
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
pafer
Advanced tools
#id, .class, tag name)pip install pafer
from pafer import HTMLPafer
html = '<div class="post"><h1>Title</h1><a href="/about">About</a></div>'
p = HTMLPafer()
result = p.parse(html)
result['tags'] # list of {name, attributes, content, rows?}
result['metadata'] # {'title': ...}
result['doctype'] # '<!DOCTYPE ...>' or None
p.select(html, '.post') # match by #id, .class or tag name
p.sanitize(html) # keep only allowed tags
p.minify(html) # collapse whitespace, strip comments
p.extract_links(html) # [{'url': ..., 'text': ..., 'attributes': ...}]
Enable the parsed-result cache with HTMLPafer(use_cache=True).
load_config(path) loads an exact file and raises ConfigLoadError (or a
subclass) when it is missing, invalid, or corrupted. Omitting path
auto-finds the caller's default.config — module directory first, then the
package directory; find_default_config() exposes that lookup directly.
Config() (or Config.load_default()) uses built-in defaults without
touching the filesystem. save_config auto-finds its target the same way
when path is omitted.
raw: [8-byte MD5 checksum][4-byte size][pickle payload]
gzip: [8-byte MD5 checksum][4-byte size][gzip.compress(pickle payload)]
xz: [8-byte MD5 checksum][4-byte size][lzma.compress(pickle payload)]
zlib: [8-byte MD5 checksum][4-byte size][zlib.compress(pickle payload)]
from pafer import load_config, save_config
settings = {'strip_whitespace': False, 'cache_size': 100}
save_config(settings, 'my.config') # raw
save_config(settings, 'my.config.gz', compression='gzip')
save_config(settings, 'my.config.xz', compression='xz')
cfg = load_config('my.config.gz') # format auto-detected
| Key | Default | Purpose |
|---|---|---|
parse_tables | True | extract table rows while parsing |
strip_whitespace | True | collapse whitespace |
encoding | utf-8 | decode bytes input |
max_depth | 100 | maximum element nesting |
default_tag | div | fallback tag |
preserve_comments | False | keep comments in the tree |
strict_mode | False | raise on malformed HTML |
remove_comments | True | strip comments when minifying |
allowed_tags | p, br, b, i, a, ul, ol, li, div, span | sanitize whitelist |
max_file_size_mb | 10 | reject oversized input |
cache_size | 50 | cache capacity |
pafer.cache.LRUCache is an in-memory LRU cache with TTL expiry:
from pafer.cache import LRUCache
cache = LRUCache(max_size=100, ttl_seconds=300)
cache.set('key', value)
cache.get('key')
from pafer.feed import FeedPafer
items = FeedPafer().parse_rss(xml_content)
items[0]['title'] # 'title', 'link', 'description', 'pubDate'
from pafer.exporters import DataExporter
DataExporter.to_json(data) # JSON string with 2-space indent
DataExporter.to_csv(rows) # CSV from a list of rows
HTMLPaferError (base), SanitizationError, SelectorSyntaxError,
ConfigLoadError.
MIT
FAQs
Regex-based HTML parsing.
The pypi package pafer receives a total of 148 weekly downloads. As such, pafer popularity was classified as not popular.
We found that pafer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.