aiobotocore 3.9.2

Source: https://github.com/aio-libs/aiobotocore
Tag scanned: 3.9.2
Compared with: 3.9.1 (0 signals introduced since)
Files: 147 scanned, 34 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 3.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 CHANGES.rst:437:132

base64-like blob (68 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
* remove AioSession and get_session top level names to match botocore_
* change exceptions raised to match those of botocore_, see `mappings <https://github.com/aio-libs/aiobotocore/pull/877/files#diff-b1675e1eb4276bfae81107cda919ba446e4ce1b1e228a9e878d65dd1f474bf8cR162-R181>`_

1.3.3 (2021-07-12)
```
dismissed LLM, confidence 0.93 Changelog entry containing a GitHub diff URL whose anchor hash tripped the base64 heuristic.
Reasoning
The flagged blob is a long URL fragment in a changelog bullet (a GitHub diff anchor like #diff-b1675e...R162-R181). Hex-like diff hash in a URL is a false positive of base64 heuristic in documentation prose.
info ~~warn~~ → info by review payload-bytes-literal tests/botocore_tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.90 Test fixture encoding a binary AWS event-stream message as escaped bytes.
Reasoning
This is a test fixture for AWS event-stream binary protocol parsing (prelude, header type bytes, lengths). Binary payload literals are expected in a parser test suite for botocore/aiobotocore; no execution or obfuscation behavior is present.
info ~~warn~~ → info by review payload-bytes-literal tests/botocore_tests/unit/test_eventstream.py:350:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.90 Test fixture of event-stream headers encoded as byte escapes for unit testing.
Reasoning
Same context as the sibling fixture: header bytes for event-stream parsing tests in a botocore-derived test module. The escapes encode protocol structure, not hidden code.
info ~~warn~~ → info by review payload-bytes-literal tests/test_eventstreams.py:17:5

concatenated bytes literal contains 45 `\xNN` escapes (45% of content) — binary payload shape (ast pass, confidence 0.85)
```
    b'lo":"world"}\nF\x0e\x9a2',
    b'\x00\x00\x00\xce\x00\x00\x00C\xdc\xd2\x99\xf9\r:message-type\x07\x00\x05event'
    b'\x0b:event-type\x07\x00\x05Stats\r:content-type\x07\x00\x08text/xml<Stats xml'
    b'ns=""><BytesScanned>19</BytesScanned><BytesProcessed>19</BytesProcessed><Byte'
```
likely benign LLM, confidence 0.90 Test data containing a binary event-stream frame with embedded XML payload.
Reasoning
Concatenated bytes literals encode AWS event-stream frames with XML stats payload for a parser test. Consistent with legitimate protocol test data; no decoding or execution follows.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/aio-libs/aiobotocore aiobotocore && cd aiobotocore
git checkout 3.9.2
disclude scan --severity info --diff 3.9.1 .