httpx 0.28.1

Source: https://github.com/encode/httpx
Tag scanned: 0.28.1
Compared with: 0.28.0 (0 signals introduced since)
Files: 98 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 21 info
Scan time: 2.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload httpx/_decoders.py:65:29

file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.first_attempt = True
        self.decompressor = zlib.decompressobj()

    def decode(self, data: bytes) -> bytes:
```
likely benign LLM, confidence 0.97 httpx HTTP decoder initializing a zlib decompressor for gzip/deflate response decoding.
Reasoning
The file is httpx's HTTP content decoder module. zlib.decompressobj() is used to decode gzip/deflate HTTP response bodies, which is the expected behavior of an HTTP client. The flagged signal matches generic decompress calls, and the snippet shows no embedded payload, no exec, and no obfuscated loader. This is a legitimate coding pattern.
info dynamic-execution scripts/build:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/check:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
./scripts/sync-version
${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/check:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/check:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/coverage:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage report --show-missing --skip-covered --fail-under=100
```
info dynamic-execution scripts/docs:10:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}mkdocs serve
```
info dynamic-execution scripts/install:12:5

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
```
if [ -z "$GITHUB_ACTIONS" ]; then
    "$PYTHON" -m venv "$VENV"
    PIP="$VENV/bin/pip"
else
```
info dynamic-execution scripts/install:18:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/install:19:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/lint:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES
```
info dynamic-execution scripts/lint:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES
```
info dynamic-execution scripts/publish:25:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/publish:26:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/test:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage run -m pytest "$@"

if [ -z $GITHUB_ACTIONS ]; then
```

info unicode-zero-width tests/models/test_url.py:755:27

U+200D ZERO WIDTH JOINER in source (in string/comment) (raw pass, confidence 0.45)

        (
            "http://ශ්⟨U+200D⟩රී.com:444",
            "http://xn--10cl1a0b660p.com:444",
            "ශ්⟨U+200D⟩රී.com",

info unicode-zero-width tests/models/test_url.py:757:20

U+200D ZERO WIDTH JOINER in source (in string/comment) (raw pass, confidence 0.45)

            "http://xn--10cl1a0b660p.com:444",
            "ශ්⟨U+200D⟩රී.com",
            b"xn--10cl1a0b660p.com",
            "http",

info unicode-zero-width tests/models/test_url.py:763:30

U+200C ZERO WIDTH NON-JOINER in source (in string/comment) (raw pass, confidence 0.45)

        (
            "https://نامه⟨U+200C⟩ای.com:4433",
            "https://xn--mgba3gch31f060k.com:4433",
            "نامه⟨U+200C⟩ای.com",

info unicode-zero-width tests/models/test_url.py:765:22

U+200C ZERO WIDTH NON-JOINER in source (in string/comment) (raw pass, confidence 0.45)

            "https://xn--mgba3gch31f060k.com:4433",
            "نامه⟨U+200C⟩ای.com",
            b"xn--mgba3gch31f060k.com",
            "https",

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/encode/httpx httpx && cd httpx
git checkout 0.28.1
disclude scan --severity info --diff 0.28.0 .