aiosignal 1.4.0

Source: https://github.com/aio-libs/aiosignal
Tag scanned: v1.4.0
Compared with: v1.3.2 (0 signals introduced since)
Files: 23 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 4.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:49:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
for PYTHON in ${PYTHON_VERSIONS}; do
    /opt/python/${PYTHON}/bin/python -m pip install -U pip
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
```
likely benign LLM, confidence 0.95 Build-script loop invoking pip and wheel builds for each Python version under /opt/python.
Reasoning
The loop variable PYTHON iterates over a configured list of Python versions and is used as a path component to run the interpreter in /opt/python. This is a standard manylinux wheel build script; the flagged pattern is ordinary parameterized tooling, not obfuscation or malicious execution.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:50:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/python -m pip install -U pip
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
done
```
likely benign LLM, confidence 0.95 Continuation of the per-version pip install and wheel build loop.
Reasoning
Same loop as the other findings: the interpreter path is built from the version variable and runs pip install and wheel build commands. Typical CI build logic with no encoding or hidden behavior.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:51:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
done
```
likely benign LLM, confidence 0.95 Per-version pip wheel command writing built wheels to an output directory.
Reasoning
Line contains the pip wheel invocation writing to a per-version output directory, within the same benign build loop. No sign of malicious intent.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:84:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    echo -n "Test $PYTHON: "
    /opt/python/${PYTHON}/bin/python -c "import platform; print('Building wheel for {platform} platform.'.format(platform=platform.platform()))"
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
```
likely benign LLM, confidence 0.93 Test step printing platform info and installing CI requirements for a given Python version.
Reasoning
Test section of a wheel build script that prints the platform and installs CI test requirements from the repo's own requirements directory. The variable-based interpreter path is expected for multi-version testing.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:85:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
```
likely benign LLM, confidence 0.93 Installs the built wheel from a local wheelhouse and runs the test suite.
Reasoning
Installs the built package from a local wheelhouse with --no-index and runs pytest on the repo tests. Standard local test flow; the variable command name only reflects multi-version iteration.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:86:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
done
```
likely benign LLM, confidence 0.93 Local wheel install followed by running py.test against the repository tests.
Reasoning
Continuation of the test loop: local --no-index install and py.test on repo tests. No network fetch of untrusted code or encoded payload.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:87:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
done
```
likely benign LLM, confidence 0.93 Runs the test suite for each configured Python interpreter.
Reasoning
Final lines of the test loop running the test suite for each Python version. Benign build and test tooling.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/aio-libs/aiosignal aiosignal && cd aiosignal
git checkout v1.4.0
disclude scan --severity info --diff v1.3.2 .