PyPI / redis / 8.1.0

redis 8.1.0

Source

https://github.com/redis/redis-py

Tag scanned

v8.1.0

Compared with

v8.0.1 (0 signals introduced since)

Files

360 scanned, 29 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 11 info

Scan time

9.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 9 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line README.md:63:1

   line length 513 characters (raw pass, confidence 0.50)

   The most recent version of this library supports Redis version [7.2](https://github.com/redis/redis/blob/7.2/00-RELEASENOTES), [7.4](https://github.com/redis/redis/blob/7.4/00-RELEASENOTES), [8.0](https://github.com/redis/redis/blob/8.0/00-RELEASENOTES), [8.2](https://github.com/redis/redis/blob/8.2/00-RELEASENOTES), [

2. info warn → info by review dynamic-execution docker-compose.yml:22:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save ""}

   likely benign LLM, confidence 0.85 Compose file expands a REDIS_EXTRA_ARGS variable with default Redis server flags.

   Reasoning

   The flagged expansion supplies default Redis server arguments (${REDIS_EXTRA_ARGS:-...}) and is not used as a command name. Its value is passed as flags to redis-server, so this is ordinary configuration. The debug and module flags are notable but sit in a Redis service definition.

3. info warn → info by review dynamic-execution docker-compose.yml:45:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --replicaof redis 6379 --protected-mode no --save ""}

   likely benign LLM, confidence 0.85 Compose file passes default Redis replication and config flags through an environment variable.

   Reasoning

   Same pattern as the other compose findings: a default-valued variable supplies Redis server flags such as --replicaof and --protected-mode. The variable is not invoked as a command, so the dynamic-execution signal is a misreading.

4. info warn → info by review dynamic-execution docker-compose.yml:66:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save "" --tls-cluster yes}

   likely benign LLM, confidence 0.85 Compose file uses a REDIS_EXTRA_ARGS default to set Redis server options including TLS cluster.

   Reasoning

   The variable holds Redis server arguments with a default value and is not executed as a command. The flags are configuration for a test or dev Redis cluster.

5. info warn → info by review dynamic-execution docker-compose.yml:96:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save "" --tls-cluster yes}

   likely benign LLM, confidence 0.85 Compose file defines default Redis server flags via an environment variable.

   Reasoning

   This is a repeat of the same default-argument expansion for Redis server flags. No command execution is involved.

6. info warn → info by review dynamic-execution docker-compose.yml:123:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---sentinel}

   likely benign LLM, confidence 0.85 Compose file sets a Redis sentinel mode flag through an environment variable default.

   Reasoning

   The default value is a single Redis sentinel flag. The variable supplies an argument, not a command name, so the finding is a false positive.

7. info warn → info by review dynamic-execution docker-compose.yml:142:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --save ""}

   likely benign LLM, confidence 0.85 Compose file sets default Redis server flags via an environment variable.

   Reasoning

   The default value consists of Redis server flags passed to the server. The variable is not invoked as a command, so the dynamic-execution signal does not apply.

8. info warn → info by review decoder-decompress-payload redis/http/http_client.py:419:24

   file imports decoder module(s) base64, gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

               if "gzip" in encoding:
                   return gzip.decompress(content)
               if "deflate" in encoding:
                   # Try raw deflate, then zlib-wrapped

   likely benign LLM, confidence 0.90 HTTP client decompresses gzip or deflate response bodies according to Content-Encoding.

   Reasoning

   gzip.decompress is applied to an HTTP response body when the Content-Encoding header says gzip. This is standard HTTP content decoding in a client library, not a hidden embedded payload.

9. info critical → info by review bash-dev-tcp-socket util/wait-for-it.sh:60:21

   /dev/tcp socket opened without external binary (covert channel / reverse shell) (ast pass, confidence 0.97)

           else
               (echo > /dev/tcp/$WAITFORIT_HOST/$WAITFORIT_PORT) >/dev/null 2>&1
               WAITFORIT_result=$?
           fi

   likely benign LLM, confidence 0.92 Duplicate report of the same bash /dev/tcp port probe in wait-for-it.sh.

   Reasoning

   Duplicate of the same /dev/tcp port probe in wait-for-it.sh, which is a legitimate connectivity check in this widely used script.

10. info critical → info by review bash-dev-tcp-socket util/wait-for-it.sh:60:21

    /dev/tcp socket opened without external binary (covert channel / reverse shell) (ast pass, confidence 0.97)

            else
                (echo > /dev/tcp/$WAITFORIT_HOST/$WAITFORIT_PORT) >/dev/null 2>&1
                WAITFORIT_result=$?
            fi

    likely benign LLM, confidence 0.92 Duplicate report of the same bash /dev/tcp port probe in wait-for-it.sh.

    Reasoning

    Duplicate of the same /dev/tcp port probe in wait-for-it.sh, which is a legitimate connectivity check in this widely used script.

11. info critical → info by review dynamic-execution util/wait-for-it.sh:200:5

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

        fi
        exec "${WAITFORIT_CLI[@]}"
    else
        exit $WAITFORIT_RESULT

    likely benign LLM, confidence 0.88 wait-for-it.sh execs the user-supplied command once the target port is ready.

    Reasoning

    The exec runs the command the user passed after the wait succeeds. That is the script's documented purpose (wait, then run a command), so the dynamic path is the intended interface rather than a hidden payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/redis/redis-py redis-py && cd redis-py
git checkout v8.1.0
disclude scan --severity info --diff v8.0.1 .