yarl 1.25.1

Source: https://github.com/aio-libs/yarl
Tag scanned: v1.25.1
Compared with: v1.25.0 (0 signals introduced since)
Files: 59 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 41 info
Scan time: 13.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:17

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:57:24

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> str(URL('http://εμπορικόσήμα.eu/шлях/這裡'))
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Docs example of an internationalized Greek hostname being converted to punycode.
Reasoning
This is a doctest in yarl's API docs showing IDN handling. The Greek label is a real example word ("trademark") that is punycoded to xn--jxagkqfkduily1i, so the homoglyph flag reflects a deliberate internationalization example, not an attack.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:57:24

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> str(URL('http://εμπορικόσήμα.eu/шлях/這裡'))
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Same IDN doctest; mixed scripts are intentional to demonstrate Unicode host handling.
Reasoning
The mixed-script flag comes from the same IDN doctest. Mixing Greek, Cyrillic and Han in a demo URL is what the documentation is meant to show, and the code runs no payload.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:73:26

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> url = URL('http://εμπορικόσήμα.eu/шлях/這裡')
   >>> str(url)
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Docs example converting a Unicode hostname to its ASCII form.
Reasoning
Same yarl IDN example, here through a variable and str(url). It shows the punycode output and is part of the library documentation.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:73:26

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> url = URL('http://εμπορικόσήμα.eu/шлях/這裡')
   >>> str(url)
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Same IDN example; the mixed-script flag is expected for this demo.
Reasoning
Mixed-script warning on the same documentation example of Unicode hostnames; it is expected in an IDN demonstration.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:77:12

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> url.human_repr()
   'http://εμπορικόσήμα.eu/шлях/這裡'
```
likely benign LLM, confidence 0.92 Docs example showing the human-readable Unicode representation of a URL.
Reasoning
Doctest showing human_repr() returning the Unicode form of the host. Documentation of display behavior, no executable risk.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:77:12

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> url.human_repr()
   'http://εμπορικόσήμα.eu/шлях/這裡'
```
likely benign LLM, confidence 0.92 Same human_repr doctest; the multilingual sample explains the mixed-script flag.
Reasoning
Mixed-script flag on the human_repr doctest, which uses the same deliberate multilingual IDN sample.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:940:59

identifier `cуфікс` contains homoglyph candidates: у (0443)→y, і (0456)→i, с (0441)→c (raw pass, confidence 0.70)
```
      URL('http://example.com/path/to.doc')
      >>> URL('http://example.com/path/to').with_suffix('.cуфікс')
      URL('http://example.com/path/to.c%D1%83%D1%84%D1%96%D0%BA%D1%81')
```
likely benign LLM, confidence 0.85 Docs example applying with_suffix using a Ukrainian-looking suffix string.
Reasoning
Doctest for with_suffix in which the suffix is Ukrainian "суфікс". The Latin 'c' mixed with Cyrillic letters looks like a typo or a demo of non-ASCII suffixes, and the output is percent-encoded. It is documentation with no execution impact.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:940:59

identifier `cуфікс` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
```
      URL('http://example.com/path/to.doc')
      >>> URL('http://example.com/path/to').with_suffix('.cуфікс')
      URL('http://example.com/path/to.c%D1%83%D1%84%D1%96%D0%BA%D1%81')
```
likely benign LLM, confidence 0.85 Same with_suffix doctest; mixed Latin and Cyrillic is probably an authoring slip.
Reasoning
Mixed Latin/Cyrillic flag on the same with_suffix doctest. The likely cause is a stray Latin letter in a documentation string, which is not a real obfuscation technique here.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:1068:29

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
      >>> url = URL('http://εμπορικόσήμα.eu/這裡')
      >>> str(url)
      'http://xn--jxagkqfkduily1i.eu/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Docs example of a Unicode hostname with CJK characters being punycoded.
Reasoning
Doctest with the same IDN sample (Greek label plus Chinese characters) and its punycode output. It is documentation of library behavior.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:1068:29

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
      >>> url = URL('http://εμπορικόσήμα.eu/這裡')
      >>> str(url)
      'http://xn--jxagkqfkduily1i.eu/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.92 Same IDN doctest; mixed scripts are part of the demonstration.
Reasoning
Mixed-script flag on the IDN doctest with Greek and CJK characters. It is intended demonstration content.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:1072:15

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
      >>> url.human_repr()
      'http://εμπορικόσήμα.eu/這裡'

.. _yarl-api-default-ports:
```
likely benign LLM, confidence 0.92 Docs example of the human-readable form of an IDN URL.
Reasoning
human_repr doctest on the same IDN sample, shown in an RST docs file. No code is executed and there is no obfuscation.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:1072:15

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
      >>> url.human_repr()
      'http://εμπορικόσήμα.eu/這裡'

.. _yarl-api-default-ports:
```
likely benign LLM, confidence 0.92 Same human_repr example; the mixed-script flag is expected.
Reasoning
Mixed-script flag on the human_repr documentation example; expected for an internationalization demo.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:51:19

