crates.io / parking_lot / 0.13.0

parking_lot 0.13.0

Source

https://github.com/Amanieu/parking_lot

Artifact scanned

parking_lot-0.13.0.crate (crate · 48.3 KB · SHA-256 a9cf937ca4e1…)

Compared with

parking_lot-0.12.5.crate (1 signals introduced since)

Files

22 scanned, 9 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 02:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution .github/semver-checks/cargo-semver-checks:19:1 new in this release

   command name is a variable (`$CARGO_SEMVER_CHECKS_REAL`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   
   "$CARGO_SEMVER_CHECKS_REAL" "$@" "${features[@]}"

   likely benign LLM, confidence 0.80 A bash wrapper in .github that execs the real cargo-semver-checks binary, named by an environment variable, with forwarded arguments and feature flags.

   Reasoning

   The flagged line runs the binary named by $CARGO_SEMVER_CHECKS_REAL with the script's arguments and a feature array. This looks like a CI wrapper that forwards to the real cargo-semver-checks, adding feature flags. The variable is an environment-controlled path, which is a common and legitimate wrapper pattern, though it does leave the executed command to the environment. The file lives under .github/semver-checks, which fits release tooling rather than a payload. No encoding, network access, or hidden logic appears in the snippet.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o parking_lot-0.13.0.crate 'https://static.crates.io/crates/parking%5Flot/parking%5Flot-0%2E13%2E0.crate'
printf '%s  %s\n' a9cf937ca4e1d0b7578784559063422fc39ae7c5a00f02471f2614d5486fd226 parking_lot-0.13.0.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf parking_lot-0.13.0.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg