yarl 1.25.1

Source: https://github.com/aio-libs/yarl
Tag scanned: v1.25.1
Compared with: v1.25.0 (0 signals introduced since)
Files: 59 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 41 info
Scan time: 13.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 22:31

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:57:24

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> str(URL('http://εμπορικόσήμα.eu/шлях/這裡'))
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Doctest in yarl API docs demonstrating IDN/punycode conversion of a Unicode hostname.
Reasoning
The snippet is a doctest showing IDN encoding of an internationalized hostname in yarl's API docs. The mixed Greek/Cyrillic/Han characters are deliberate examples of Unicode input, and the output shows the punycode conversion. This is legitimate documentation of a URL library's behavior.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:57:24

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> str(URL('http://εμπορικόσήμα.eu/шлях/這裡'))
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Same IDN doctest; flags the mixed-script hostname used as an example input.
Reasoning
Same doctest block as the homoglyph finding. The Greek-plus-Latin mix in the example hostname is intentional IDN demonstration text in a documentation file, not a spoofed identifier in code.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:73:26

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> url = URL('http://εμπορικόσήμα.eu/шлях/這裡')
   >>> str(url)
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Doctest showing str() conversion of a Unicode URL in yarl docs.
Reasoning
A second doctest in the same yarl docs page repeats the IDN example to show str(url) output. The characters are illustrative input for a URL library, and nothing executes or deceives.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:73:26

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> url = URL('http://εμπορικόσήμα.eu/шлях/這裡')
   >>> str(url)
   'http://xn--jxagkqfkduily1i.eu/%D1%88%D0%BB%D1%8F%D1%85/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Same IDN doctest; mixed-script hostname is intentional example input.
Reasoning
Mixed-script flag on the same intentional IDN example in the documentation. Expected for a page documenting internationalized domain handling.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:77:12

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
   >>> url.human_repr()
   'http://εμπορικόσήμα.eu/шлях/這裡'
```
likely benign LLM, confidence 0.92 Docs example of human_repr() rendering a Unicode URL.
Reasoning
Example of human_repr() output for an IDN URL in the documentation. The text is a display-format illustration, not code that hides or spoofs an identifier.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:77:12

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
   >>> url.human_repr()
   'http://εμπορικόσήμα.eu/шлях/這裡'
```
likely benign LLM, confidence 0.92 Same human_repr example; flags the mixed-script hostname.
Reasoning
Mixed-script flag on the same human_repr() documentation example. This is expected when documenting Unicode hostname rendering.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:940:59

identifier `cуфікс` contains homoglyph candidates: у (0443)→y, і (0456)→i, с (0441)→c (raw pass, confidence 0.70)
```
      URL('http://example.com/path/to.doc')
      >>> URL('http://example.com/path/to').with_suffix('.cуфікс')
      URL('http://example.com/path/to.c%D1%83%D1%84%D1%96%D0%BA%D1%81')
```
likely benign LLM, confidence 0.92 Docs example of with_suffix() with a non-ASCII suffix and its percent-encoded output.
Reasoning
The with_suffix example uses a Cyrillic-plus-Latin suffix string and shows its percent-encoded result. This illustrates how yarl encodes non-ASCII path input. The mix is in a doc example and is not used to disguise code.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:940:59

identifier `cуфікс` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)
```
      URL('http://example.com/path/to.doc')
      >>> URL('http://example.com/path/to').with_suffix('.cуфікс')
      URL('http://example.com/path/to.c%D1%83%D1%84%D1%96%D0%BA%D1%81')
```
likely benign LLM, confidence 0.92 Same with_suffix example; flags the mixed-script suffix string.
Reasoning
Mixed Latin/Cyrillic flag on the with_suffix documentation example. The mix is deliberate test input for encoding behavior.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:1068:29

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
      >>> url = URL('http://εμπορικόσήμα.eu/這裡')
      >>> str(url)
      'http://xn--jxagkqfkduily1i.eu/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Doctest in yarl docs showing punycode conversion of a Han-script hostname.
Reasoning
A doctest showing IDN conversion of a Chinese-character hostname to punycode. This is ordinary documentation of URL encoding behavior.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:1068:29

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
      >>> url = URL('http://εμπορικόσήμα.eu/這裡')
      >>> str(url)
      'http://xn--jxagkqfkduily1i.eu/%E9%80%99%E8%A3%A1'
```
likely benign LLM, confidence 0.93 Same IDN doctest; flags the mixed-script hostname.
Reasoning
Mixed-script flag on the same IDN doctest. Expected for an intentional internationalized-domain example.
info ~~warn~~ → info by review unicode-homoglyph docs/api.rst:1072:15

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (raw pass, confidence 0.70)
```
      >>> url.human_repr()
      'http://εμπορικόσήμα.eu/這裡'

.. _yarl-api-default-ports:
```
likely benign LLM, confidence 0.92 Docs example of human_repr() rendering a Unicode URL, followed by a RST label.
Reasoning
Documentation example of human_repr() on an IDN URL. The Unicode is example output, and the surrounding text is a normal RST reference label.
info ~~warn~~ → info by review unicode-mixed-script docs/api.rst:1072:15

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
      >>> url.human_repr()
      'http://εμπορικόσήμα.eu/這裡'

.. _yarl-api-default-ports:
```
likely benign LLM, confidence 0.92 Same human_repr example; flags the mixed-script hostname.
Reasoning
Mixed-script flag on the same human_repr() documentation example. Expected for this documentation content.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:51:19