[embedded bash] command name is a variable (`$yarl`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ yarl/__init__.py
       [dir:yarl] $ python -m towncrier build \
                      -- --version 'VERSION_WITHOUT_LEADING_V'
```
likely benign LLM, confidence 0.93 Embedded shell example in a yarl release guide using variable-prefixed command names.
Reasoning
This is a release guide in documentation. The bash lines are illustrative commands for maintainers (cd yarl, python -m towncrier build, git commit). The scanner flags the command name being a variable, which is an artifact of the docs using a $yarl directory prefix and $python/$git placeholders. Nothing here executes automatically; it is rst documentation.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:52:19

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ yarl/__init__.py
       [dir:yarl] $ python -m towncrier build \
                      -- --version 'VERSION_WITHOUT_LEADING_V'
       [dir:yarl] $ git commit -v CHANGES{.rst,/} yarl/__init__.py
```
likely benign LLM, confidence 0.93 Documented release step invoking python -m towncrier and git commit.
Reasoning
Documentation example of a towncrier build command followed by git commit. The $python placeholder is typical of a human-readable release procedure, not a dropper or hidden execution path.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:54:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
                      -- --version 'VERSION_WITHOUT_LEADING_V'
       [dir:yarl] $ git commit -v CHANGES{.rst,/} yarl/__init__.py
```
likely benign LLM, confidence 0.93 Documented git commit step in release instructions.
Reasoning
A documented git commit command in a release guide. The variable-command flag is a false positive from the doc-style placeholder syntax.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:73:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ git tag \
                      -s 'VERSION_WITH_LEADING_V' \
                      -m 'VERSION_WITH_LEADING_V' \
```
likely benign LLM, confidence 0.93 Documented signed git tag step in the release guide.
Reasoning
Documented signed git tag command for a release, with version placeholders. Standard maintainer instructions, not executed by the repository.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:84:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ git push origin 'VERSION_WITH_LEADING_V'
```
likely benign LLM, confidence 0.93 Documented git push of the version tag to origin.
Reasoning
Documented git push of the release tag. Ordinary release procedure text in a docs file.

info unicode-homoglyph tests/test_normalize_path.py:29:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_normalize_path.py:29:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:29:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:29:59

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_normalize_path.py:30:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:70

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_quoting.py:627:10

identifier `abcфух` contains homoglyph candidates: у (0443)→y, х (0445)→x (in string/comment) (raw pass, confidence 0.35)
```
    # more than 8 KiB
    s = "abcфух%30%0a" * 1024
    assert quoter()(s) == "abc%D1%84%D1%83%D1%850%0A" * 1024
```
info unicode-mixed-script tests/test_quoting.py:627:10

identifier `abcфух` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
    # more than 8 KiB
    s = "abcфух%30%0a" * 1024
    assert quoter()(s) == "abc%D1%84%D1%83%D1%850%0A" * 1024
```

info unicode-homoglyph tests/test_url.py:1468:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_url.py:1468:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1468:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1468:59

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_url.py:1469:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:70

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:2063:23

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
def test_to_idna() -> None:
    url = URL("http://εμπορικόσήμα.eu")
    assert "http://xn--jxagkqfkduily1i.eu" == str(url)
    url = URL("http://einlaß.de/")
```

info unicode-mixed-script tests/test_url.py:2063:23

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

def test_to_idna() -> None:
    url = URL("http://εμπορικόσήμα.eu")
    assert "http://xn--jxagkqfkduily1i.eu" == str(url)
    url = URL("http://einlaß.de/")

info unicode-homoglyph tests/test_url.py:2169:23

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
def test_to_str() -> None:
    url = URL("http://εμπορικόσήμα.eu/")
    assert "http://xn--jxagkqfkduily1i.eu/" == str(url)
```
info unicode-mixed-script tests/test_url.py:2169:23

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
def test_to_str() -> None:
    url = URL("http://εμπορικόσήμα.eu/")
    assert "http://xn--jxagkqfkduily1i.eu/" == str(url)
```

info unicode-homoglyph tests/test_url_update_netloc.py:128:34

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

    url = URL("http://john@example.com")
    url2 = url.with_password("п:а")
    assert url2.raw_password == "%D0%BF%3A%D0%B0"
    assert url2.password == "п:а"

info unicode-homoglyph tests/test_url_update_netloc.py:130:33

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
```
    assert url2.raw_password == "%D0%BF%3A%D0%B0"
    assert url2.password == "п:а"
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/aio-libs/yarl yarl && cd yarl
git checkout v1.25.1
disclude scan --severity info --diff v1.25.0 .