aiobotocore 3.9.2

Source: https://github.com/aio-libs/aiobotocore
Tag scanned: 3.9.2
Compared with: 3.9.1 (0 signals introduced since)
Files: 147 scanned, 34 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 5.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 CHANGES.rst:437:132

base64-like blob (68 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
* remove AioSession and get_session top level names to match botocore_
* change exceptions raised to match those of botocore_, see `mappings <https://github.com/aio-libs/aiobotocore/pull/877/files#diff-b1675e1eb4276bfae81107cda919ba446e4ce1b1e228a9e878d65dd1f474bf8cR162-R181>`_

1.3.3 (2021-07-12)
```
dismissed LLM, confidence 0.95 Changelog entry linking to a GitHub PR diff; the flagged base64-like string is a diff anchor hash.
Reasoning
The blob is a GitHub diff anchor fragment (#diff-b1675e...R162-R181) inside a changelog link. It is a hash in a URL, not an encoded payload. Benign documentation text.
info ~~warn~~ → info by review payload-bytes-literal tests/botocore_tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.90 Binary event-stream test vector with header bytes in a botocore-derived unit test.
Reasoning
This is a test fixture for AWS event-stream binary parsing. The byte escapes encode prelude, CRC and header fields, which is the expected shape for testing a binary protocol decoder in a botocore-derived test suite. Not malicious.
info ~~warn~~ → info by review payload-bytes-literal tests/botocore_tests/unit/test_eventstream.py:350:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.90 Encoded event-stream headers used as test input for a binary protocol parser.
Reasoning
Same pattern as the sibling finding: encoded event-stream header data (type/length-prefixed names like 'bytes', 'utf8') used as a parser test fixture. Legitimate test data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_eventstreams.py:17:5

concatenated bytes literal contains 45 `\xNN` escapes (45% of content) — binary payload shape (ast pass, confidence 0.85)
```
    b'lo":"world"}\nF\x0e\x9a2',
    b'\x00\x00\x00\xce\x00\x00\x00C\xdc\xd2\x99\xf9\r:message-type\x07\x00\x05event'
    b'\x0b:event-type\x07\x00\x05Stats\r:content-type\x07\x00\x08text/xml<Stats xml'
    b'ns=""><BytesScanned>19</BytesScanned><BytesProcessed>19</BytesProcessed><Byte'
```
likely benign LLM, confidence 0.90 Event-stream framed sample response in a test file for decoding AWS-style eventstreams.
Reasoning
The literal contains AWS event-stream framing with readable embedded XML and JSON, consistent with a test case for decoding eventstream responses. The escapes are protocol framing bytes, not an obfuscated payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/aio-libs/aiobotocore aiobotocore && cd aiobotocore
git checkout 3.9.2
disclude scan --severity info --diff 3.9.1 .