PyPI / redis / 8.1.0

redis 8.1.0

Source

https://github.com/redis/redis-py

Tag scanned

v8.1.0

Compared with

v8.0.1 (0 signals introduced since)

Files

360 scanned, 29 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 11 info

Scan time

11.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 9 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 03:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line README.md:63:1

   line length 513 characters (raw pass, confidence 0.50)

   The most recent version of this library supports Redis version [7.2](https://github.com/redis/redis/blob/7.2/00-RELEASENOTES), [7.4](https://github.com/redis/redis/blob/7.4/00-RELEASENOTES), [8.0](https://github.com/redis/redis/blob/8.0/00-RELEASENOTES), [8.2](https://github.com/redis/redis/blob/8.2/00-RELEASENOTES), [

2. info warn → info by review dynamic-execution docker-compose.yml:22:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save ""}

   likely benign LLM, confidence 0.85 Compose file expands an environment variable into redis-server command-line flags with a default.

   Reasoning

   The flagged value is the default-value expansion of REDIS_EXTRA_ARGS, and the text after the colon-dash is redis-server option flags. The variable supplies arguments to redis-server rather than choosing the program to run, so the 'variable command name' reading is a false positive from the parser.

3. info warn → info by review dynamic-execution docker-compose.yml:45:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --replicaof redis 6379 --protected-mode no --save ""}

   likely benign LLM, confidence 0.85 Compose file passes default redis-server flags through an environment variable.

   Reasoning

   Same pattern: an env-var default supplies redis-server flags (replicaof, protected-mode). This is ordinary Redis configuration, and the variable does not select the executed binary.

4. info warn → info by review dynamic-execution docker-compose.yml:66:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save "" --tls-cluster yes}

   likely benign LLM, confidence 0.85 Compose file sets redis-server options via an env-var default.

   Reasoning

   The expansion only supplies redis-server options such as debug and TLS flags. The variable is not the command name, so the finding misreads the YAML.

5. info warn → info by review dynamic-execution docker-compose.yml:96:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --tls-auth-clients optional --save "" --tls-cluster yes}

   likely benign LLM, confidence 0.85 Compose file supplies redis-server flags through an env-var default.

   Reasoning

   Same redis-server flag default expansion as the other compose entries. No executable is chosen by the variable.

6. info warn → info by review dynamic-execution docker-compose.yml:123:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---sentinel}

   likely benign LLM, confidence 0.85 Compose file uses an env-var default to enable Redis Sentinel mode.

   Reasoning

   The default is just '--sentinel', a redis-server mode flag. This is a normal Redis Sentinel deployment configuration.

7. info warn → info by review dynamic-execution docker-compose.yml:142:14

   [embedded bash] command name is a variable (`$REDIS_EXTRA_ARGS`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   ${REDIS_EXTRA_ARGS:---enable-debug-command yes --enable-module-command yes --save ""}

   likely benign LLM, confidence 0.85 Compose file expands an env-var default into redis-server options.

   Reasoning

   The default expands to redis-server options (debug, module command, save). The variable is an argument list, not the command name, so this is a parser false positive.

8. info warn → info by review decoder-decompress-payload redis/http/http_client.py:419:24

   file imports decoder module(s) base64, gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

               if "gzip" in encoding:
                   return gzip.decompress(content)
               if "deflate" in encoding:
                   # Try raw deflate, then zlib-wrapped

   likely benign LLM, confidence 0.90 HTTP client decompresses gzip/deflate response bodies according to Content-Encoding.

   Reasoning

   The snippet is standard HTTP content-encoding handling: gzip or deflate response bodies are decompressed when the server indicates that encoding. This is a normal HTTP client function, not a hidden embedded payload.

9. info critical → info by review bash-dev-tcp-socket util/wait-for-it.sh:60:21

   /dev/tcp socket opened without external binary (covert channel / reverse shell) (ast pass, confidence 0.97)

           else
               (echo > /dev/tcp/$WAITFORIT_HOST/$WAITFORIT_PORT) >/dev/null 2>&1
               WAITFORIT_result=$?
           fi

   likely benign LLM, confidence 0.90 Same bash /dev/tcp port probe in wait-for-it, reported at a second site.

   Reasoning

   Duplicate of the same /dev/tcp connectivity check in the wait-for-it utility. Its only effect is to record the exit status of a probe, which is benign.

10. info critical → info by review bash-dev-tcp-socket util/wait-for-it.sh:60:21

    /dev/tcp socket opened without external binary (covert channel / reverse shell) (ast pass, confidence 0.97)

            else
                (echo > /dev/tcp/$WAITFORIT_HOST/$WAITFORIT_PORT) >/dev/null 2>&1
                WAITFORIT_result=$?
            fi

    likely benign LLM, confidence 0.90 Same bash /dev/tcp port probe in wait-for-it, reported at a second site.

    Reasoning

    Duplicate of the same /dev/tcp connectivity check in the wait-for-it utility. Its only effect is to record the exit status of a probe, which is benign.

11. info critical → info by review dynamic-execution util/wait-for-it.sh:200:5

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

        fi
        exec "${WAITFORIT_CLI[@]}"
    else
        exit $WAITFORIT_RESULT

    likely benign LLM, confidence 0.90 After a successful wait, the script execs the user-supplied command array.

    Reasoning

    The exec runs the array WAITFORIT_CLI, which is built from the script's own '--' argument after the wait succeeds. That is the documented way to chain a command after waiting, so the dynamic path is the user's explicit command, not injected code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/redis/redis-py redis-py && cd redis-py
git checkout v8.1.0
disclude scan --severity info --diff v8.0.1 .