httpcore 1.0.9

Source: https://github.com/encode/httpcore
Tag scanned: 1.0.9
Compared with: 1.0.8 (0 signals introduced since)
Files: 82 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 19 info
Scan time: 0.2 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution scripts/benchmark:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python tests/benchmark/server.py &
SERVER_PID=$!
EXIT_CODE=0
```
info dynamic-execution scripts/benchmark:15:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
EXIT_CODE=0
${PREFIX}python tests/benchmark/client.py "$@" || EXIT_CODE=$?
kill $SERVER_PID
exit $EXIT_CODE
```
info dynamic-execution scripts/build:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:15:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/check:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```

info dynamic-execution scripts/check:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)

${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
${PREFIX}python scripts/unasync.py --check

info dynamic-execution scripts/check:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
${PREFIX}python scripts/unasync.py --check
```
info dynamic-execution scripts/check:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check $SOURCE_FILES
${PREFIX}python scripts/unasync.py --check
```
info dynamic-execution scripts/coverage:10:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage report --show-missing --skip-covered --fail-under=100
```
info dynamic-execution scripts/install:12:5

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
```
if [ -z "$GITHUB_ACTIONS" ]; then
    "$PYTHON" -m venv "$VENV"
    PIP="$VENV/bin/pip"
else
```
info dynamic-execution scripts/install:18:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip setuptools wheel
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/install:19:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip setuptools wheel
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/lint:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES
```

info dynamic-execution scripts/lint:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)

${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES

# Run unasync last because its `--check` mode is not aware of code formatters.

info dynamic-execution scripts/lint:16:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# (This means sync code isn't prettified, and that's mostly okay.)
${PREFIX}python scripts/unasync.py
```
info dynamic-execution scripts/publish:26:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/publish:27:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/test:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage run -m pytest

if [ -z $GITHUB_ACTIONS ]; then
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/encode/httpcore httpcore && cd httpcore
git checkout 1.0.9
disclude scan --severity info --diff 1.0.8 .