PyPI / anthropic / 1.15.0

anthropic 1.15.0

Source

https://github.com/anthropics/anthropic-sdk-python

Tag scanned

v1.15.0

Compared with

v1.14.0 (0 signals introduced since)

Files

2644 scanned, 32 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

7.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-17 08:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line api.md:2880:1

   line length 566 characters (raw pass, confidence 0.50)

   - <code title="post /v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve?beta=true">client.beta.organization.spend_limits.increase_requests.<a href="./src/anthropic/resources/beta/organization/spend_limits/increase_requests.py">approve</a>(spend_limit_increase_request_id, \*\*<a hre

2. info warn → info by review dynamic-execution tests/lib/test_credentials.py:1902:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

           # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
           exec(compile(source, "<provider>", "exec", dont_inherit=True), namespace)
   
           cache = TokenCache(namespace["provider"])

   likely benign LLM, confidence 0.93 Test helper that execs generated provider source to build a TokenCache.

   Reasoning

   The exec call runs compiled source inside a test helper; the comment explains the dont_inherit flag for annotation handling, which is a legitimate test-fixture pattern. The source is test-local, not attacker-controlled input from outside.

3. info warn → info by review dynamic-execution tests/lib/test_credentials.py:1902:14

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

           # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
           exec(compile(source, "<provider>", "exec", dont_inherit=True), namespace)
   
           cache = TokenCache(namespace["provider"])

   likely benign LLM, confidence 0.90 compile call feeding the test-only exec of provider source.

   Reasoning

   compile is the companion of the exec above, with the same documented, test-only purpose of creating a provider from source without annotation stringification. No external input is shown.

4. info warn → info by review frame-introspection tests/lib/utils.py:51:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

   def get_caller_name(*, stacklevel: int = 1) -> str:
       frame = inspect.currentframe()
       assert frame is not None

   likely benign LLM, confidence 0.95 Test utility reading the call stack to get a caller name.

   Reasoning

   Using inspect.currentframe to determine caller name is a common test-utility technique for logging or reporting; it is not malicious and has no exfiltration or execution impact.

5. info warn → info by review dynamic-execution tests/test_utils/test_reflection.py:16:5

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
       exec(compile(source, "<func>", "exec", dont_inherit=True), namespace)
   
       signature = signature_without_evaluating_annotations(namespace["func"])

   likely benign LLM, confidence 0.93 Reflection test that execs generated function source to inspect its signature.

   Reasoning

   Same documented pattern: exec of a locally generated function source in a reflection test so annotations are not stringified. Scope is a test module with no untrusted input shown.

6. info warn → info by review dynamic-execution tests/test_utils/test_reflection.py:16:10

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
       exec(compile(source, "<func>", "exec", dont_inherit=True), namespace)
   
       signature = signature_without_evaluating_annotations(namespace["func"])

   likely benign LLM, confidence 0.93 compile call supporting the reflection test's generated function source.

   Reasoning

   compile paired with the exec for the reflection test, with the same explicit justification in the comment. Benign test scaffolding.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/anthropics/anthropic-sdk-python anthropic-sdk-python && cd anthropic-sdk-python
git checkout v1.15.0
disclude scan --severity info --diff v1.14.0 .