Repository navigation
[flake8-bandit] Describe what the rule actually checks for httpx (S113) - #27936
Merged
Merged
Conversation
The rule's docs said it checks `requests` or `httpx` calls that omit `timeout`. That has not been true for httpx since astral-sh#12213: omitting the argument is fine there, and only an explicit `timeout=None` is reported. The implementation only reports the implicit case when the module is `requests`. Assisted-by: Claude (Anthropic)
ntBre
changed the title
flake8-bandit] Describe what the rule actually checks for httpx (S113)
ntBre
added
the
documentation
ntBre
reviewed
Aug 28, 2026
ntBre
left a comment
ntBre
left a comment
Contributor
There was a problem hiding this comment.
Thanks! I had a couple of phrasing suggestions, but this looks reasonable to me.
Contributor
|
Don't worry about this |
This comment was marked as low quality.
This comment was marked as low quality.
Sorry, something went wrong.
Co-authored-by: Brent Westbrook <36778786+ntBre@users.noreply.github.com>
ntBre
approved these changes
Oct 26, 2026
ntBre
enabled auto-merge (squash)
October 26, 2026 17:15
rlichtenwalter
added a commit
to rlichtenwalter/dir2text
that referenced
this pull request
Oct 30, 2026
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [DavidAnson/markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) | repository | minor | `v0.23.3` → `v0.24.0` |  |  | | [ruff](https://docs.astral.sh/ruff) ([source](https://github.com/astral-sh/ruff), [changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | dependency-groups | patch | `==0.17.1` → `==0.17.3` |  |  | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>DavidAnson/markdownlint-cli2</summary> ### [`v0.24.0`](DavidAnson/markdownlint-cli2@v0.23.3...v0.24.0) [Compare Source](DavidAnson/markdownlint-cli2@v0.23.3...v0.24.0) </details> <details> <summary>astral-sh/ruff (ruff)</summary> ### [`v0.17.3`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0173) [Compare Source](astral-sh/ruff@0.17.2...0.17.3) Released on 2026-10-26. ##### Preview features - \[`suspicious`] Add `shared-clock-mock` ([#​29074](astral-sh/ruff#29074)) ##### Bug fixes - \[`pyupgrade`] Avoid incorrect conversions to f-strings (`UP032`) ([#​25485](astral-sh/ruff#25485)) ##### Performance - Buffer stdout in `ruff format` ([#​29631](astral-sh/ruff#29631)) - Specialize ASCII identifier lexing ([#​29503](astral-sh/ruff#29503)) - Speed up identifier and keyword lexing ([#​29463](astral-sh/ruff#29463)) ##### Documentation - \[`flake8-bandit`] Describe what the rule actually checks for `httpx` (`S113`) ([#​27936](astral-sh/ruff#27936)) ##### Contributors - [@​itsvedantkumar](https://github.com/itsvedantkumar) - [@​charliermarsh](https://github.com/charliermarsh) - [@​anishgirianish](https://github.com/anishgirianish) ### [`v0.17.2`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0172) [Compare Source](astral-sh/ruff@0.17.1...0.17.2) Released on 2026-10-22. ##### Preview features - \[`complexity`] Add `unnecessary-regular-expression-compile` ([#​25533](astral-sh/ruff#25533)) ##### Bug fixes - Avoid syntax errors for type variables with starred constraints (`UP040`, `UP046`, `UP047`, `RUF053`) ([#​28362](astral-sh/ruff#28362)) - \[`pydocstyle`] Treat backslash-escaped `*args` and `**kwargs` as documented (`D417`) ([#​29536](astral-sh/ruff#29536)) - \[`pylint`] Avoid false positive on starred elements (`PLE0643`) ([#​29483](astral-sh/ruff#29483)) - \[`pylint`] Mark fixes unsafe when deleting comments (`PLR5501`, `PLW0120`) ([#​29414](astral-sh/ruff#29414)) - \[`pyupgrade`] Mark fix unsafe when deleting comments (`UP035`) ([#​29413](astral-sh/ruff#29413)) ##### Performance - Avoid intermediate names in lint name resolution ([#​29506](astral-sh/ruff#29506)) - Prefilter bidirectional Unicode checks by UTF-8 leading bytes ([#​29561](astral-sh/ruff#29561)) - Share postfix parsing and reduce expression copies ([#​29480](astral-sh/ruff#29480)) ##### Configuration - \[`pylint`] Add a configurable allowlist for `magic-value-comparison` (`PLR2004`) ([#​18961](astral-sh/ruff#18961)) ##### Documentation - Clarify documentation and correct stale guidance ([#​29374](astral-sh/ruff#29374)) - \[`pyupgrade`] Remove mentions of variance related to fix safety (`UP040`, `UP047`) ([#​29592](astral-sh/ruff#29592)) ##### Contributors - [@​fixfon](https://github.com/fixfon) - [@​MichaReiser](https://github.com/MichaReiser) - [@​zaniebot](https://github.com/zaniebot) - [@​FrancescoPezzella](https://github.com/FrancescoPezzella) - [@​anishgirianish](https://github.com/anishgirianish) - [@​rajveer3x](https://github.com/rajveer3x) - [@​charliermarsh](https://github.com/charliermarsh) - [@​LckyLike](https://github.com/LckyLke) - [@​DaniBodor](https://github.com/DaniBodor) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Denver) - Branch creation - Between 02:00 AM and 06:59 AM, only on Tuesday (`* 2-6 * * 2`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDguMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE0OC4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> Reviewed-on: https://git.lichtenwalter.site/rlichten/dir2text/pulls/100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi :)
Summary
The S113 docs say it checks
requestsorhttpxcalls that omittimeout, but that hasn't been true for httpx sincee #12213httpx applies a default timeout, so leaving the argument out is fine there -- only an explicit
timeout=Nonegets reportedIn the code the implicit case is only reported when the module is
requestsSo this rewrites "What it does" & "Why is this bad?" to match what the rule actually does
Doc comment only, no behaviour change -- closes #27868
Test Plan
Ran ruff 0.16.3 over three files:
httpx.get(url)-> nothing reportedhttpx.get(url, timeout=None)-> S113, "timeout set toNone"requests.get(url)-> S113, "without timeout"docs/rulesis generated rather than committed, so there's nothing to regenerate hereDrafted with AI assistance (Claude Fable 5)