NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
PyPI · #1980 most downloaded on PyPI
A utility to fetch and download python packages
Last release 1 months ago
14 Aug 2026
Release timing varies
gaps range from 8 days to 8 months
Most releases are documented
notes for 44 of 49 stable releases
Nothing withdrawn
no release was ever pulled
4 years old
49 releases · first in 2022
One column per quarter.
Complete path traversal protection by replacing os.makedirs with safe_makedirs ( CVE-2026-73030 ) - by @frostming in #186 (8b922)
Allow again branches in git URLs - by @nyoxi in #171 (0fac6)
Ensure repository is reset to the correct revision during fetch - by @frostming (66268)
Support Python 3.14 and drop support for Python 3.8 - by @frostming in #167 (244bb)
Do not use Path.from_uri() - by @frostming (87599)
Git checkout with short commit hash - by @frostming (46012)
Update contributing guidelines for rebase branch - by @wimglenn in #152 (9f843)
Really drop python<=3.7 support - by @kloczek in #142 (f54d5)
Don't show warning message when no netrc exists - by @enku in #140 (ac504)
Show warning message when failing to parse netrc file Close #124 - by @frostming in #124 (9ee45)
Allow using local file:// locations with find_links and index_urls - by @frostming in https://github.com/frostming/unearth/issues/132 (a9412)
New method check_wheel_tags for override - by @frostming (717b4)
Add keyring cli get creds mode - by @ZlatyChlapec in https://github.com/frostming/unearth/issues/127 (4a7d7)
Skip netrc when parse failed - by @frostming in https://github.com/frostming/unearth/issues/121 (07d5d)
Allow passing headers to package finder - by @frostming (2e29f)
Incorrect username when using system keyring CLI - by @frostming in https://github.com/frostming/unearth/issues/114 (1ce69)
Close local files after read - by @frostming (fc157)
Support exclude_newer_than evaluation - by @frostming (e5853)
Remove the hashes argument from PackageFinder.build_evaluator that is deprecated before - by @frostming (4c8b4)
PackageFinder.build_evaluator that is deprecated before - by @frostming <samp>(4c8b4)</samp>Drop support for Python 3.7 - by @bswck in https://github.com/frostming/unearth/issues/93 (80ba3)
Match index url with the same netloc - by @frostming (b43f3)
Add callback to report download status - by @frostming in https://github.com/frostming/unearth/issues/78 (049c8)
security: Validate the package name extracted from the part before the last hyphen - by @frostming in https://github.com/frostming/unearth/issues/77 (
Also fallback on "__token__" username for KeyringCliProvider - by @deronnax in https://github.com/frostming/unearth/issues/71 (1b23c)
Handle 403 same as 401, and look for credentials on 404 error - by @logangrado, Logan Grado, pre-commit-ci[bot] and Frost Ming in https://github.com/f
Postpone the validation of hashes - by @frostming in https://github.com/frostming/unearth/issues/62 (f0aea)
Migrate from deprecated pdm.pep517 to pdm.backend - by @kloczek in https://github.com/frostming/unearth/issues/58 (992e6)
Fix the dist info link evaluation - by @frostming (0c175)
cli: Exposing requires-python, platform and abi interface for cli tools. - by @frostming in https://github.com/frostming/unearth/issues/52 (b9935)
Allow to order the index urls and find links together for PackageFinder - by @frostming in https://github.com/frostming/unearth/issues/43 (dbe85)
prefer_binary for individual packages.Fix a bug that empty password in auth is ignored - by @frostming (979bf)
Allow to use keyring from CLI - by @frostming in https://github.com/frostming/unearth/issues/36 (7c66e)
Skip invalid requires-python specifier - by @frostming (69d8a)
Disable vcs prompt for verbosity <=0 - by @q0w in https://github.com/frostming/unearth/issues/31 (61514)
Suppress warnings for insecure requests - by @frostming (419df)
Skip invalid versions rejected by packaging 22.0 - by @pdm-project in https://github.com/frostming/unearth/issues/26 (8fc2a)
Log the file size when downloading - by @frostming in https://github.com/frostming/unearth/issues/22 (9514a)
Match the index auth by netloc rather than original URL - by @frostming (e3306)
Allow CA certificates to be configured - by @sleiner in https://github.com/frostming/unearth/issues/16
Fix a bug of package url not following redirects - by @frostming (b880a)
Full Changelog: https://github.com/frostming/unearth/compare/0.5.1...0.5.2
Normalize the name when building the index url - by @frostming (38677)
Check hash against allowed hash names `38b38a4` by @frostming
38b38a4 by @frostmingde98e13 by @frostmingFix a crash issue when wheel name contains invalid version `#10` by @frostming
#10 by @frostminga3a680c by @frostming7d9800f by @frostmingAllow respecting the source order by the respect_source_order argument of PackageFinder
respect_source_order argument of PackageFinderFull Changelog: https://github.com/frostming/unearth/compare/0.3.2...0.4.0
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →