PyPI / hpack / 4.2.0

hpack 4.2.0

Source

https://github.com/python-hyper/hpack

Tag scanned

v4.2.0

Compared with

v4.1.0 (0 signals introduced since)

Files

27 scanned, 389 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review payload-bytes-literal tests/test_hpack.py:538:13

   concatenated bytes literal contains 115 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)

           data = (
               b'\x82\x87D\x87a\x07\xa4\xacV4\xcfA\x8c\xf1\xe3\xc2\xe5\xf2:k\xa0'
               b'\xab\x90\xf4\xff@\x88%\xa8I\xe9[\xa9}\x7f\x89%\xa8I\xe9[\xb8\xe8'
               b'\xb4\xbfz\xbc\xd0\x7ff\xa2\x81\xb0\xda\xe0S\xfa\xd02\x1a\xa4\x9d'

   likely benign LLM, confidence 0.95 A test fixture in a HPACK test file containing a concatenated bytes literal of encoded HTTP/2 header data.

   Reasoning

   This is a test file for an HPACK (HTTP/2 header compression) implementation. The bytes literal is a sequence of HPACK-encoded header bytes (e.g., 0x82 is an indexed header field for :method GET, 0x87 for :scheme https), consistent with Huffman-coded header test vectors. Such binary test fixtures are normal in protocol library test suites; the finding is a shape match with no execution or malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/python-hyper/hpack hpack && cd hpack
git checkout v4.2.0
disclude scan --severity info --diff v4.1.0 .