PyPI / httpx2 / 2.15.1

httpx2 2.15.1

Source

https://github.com/pydantic/httpx2

Tag scanned

v2.15.1

Directory

src/httpx2 (only this part of the repository was scanned)

Compared with

v2.15.0 (0 signals introduced since)

Files

31 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-19 21:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload src/httpx2/httpx2/_decoders.py:74:24

   file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

       def decompress(self, data: bytes) -> typing.Iterator[bytes]:
           decompressed = self.decompressor.decompress(data, MAX_DECODE_CHUNK_SIZE)
           while decompressed:
               yield decompressed

   likely benign LLM, confidence 0.95 Streaming decompression of HTTP response bodies in an httpx decoder class.

   Reasoning

   This is a standard HTTP content-decoding loop: it calls zlib/codecs decompress on response data in fixed-size chunks (MAX_DECODE_CHUNK_SIZE) and yields the output, exactly as httpx's decoder module does. The data is the network response body, not an embedded payload, and nothing here executes decoded content. The signal fires on the generic decompress() call pattern, which is expected in an HTTP library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pydantic/httpx2 httpx2 && cd httpx2
git checkout v2.15.1
disclude scan --severity info --diff v2.15.0 src/httpx2