
Breaking changes 15
importlib is no longer exported from the gdown package because it was listed in __all__ by accident.
Incomplete response bodies are rejected instead of being saved as completed downloads.
Removes assert_md5sum(); use hashlib for checksum verification.
Removes the md5 parameter; use the hash parameter instead, such as hash="md5:abc123".
download() raises DownloadError or its subclass FileURLRetrievalError on failure instead of returning None.
download_folder() raises DownloadError or its subclass FileURLRetrievalError on failure instead of returning None.
Removes the fuzzy parameter; gdown now extracts the file ID from any Google Drive URL format without it.
Validates archive members stay within the target directory, preventing path traversal writes outside the extraction path.
Removes FolderContentsMaximumLimitError because folder downloads now use an endpoint with no file count limit.
Removes the --fuzzy CLI flag; pass Google Drive URLs directly.
Removes the --id CLI flag; use gdown.parse_url() for URL parsing.
Removes the --remaining-ok flag; folder downloads no longer need to proceed with a partial download due to the 50-file limit.
Removes md5sum(); use hashlib for checksum verification.
Returns None instead of False for non-Google-Drive URLs.
gdown now requires Python 3.10 or later; Python 3.8 and 3.9 are no longer supported.
Security 1
The cookies file is written owner-only and keeps session cookies.
New APIs and options 11
Optional cancellation events for download() and cached_download() interrupt stalled response reads and download waits without shortening network timeouts, raising DownloadCancelled while preserving partial-file cleanup.
Adds opt-in automatic recovery of interrupted file and folder downloads, with bounded backoff and validated byte-range resume; --continue still controls reuse of earlier downloads.
Adds an installation extra for importing Chromium cookies from GNOME Keyring.
Adds --timeout SECONDS to prevent a stalled server from blocking forever.
Adds opt-in automatic recovery of interrupted file and folder downloads, with bounded backoff and validated byte-range resume.
Adds a requests-style timeout parameter to download(), download_folder(), and cached_download() so a stalled server no longer blocks forever.
Selects a cookies file other than
~/.cache/gdown/cookies.txt.Downloads using the signed-in Google account by reading cookies directly from a local browser.
Adds a parameter that resolves the target filename and ID without fetching the file, returning a GoogleDriveFileToDownload.
Lists file or folder contents as a JSON array of url and path entries on stdout instead of downloading; paths use POSIX separators, and the flag cannot be combined with -O/--output.
Adds a progress parameter to download() for hooking into download progress.
Behavior and default changes 6
Staging directories are named after their file and hidden, making leftovers from killed downloads recognizable.
Verifies hash while streaming instead of reading the finished file back from disk.
Downloads continue after individual files fail, and all failures are reported together.
Folder URLs are detected automatically;
--folderis needed only for ambiguous bare IDs.Prints a one-time beta warning to stderr when --json is used; --quiet suppresses the warning.
Folder downloads support more than 50 files using the embeddedfolderview endpoint.
Tooling 1
Adds a py.typed marker for PEP 561 support.
Fixes and other changes 21
Progress totals are reported as unknown for compressed or chunked HTTP responses instead of comparing decoded bytes against Content-Length.
Cached downloads are published atomically when the cache and destination are on different filesystems.
A download resumes only from its own partial file, avoiding reuse of a partial file for a longer filename with the same prefix.
Sanitizes Windows-invalid file and folder names when downloading from Google Drive.
Supports Google Drive file URLs ending in /preview or without a /view or /edit suffix.
An invalid --speed value now reports accepted units instead of an internal function name.
Reports a hit --timeout as a timeout instead of asking to file an issue.
Propagates progress callback exceptions unchanged instead of misreporting chunked-encoding errors as incomplete downloads.
Staging directories are removed after success or interruption, and the cache is created on demand instead of during import.
Sessions and streamed responses are closed on early exits, failures, and response replacement, including single-file Listing and resumed downloads.
Export extensions are preserved for dotted Google-native filenames.
Folder JSON export paths are fixed.
A browser cookie extraction error no longer replaces working session cookies with invalid decrypted values.
An explicitly supplied user agent is honored for file downloads within folders, while existing default user agents are retained.
Exceptions during file or folder downloads no longer leave HTTP sessions, progress bars, or output files behind.
Archive member paths returned by extractall use native path separators consistently for ZIP and tar results.
Handles a corrupted cookies file instead of crashing.
Sanitizes path separators in filenames on all platforms.
Detects Google Docs, Sheets, and Slides via URL patterns instead of page title, fixing downloads on non-English Google accounts.
Appends the correct extension for Google exports in folder downloads.
Fixes output directory detection and filename handling on Windows.
gdown 510 changes
Breaking changes 4
Rejects symlinks, hardlinks, and special files in tar archives.
Cookies are saved using MozillaCookieJar instead of JSON.
Python 2 support is dropped.
Log messages are printed to stderr instead of stdout.
Security 2
Sanitizes filenames from HTTP responses and URLs to prevent path traversal through /, \, .., and null bytes.
Uses Python 3.12+ filter="data" for tar extraction when available.
Behavior and default changes 1
The message printed by assert_md5sum is simplified.
Fixes and other changes 3
Sanitizes the root folder name before building directory paths.
Verifies the file hash before moving it to the final location, preventing corrupted files from being left there if verification fails.
Tracks downloaded bytes independently from the progress bar for speed limiting, avoiding unnecessary sleep when resuming downloads.