crates.io / hashbrown / 0.17.1

hashbrown 0.17.1

Source

https://github.com/rust-lang/hashbrown

Tag scanned

v0.17.1

Compared with

v0.17.0 (0 signals introduced since)

Files

44 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 8 info

Scan time

2.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 20:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info dynamic-execution ci/run.sh:46:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   # Make sure we can compile without the default hasher
   "${CARGO}" -vv build --target="${TARGET}" --no-default-features
   "${CARGO}" -vv build --target="${TARGET}" --release --no-default-features

2. info dynamic-execution ci/run.sh:47:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   "${CARGO}" -vv build --target="${TARGET}" --no-default-features
   "${CARGO}" -vv build --target="${TARGET}" --release --no-default-features
   
   "${CARGO}" -vv ${OP} --target="${TARGET}"

3. info dynamic-execution ci/run.sh:49:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   
   "${CARGO}" -vv ${OP} --target="${TARGET}"
   "${CARGO}" -vv ${OP} --target="${TARGET}" --features "${FEATURES}"

4. info dynamic-execution ci/run.sh:50:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   "${CARGO}" -vv ${OP} --target="${TARGET}"
   "${CARGO}" -vv ${OP} --target="${TARGET}" --features "${FEATURES}"
   
   "${CARGO}" -vv ${OP} --target="${TARGET}" --release

5. info dynamic-execution ci/run.sh:52:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   
   "${CARGO}" -vv ${OP} --target="${TARGET}" --release
   "${CARGO}" -vv ${OP} --target="${TARGET}" --release --features "${FEATURES}"

6. info dynamic-execution ci/run.sh:53:1

   command name is a variable (`$CARGO`) that this file sets only to plain text (ast pass, confidence 0.40)

   "${CARGO}" -vv ${OP} --target="${TARGET}" --release
   "${CARGO}" -vv ${OP} --target="${TARGET}" --release --features "${FEATURES}"

7. info warn → info by review dynamic-execution ci/tools.sh:13:9

   command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

           }
           "$@"
           result=$?
           [ $result -eq 0 ] && break

   likely benign LLM, confidence 0.90 A bash retry wrapper in a CI tools script that executes its positional arguments until one attempt succeeds.

   Reasoning

   The snippet is a retry loop that runs "$@", the arguments passed to the script, then breaks on success. This is a standard CI retry wrapper pattern. The command comes from the invoking CI configuration, not from attacker-controlled or obfuscated input. The dynamic-execution signal is accurate but reflects a normal design choice in a build helper.

8. info whitespace-anomaly src/macros.rs:4:1

   file mixes tab and space indentation (2 tab-indented and 51 space-indented lines) (raw pass, confidence 0.40)

   macro_rules! cfg_if {
       // match if/else chains with a final `else`
       ($(
           if #[cfg($($meta:meta),*)] { $($it:item)* }

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rust-lang/hashbrown hashbrown && cd hashbrown
git checkout v0.17.1
disclude scan --severity info --diff v0.17.0 .