PyPI / requests / 2.34.2

requests 2.34.2

Source

https://github.com/psf/requests

Artifact scanned

requests-2.34.2-py3-none-any.whl (wheel · 71.4 KB · SHA-256 2a0d60c172f8…)

Compared with

requests-2.34.1-py3-none-any.whl (0 signals introduced since)

Files

20 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

9.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-22 23:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute requests/packages.py:9:5

   reach-by-name through `locals` (ast pass, confidence 0.60)

   for package in ("urllib3", "idna"):
       locals()[package] = __import__(package)
       # This traversal is apparently necessary such that the identities are
       # preserved (requests.packages.urllib3.* is urllib3.*)

   likely benign LLM, confidence 0.93 Compatibility shim in requests that exposes urllib3 and idna under requests.packages via locals().

   Reasoning

   This is the well-known requests compatibility shim that aliases urllib3 and idna into the requests.packages namespace. The comment explains the intent, and the loop covers only two fixed, known package names. Reaching modules by name through locals() is unusual style but not malicious.

2. info critical → info by review dynamic-import requests/packages.py:9:25

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   for package in ("urllib3", "idna"):
       locals()[package] = __import__(package)
       # This traversal is apparently necessary such that the identities are
       # preserved (requests.packages.urllib3.* is urllib3.*)

   likely benign LLM, confidence 0.85 Dynamic __import__ over a fixed tuple of urllib3 and idna inside the requests compatibility shim.

   Reasoning

   __import__ is called on a non-literal variable, which the scanner flags critical, but the variable iterates over a hardcoded tuple of two known dependencies. There is no decoding, network access, or remote input. The pattern is a legitimate, if dated, dynamic import in a known library, so the severity is overstated for this context.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o requests-2.34.2-py3-none-any.whl https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl
printf '%s  %s\n' 2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 requests-2.34.2-py3-none-any.whl | shasum -a 256 -c -
unzip -q requests-2.34.2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg