httpx 0.28.1

Source: https://github.com/encode/httpx
Tag scanned: 0.28.1
Compared with: 0.28.0 (0 signals introduced since)
Files: 99 scanned, 15 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 21 info
Scan time: 2.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:34

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload httpx/_decoders.py:65:29

file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.first_attempt = True
        self.decompressor = zlib.decompressobj()

    def decode(self, data: bytes) -> bytes:
```
dismissed LLM, confidence 0.97 Streaming zlib decompressor used by httpx to decode compressed HTTP response bodies.
Reasoning
This is httpx's HTTP content-decoding module. zlib.decompressobj() is used to decompress HTTP response bodies (gzip/deflate Content-Encoding), which is the expected function of an HTTP client. The rule fires on the generic presence of decompress calls, not on any embedded payload or dropper behavior; the snippet shows ordinary streaming decompressor setup.
info dynamic-execution scripts/build:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}python -m build
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/build:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine check dist/*
${PREFIX}mkdocs build
```
info dynamic-execution scripts/check:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
./scripts/sync-version
${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/check:13:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff format $SOURCE_FILES --diff
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/check:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}mypy $SOURCE_FILES
${PREFIX}ruff check $SOURCE_FILES
```
info dynamic-execution scripts/coverage:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage report --show-missing --skip-covered --fail-under=100
```
info dynamic-execution scripts/docs:10:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}mkdocs serve
```
info dynamic-execution scripts/install:12:5

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
```
if [ -z "$GITHUB_ACTIONS" ]; then
    "$PYTHON" -m venv "$VENV"
    PIP="$VENV/bin/pip"
else
```
info dynamic-execution scripts/install:18:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/install:19:1

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
```
"$PIP" install -U pip
"$PIP" install -r "$REQUIREMENTS"
```
info dynamic-execution scripts/lint:11:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES
```
info dynamic-execution scripts/lint:12:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}ruff check --fix $SOURCE_FILES
${PREFIX}ruff format $SOURCE_FILES
```
info dynamic-execution scripts/publish:25:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/publish:26:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}twine upload dist/*
${PREFIX}mkdocs gh-deploy --force
```
info dynamic-execution scripts/test:14:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
${PREFIX}coverage run -m pytest "$@"

if [ -z $GITHUB_ACTIONS ]; then
```

info unicode-zero-width tests/models/test_url.py:755:27

U+200D ZERO WIDTH JOINER in source (in string/comment) (raw pass, confidence 0.45)

        (
            "http://ශ්⟨U+200D⟩රී.com:444",
            "http://xn--10cl1a0b660p.com:444",
            "ශ්⟨U+200D⟩රී.com",

info unicode-zero-width tests/models/test_url.py:757:20

U+200D ZERO WIDTH JOINER in source (in string/comment) (raw pass, confidence 0.45)

            "http://xn--10cl1a0b660p.com:444",
            "ශ්⟨U+200D⟩රී.com",
            b"xn--10cl1a0b660p.com",
            "http",

info unicode-zero-width tests/models/test_url.py:763:30

U+200C ZERO WIDTH NON-JOINER in source (in string/comment) (raw pass, confidence 0.45)

        (
            "https://نامه⟨U+200C⟩ای.com:4433",
            "https://xn--mgba3gch31f060k.com:4433",
            "نامه⟨U+200C⟩ای.com",

info unicode-zero-width tests/models/test_url.py:765:22

U+200C ZERO WIDTH NON-JOINER in source (in string/comment) (raw pass, confidence 0.45)

            "https://xn--mgba3gch31f060k.com:4433",
            "نامه⟨U+200C⟩ای.com",
            b"xn--mgba3gch31f060k.com",
            "https",

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/encode/httpx httpx && cd httpx
git checkout 0.28.1
disclude scan --severity info --diff 0.28.0 .