starlette 1.8.0

Source: https://github.com/Kludex/starlette
Tag scanned: 1.8.0
Compared with: 1.7.0 (0 signals introduced since)
Files: 125 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload benchmarks/gzip_benchmark.py:93:16

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert isinstance(compressed, bytes)
        assert gzip.decompress(compressed) == self.payload

        assert len(self.tiny_messages) == 2
```
likely benign LLM, confidence 0.95 Benchmark test asserting that gzip decompression of a locally compressed payload round-trips correctly.
Reasoning
The snippet is a benchmark assertion that round-trips self.payload through gzip.compress/decompress and checks equality. The decompress call operates on data the test itself produced, not an embedded payload executed at runtime. This is a standard test pattern.
info ~~warn~~ → info by review decoder-decompress-payload tests/middleware/test_gzip.py:145:20

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    assert len(events) == 3
    decompressor = zlib.decompressobj(16 + zlib.MAX_WBITS)
    assert decompressor.decompress(events[1]["body"]) == chunk
    assert decompressor.decompress(events[2]["body"]) == b"tail"
```
likely benign LLM, confidence 0.95 Test verifying streamed gzip response bodies decompress to expected chunks in the gzip middleware.
Reasoning
The snippet builds a zlib decompressobj and checks decompressed chunks against expected values inside a test assertion. The input is HTTP response bodies captured from the test client, and the result is compared to known chunk and tail values. This is ordinary middleware testing with no execution of decoded content.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Kludex/starlette starlette && cd starlette
git checkout 1.8.0
disclude scan --severity info --diff 1.7.0 .