aiohttp 3.14.5

Source: https://github.com/aio-libs/aiohttp
Artifact scanned: aiohttp-3.14.5-py3-none-any.whl (wheel · 273.0 KB · SHA-256 efc21a454892…)
Compared with: aiohttp-3.14.4-py3-none-any.whl (0 signals introduced since)
Files: 56 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 5.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 01:33

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection aiohttp/client.py:440:62

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if loop.get_debug():
            self._source_traceback = traceback.extract_stack(sys._getframe(1))

        if cookie_jar is None:
```
likely benign LLM, confidence 0.97 Debug-only capture of the caller's stack trace in the ClientSession constructor.
Reasoning
sys._getframe(1) is used inside a loop.get_debug() guard to record the creation traceback for debugging unclosed sessions, a well-known asyncio/aiohttp idiom. Not obfuscation.
info ~~warn~~ → info by review frame-introspection aiohttp/client_reqrep.py:524:62

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if loop.get_debug():
            self._source_traceback = traceback.extract_stack(sys._getframe(1))

    def __reset_writer(self, _: object = None) -> None:
```
likely benign LLM, confidence 0.97 Debug-only stack capture for source traceback in client request code.
Reasoning
Same debug-guarded source traceback capture via sys._getframe(1) in ClientResponse/request setup; standard aiohttp debugging code.
info ~~warn~~ → info by review frame-introspection aiohttp/client_reqrep.py:1103:62

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if loop.get_debug():
            self._source_traceback = traceback.extract_stack(sys._getframe(1))

        self.update_version(version)
```
likely benign LLM, confidence 0.97 Debug-only stack capture for source traceback in response/request code.
Reasoning
Identical loop.get_debug()-guarded traceback capture; legitimate diagnostic code.
info ~~warn~~ → info by review decoder-decompress-payload aiohttp/compression_utils.py:143:16

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def decompressobj(self, *args: Any, **kwargs: Any) -> ZLibDecompressObjProtocol:
        return self._zlib_backend.decompressobj(*args, **kwargs)

    def compress(self, data: Buffer, *args: Any, **kwargs: Any) -> bytes:
```
likely benign LLM, confidence 0.93 Compression backend wrapper for zlib used in HTTP content encoding.
Reasoning
The file wraps zlib decompressobj as a pluggable backend for HTTP content decoding. The flagged compress/decompress is ordinary HTTP compression handling of data received from the network, not a hidden embedded payload being executed.
info ~~warn~~ → info by review frame-introspection aiohttp/connector.py:148:62

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if loop.get_debug():
            self._source_traceback = traceback.extract_stack(sys._getframe(1))

    def __repr__(self) -> str:
```
likely benign LLM, confidence 0.97 Debug-only caller stack capture in connector construction.
Reasoning
Debug-guarded sys._getframe(1) for source traceback, standard asyncio debug practice.
info ~~warn~~ → info by review frame-introspection aiohttp/connector.py:309:62

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if loop.get_debug():
            self._source_traceback = traceback.extract_stack(sys._getframe(1))

        # Connection pool of reusable connections.
```
likely benign LLM, confidence 0.97 Debug-only caller stack capture in connector initialization.
Reasoning
Same debug-guarded source traceback pattern repeated in the connector class.
info ~~warn~~ → info by review frame-introspection aiohttp/helpers.py:886:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # Prefix with module name to help deduplicate key names.
        frame = inspect.currentframe()
        while frame:
            if frame.f_code.co_name == "<module>":
```
likely benign LLM, confidence 0.90 Walks call stack to locate the calling module name for key prefixing.
Reasoning
inspect.currentframe walks frames to find the module-level name for building a deduplicated key, a benign introspection used for naming/logging, not for hiding execution.
info ~~warn~~ → info by review decoder-decompress-payload aiohttp/multipart.py:614:25

file imports decoder module(s) base64, binascii and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            )
            yield await d.decompress(data, max_length=self._max_decompress_size)
            while d.data_available:
                yield await d.decompress(b"", max_length=self._max_decompress_size)
```
likely benign LLM, confidence 0.90 Streaming decompression of multipart body content with size limits.
Reasoning
This is the multipart/HTTP content-encoding decompression path (base64/binascii for Content-Transfer-Encoding, plus streaming decompress with max_length limits) operating on incoming HTTP body data. It is legitimate protocol handling with size limits, not an embedded payload executed at runtime.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o aiohttp-3.14.5-py3-none-any.whl https://files.pythonhosted.org/packages/68/30/173960c42b05a6c59f7558e4b12a4b0d9ba376cf6aa9bde7f9e08a30ca8d/aiohttp-3.14.5-py3-none-any.whl
printf '%s  %s\n' efc21a454892828368b11c2c780de0ff8bc991f73f6b99c6b66e56205470929b aiohttp-3.14.5-py3-none-any.whl | shasum -a 256 -c -
unzip -q aiohttp-3.14.5-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg