PyPI / boto3 / 1.43.117

boto3 1.43.117

Source

https://github.com/boto/boto3

Tag scanned

1.43.117

Compared with

1.43.116 (0 signals introduced since)

Files

209 scanned, 30 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 00:59

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line docs/source/_templates/page.html:231:1

   line length 2058 characters (raw pass, confidence 0.65)

                     <path fill="currentColor" d="M39.2,391.3c-4.2,0.6-7.1,4.4-6.5,8.5c0.4,3,2.6,5.5,5.5,6.3 c0,0,18.5,6.1,50,8.7c25.3,2.1,54-1.8,54-1.8c4.2-0.1,7.5-3.6,7.4-7.8c-0.1-4.2-3.6-7.5-7.8-7.4c-0.5,0-1,0.1-1.5,0.2 c0,0-28.1,3.5-50.9,1.6c-30.1-2.4-46.5-7.9-46.5-7.9C41.7,391.3,40.4,391.1,39.2,391.3z M39.2,353.6c-4.

   likely benign LLM, confidence 0.95 Long inline SVG path data in a Sphinx HTML template.

   Reasoning

   A 2058-character line containing an SVG path data attribute is a typical minified inline SVG in an HTML template. The raw pass flags length only; the content is ordinary vector path data with no encoded payload or hidden instructions.

2. info long-line docs/source/_templates/page.html:239:1

   line length 626 characters (raw pass, confidence 0.50)

                     <path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1

3. info warn → info by review dynamic-execution scripts/new-change:123:13

   `subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)

           editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
           p = subprocess.Popen(f'{editor} {f.name}', shell=True)
           p.communicate()
           with open(f.name) as f:

   likely benign LLM, confidence 0.80 A developer helper script launches the user's editor via a shell command built from environment variables.

   Reasoning

   The shell=True call interpolates an editor name taken from the VISUAL/EDITOR environment variable and a temp file name. The command is built from f-string with user-controlled env values, a shell-injection smell, but in a developer script that opens an editor for a changelog entry the environment is the user's own. Not a supply-chain dropper; the pattern is a common, if sloppy, editor-launch idiom.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/boto/boto3 boto3 && cd boto3
git checkout 1.43.117
disclude scan --severity info --diff 1.43.116 .