azure-core 1.41.0

Source: https://github.com/Azure/azure-sdk-for-python
Artifact scanned: azure_core-1.41.0-py3-none-any.whl (wheel · 215.7 KB · SHA-256 522b4011e818…)
Compared with: azure_core-1.40.0-py3-none-any.whl (0 signals introduced since)
Files: 75 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload azure/core/pipeline/transport/_aiohttp.py:468:42

file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                    zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
                    self._decompressor = zlib.decompressobj(wbits=zlib_mode)
                chunk = self._decompressor.decompress(chunk)
            return chunk
```
likely benign LLM, confidence 0.95 Streaming HTTP response decompression for gzip/deflate content encodings in the aiohttp transport.
Reasoning
This is the standard HTTP Content-Encoding handling in the Azure SDK: zlib decompressobj is configured for gzip or deflate based on the response header, and the chunk is the HTTP response body. No embedded payload is being hidden or executed; it is ordinary response decompression.
info ~~warn~~ → info by review decoder-decompress-payload azure/core/utils/_pipeline_transport_rest_shared.py:410:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
        decompressor = zlib.decompressobj(wbits=zlib_mode)
        response._content = decompressor.decompress(response._content)
        response._decompressed_content = True
```
likely benign LLM, confidence 0.95 Decompresses HTTP response content according to its Content-Encoding header in the shared REST transport utilities.
Reasoning
The code selects zlib window bits from the Content-Encoding header and decompresses the HTTP response content, which is a normal and expected library behavior. Nothing is decoded and executed; the output is stored as response content.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o azure_core-1.41.0-py3-none-any.whl https://files.pythonhosted.org/packages/5b/db/325c6d7312d2200251c52323878281045aaffcb5586612296484e4280eaa/azure_core-1.41.0-py3-none-any.whl
printf '%s  %s\n' 522b4011e8180b1a3dcd2024396a4e7fe9ac37fb8597db47163d230b5efe892d azure_core-1.41.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q azure_core-1.41.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg