[flake8-bandit] fix S113 false positive for httpx without timeout argument - #12213

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

The rule's docs said it checks `requests` or `httpx` calls that omit
`timeout`. That has not been true for httpx since astral-sh#12213: omitting the
argument is fine there, and only an explicit `timeout=None` is reported.
The implementation only reports the implicit case when the module is
`requests`.

Assisted-by: Claude (Anthropic)

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

The rule stopped flagging `httpx` calls that omit `timeout` in astral-sh#12213,
since httpx applies a default timeout. Update the documentation to
describe what the rule actually checks.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.

…al-sh#27868)

The docs say the rule checks `requests` or `httpx` calls that omit the
`timeout` parameter. That has not been true for `httpx` since astral-sh#12213, which
stopped reporting on it because `httpx` already applies a five second timeout
by default, so omitting the parameter is not a hang risk there.

The description also never mentioned the case the rule does still check for
both modules, an explicit `timeout=None`, even though the violation message
has a separate wording for it.

Describe what the rule actually does: `requests` calls that omit `timeout`,
and `requests` or `httpx` calls that pass `timeout=None`. Say why the two
modules differ, so it is clear this is a deliberate distinction rather than a
gap.