vetkit.resilience.blocking-call-in-handler.py-async
$CALL blocks inside a coroutine. Async frameworks (FastAPI, Starlette, aiohttp, Django async views) serve every request of a worker on one event loop thread, so while this call waits on the network, a timer or a child process, or hashes a password, no other request on that worker makes progress.
Last updated:
Suite: Production readiness
python
$CALL blocks inside a coroutine. Async frameworks (FastAPI, Starlette, aiohttp, Django async views) serve every request of a worker on one event loop thread, so while this call waits on the network, a timer or a child process, or hashes a password, no other request on that worker makes progress.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Use the async equivalent (httpx.AsyncClient or aiohttp instead of requests and urllib, await asyncio.sleep() instead of time.sleep(), asyncio.create_subprocess_exec instead of subprocess), or move the blocking call (including bcrypt hashing) to a thread with await asyncio.to_thread(...) or run_in_threadpool. In FastAPI, a route that only does blocking work can simply be a plain def.
References
Source: packages/engine/rules/resilience/python.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.