aiosignal 1.4.0

Source: https://github.com/aio-libs/aiosignal
Tag scanned: v1.4.0
Compared with: v1.3.2 (0 signals introduced since)
Files: 23 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 5.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 23:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:49:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
for PYTHON in ${PYTHON_VERSIONS}; do
    /opt/python/${PYTHON}/bin/python -m pip install -U pip
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
```
likely benign LLM, confidence 0.90 Build loop invoking per-version Python interpreters to pip install and build wheels.
Reasoning
The loop variable PYTHON iterates over a list of Python versions to build wheels for manylinux; the command path is built from a version string under /opt/python, a standard build-script pattern. Flagged only because the variable is interpolated into a command position, which is normal here.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:50:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/python -m pip install -U pip
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
done
```
likely benign LLM, confidence 0.90 Continuation of the wheel build loop running pip install and wheel for each Python version.
Reasoning
Same loop as line 49; the interpreter path is parameterized by the version list and the commands are ordinary pip install and wheel build steps.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:51:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/python -m pip install -r "${WORKDIR_PATH}/requirements/wheel.txt"
    /opt/python/${PYTHON}/bin/python -m pip wheel "${SRC_DIR}/" --no-deps -w "${ORIG_WHEEL_DIR}/${PYTHON}" -v
done
```
likely benign LLM, confidence 0.90 Runs pip wheel for the package into a per-version output directory.
Reasoning
Standard pip wheel invocation within the version loop, output written to a wheel directory. No download-and-execute or encoded payload.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:84:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    echo -n "Test $PYTHON: "
    /opt/python/${PYTHON}/bin/python -c "import platform; print('Building wheel for {platform} platform.'.format(platform=platform.platform()))"
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
```
likely benign LLM, confidence 0.90 Test stage printing platform info and installing CI requirements per Python version.
Reasoning
A test step that prints the platform and installs CI test requirements into the per-version interpreter. Ordinary CI test scaffolding with no obfuscation.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:85:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
```
likely benign LLM, confidence 0.90 Installs the built wheel from a local wheelhouse for testing.
Reasoning
Installs the built package from a local wheelhouse with --no-index and runs pip install from a local file URL, which is a safe offline install pattern. Variable command position is expected in a multi-version build script.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:86:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install -r ${WORKDIR_PATH}/requirements/ci-wheel.txt
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
done
```
likely benign LLM, confidence 0.90 Runs the local install and the project's pytest suite per Python version.
Reasoning
Repeats the local-wheelhouse install and invokes py.test on the repo tests, typical CI behavior with no remote execution or encoding.
info ~~warn~~ → info by review dynamic-execution tools/build-wheels.sh:87:5

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    /opt/python/${PYTHON}/bin/pip install "$package_name" --no-index -f "file://${WHEELHOUSE_DIR}"
    /opt/python/${PYTHON}/bin/py.test ${WORKDIR_PATH}/tests
done
```
likely benign LLM, confidence 0.90 Invokes py.test against the repository tests for each Python version.
Reasoning
Runs the project's test suite with py.test for each interpreter; standard CI test invocation with no suspicious payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/aio-libs/aiosignal aiosignal && cd aiosignal
git checkout v1.4.0
disclude scan --severity info --diff v1.3.2 .