[embedded bash] command name is a variable (`$yarl`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ yarl/__init__.py
       [dir:yarl] $ python -m towncrier build \
                      -- --version 'VERSION_WITHOUT_LEADING_V'
```
dismissed LLM, confidence 0.90 Release-guide bash example whose command name appears as a documentation placeholder.
Reasoning
The flagged token is a shell placeholder in a contributor release guide. The guide describes the commands a maintainer runs from the yarl checkout, and the variable is documentation notation, not a dynamic payload. Even if the variable is read as a command, it sits in a maintainer's doc.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:52:19

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ yarl/__init__.py
       [dir:yarl] $ python -m towncrier build \
                      -- --version 'VERSION_WITHOUT_LEADING_V'
       [dir:yarl] $ git commit -v CHANGES{.rst,/} yarl/__init__.py
```
dismissed LLM, confidence 0.92 Release-guide bash example running towncrier build; the variable-named command is documentation.
Reasoning
The flagged python command appears in a release-guide example that runs towncrier and git for the project's changelog. It is standard maintainer documentation with no encoded or hidden execution.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:54:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
                      -- --version 'VERSION_WITHOUT_LEADING_V'
       [dir:yarl] $ git commit -v CHANGES{.rst,/} yarl/__init__.py
```
likely benign LLM, confidence 0.90 Documentation example showing a git commit command in a release guide.
Reasoning
This is a release guide in reStructuredText documentation showing a git commit command for a project release. The 'command name is a variable' flag is an artifact of the bash-block parser treating the '$ git' prompt marker as a variable. Nothing here is executed or obfuscated.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:73:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ git tag \
                      -s 'VERSION_WITH_LEADING_V' \
                      -m 'VERSION_WITH_LEADING_V' \
```
likely benign LLM, confidence 0.90 Documentation example showing a signed git tag command for a release.
Reasoning
A documented git tag command with placeholder version strings in a project release guide. The flagged dynamic command is just the shell prompt notation in docs, not executed code or a dropper.
info ~~warn~~ → info by review dynamic-execution docs/contributing/release_guide.rst:84:19

[embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
       [dir:yarl] $ git push origin 'VERSION_WITH_LEADING_V'
```
likely benign LLM, confidence 0.90 Documentation example showing git push of a release tag.
Reasoning
A documented git push to origin with a placeholder version, in a contributor release guide. Benign instructional content flagged by a generic embedded-bash heuristic.

info unicode-homoglyph tests/test_normalize_path.py:29:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_normalize_path.py:29:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:29:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:29:59

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_normalize_path.py:30:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_normalize_path.py:30:70

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_quoting.py:627:10

identifier `abcфух` contains homoglyph candidates: у (0443)→y, х (0445)→x (in string/comment) (raw pass, confidence 0.35)
```
    # more than 8 KiB
    s = "abcфух%30%0a" * 1024
    assert quoter()(s) == "abc%D1%84%D1%83%D1%850%0A" * 1024
```
info unicode-mixed-script tests/test_quoting.py:627:10

identifier `abcфух` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
    # more than 8 KiB
    s = "abcфух%30%0a" * 1024
    assert quoter()(s) == "abc%D1%84%D1%83%D1%850%0A" * 1024
```

info unicode-homoglyph tests/test_url.py:1468:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_url.py:1468:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1468:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1468:59

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    # Non-ASCII characters
    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:7

identifier `μονοπάτι` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-mixed-script tests/test_url.py:1469:7

identifier `μονοπάτι` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:30

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:1469:70

identifier `να` contains homoglyph candidates: ν (03BD)→v, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    ("μονοπάτι/../../να/ᴜɴɪ/ᴄᴏᴅᴇ", "να/ᴜɴɪ/ᴄᴏᴅᴇ"),
    ("μονοπάτι/../../να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/.", "να/𝕦𝕟𝕚/𝕔𝕠𝕕𝕖/"),
]

info unicode-homoglyph tests/test_url.py:2063:23

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
def test_to_idna() -> None:
    url = URL("http://εμπορικόσήμα.eu")
    assert "http://xn--jxagkqfkduily1i.eu" == str(url)
    url = URL("http://einlaß.de/")
```

info unicode-mixed-script tests/test_url.py:2063:23

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

def test_to_idna() -> None:
    url = URL("http://εμπορικόσήμα.eu")
    assert "http://xn--jxagkqfkduily1i.eu" == str(url)
    url = URL("http://einlaß.de/")

info unicode-homoglyph tests/test_url.py:2169:23

identifier `εμπορικόσήμα` contains homoglyph candidates: ο (03BF)→o, ρ (03C1)→p, κ (03BA)→k, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
def test_to_str() -> None:
    url = URL("http://εμπορικόσήμα.eu/")
    assert "http://xn--jxagkqfkduily1i.eu/" == str(url)
```
info unicode-mixed-script tests/test_url.py:2169:23

identifier `εμπορικόσήμα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
def test_to_str() -> None:
    url = URL("http://εμπορικόσήμα.eu/")
    assert "http://xn--jxagkqfkduily1i.eu/" == str(url)
```

info unicode-homoglyph tests/test_url_update_netloc.py:128:34

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

    url = URL("http://john@example.com")
    url2 = url.with_password("п:а")
    assert url2.raw_password == "%D0%BF%3A%D0%B0"
    assert url2.password == "п:а"

info unicode-homoglyph tests/test_url_update_netloc.py:130:33

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
```
    assert url2.raw_password == "%D0%BF%3A%D0%B0"
    assert url2.password == "п:а"
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/aio-libs/yarl yarl && cd yarl
git checkout v1.25.1
disclude scan --severity info --diff v1.25.0 .