reqwest 0.13.5

Source: https://github.com/seanmonstar/reqwest
Artifact scanned: reqwest-0.13.5.crate (crate · 157.1 KB · SHA-256 16a1cfa75cc1…)
Compared with: reqwest-0.13.4.crate (0 signals introduced since)
Files: 41 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 07:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 src/tls.rs:867:13

base64-like blob (592 bytes over 10 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
            -----BEGIN CERTIFICATE-----
            MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5
            MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
            Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
```
likely benign LLM, confidence 0.95 Embedded Amazon Root CA PEM certificate in a Rust TLS source file.
Reasoning
The snippet is a PEM certificate block (BEGIN CERTIFICATE header, Amazon Root CA subject text in base64). Embedding root CA certificates in a TLS crate is ordinary and expected; the raw base64-blob signal is a known false positive for PEM data.
info ~~warn~~ → info by review encoding-base64 src/tls.rs:880:13

base64-like blob (672 bytes over 11 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
            -----BEGIN CERTIFICATE-----
            MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5
            MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
            Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
```
likely benign LLM, confidence 0.95 Another embedded Amazon root CA PEM certificate in src/tls.rs.
Reasoning
Same pattern as the sibling finding: a PEM-encoded Amazon root CA certificate (Amazon Root CA 4 subject visible in base64). Legitimate trust-anchor data, flagged only because the raw pass matches base64 length and compressibility.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o reqwest-0.13.5.crate 'https://static.crates.io/crates/reqwest/reqwest-0%2E13%2E5.crate'
printf '%s  %s\n' 16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029 reqwest-0.13.5.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf reqwest-0.13.5.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg