zerocopy 0.8.63

Source: https://github.com/google/zerocopy
Artifact scanned: zerocopy-0.8.63.crate (crate · 325.5 KB · SHA-256 e5fe1f8f1b06…)
Compared with: zerocopy-0.8.62.crate (0 signals introduced since)
Files: 155 scanned, 254 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 04:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution cargo.sh:25:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
cd "$ZEROCOPY_DIR"
exec "$REPO_DIR/tools/target/debug/cargo-zerocopy" "$@"
```
likely benign LLM, confidence 0.80 A bash wrapper script that execs a locally built cargo-zerocopy helper binary from the repository's tools directory, passing through its arguments.
Reasoning
The script changes into a directory and then execs a binary built from the repository's own tools directory (tools/target/debug/cargo-zerocopy), forwarding arguments. This is a typical cargo wrapper pattern in the zerocopy project, where the tool is built locally before being executed. The dynamic path is a variable rooted in the repo, not a downloaded or attacker-controlled location. Residual doubt: the binary's origin is not shown in the snippet, but nothing here indicates malicious intent.

info high-complexity src/error.rs:1201:14

compression ratio 0.667 is >2σ above file mean 0.553 (raw pass, confidence 0.50)

            ValidityError::<_, bool>::new(&[2u8; 1][..]).to_string(),
            "The conversion failed because the source bytes are not a valid value of the destination type.\n\
            \n\
            Destination type: bool"

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o zerocopy-0.8.63.crate 'https://static.crates.io/crates/zerocopy/zerocopy-0%2E8%2E63.crate'
printf '%s  %s\n' e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8 zerocopy-0.8.63.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf zerocopy-0.8.63.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg