PyPI / anthropic / 1.15.0

anthropic 1.15.0

Source

https://github.com/anthropics/anthropic-sdk-python

Tag scanned

v1.15.0

Compared with

v1.14.0 (0 signals introduced since)

Files

2644 scanned, 32 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

8.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 05:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line api.md:2880:1

   line length 566 characters (raw pass, confidence 0.50)

   - <code title="post /v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve?beta=true">client.beta.organization.spend_limits.increase_requests.<a href="./src/anthropic/resources/beta/organization/spend_limits/increase_requests.py">approve</a>(spend_limit_increase_request_id, \*\*<a hre

2. info warn → info by review dynamic-execution tests/lib/test_credentials.py:1902:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

           # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
           exec(compile(source, "<provider>", "exec", dont_inherit=True), namespace)
   
           cache = TokenCache(namespace["provider"])

   likely benign LLM, confidence 0.85 Test helper that execs a compiled provider source string into a namespace to build a TokenCache for testing.

   Reasoning

   The exec call sits in a test helper, and the comment explains that dont_inherit is needed so this module's `from __future__ import annotations` does not turn the provider's annotations into strings. That is a deliberate way to build test fixtures from source text. The snippet does not show where the source string comes from, which is the one open question, but nothing here suggests attacker-controlled input or concealment.

3. info warn → info by review dynamic-execution tests/lib/test_credentials.py:1902:14

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

           # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
           exec(compile(source, "<provider>", "exec", dont_inherit=True), namespace)
   
           cache = TokenCache(namespace["provider"])

   likely benign LLM, confidence 0.85 compile call building the code object for the test provider exec above.

   Reasoning

   This compile call is the first half of the same exec(compile(...)) pattern. The dont_inherit flag and the explanatory comment show it is intentional test scaffolding about annotation evaluation, not obfuscation.

4. info warn → info by review frame-introspection tests/lib/utils.py:51:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

   def get_caller_name(*, stacklevel: int = 1) -> str:
       frame = inspect.currentframe()
       assert frame is not None

   likely benign LLM, confidence 0.90 Test utility reading the call-stack frame to determine the caller's name.

   Reasoning

   inspect.currentframe is used to find the caller's name for a stacklevel-based helper in test utilities. This is a common, legitimate introspection technique for logging or test labelling and has no evasion or malicious role.

5. info warn → info by review dynamic-execution tests/test_utils/test_reflection.py:16:5

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
       exec(compile(source, "<func>", "exec", dont_inherit=True), namespace)
   
       signature = signature_without_evaluating_annotations(namespace["func"])

   likely benign LLM, confidence 0.85 Test code that execs a function source string to check signature extraction without evaluating annotations.

   Reasoning

   This matches the same test pattern: exec of compiled source with dont_inherit, documented in the comment, to produce a function whose annotations are then inspected by signature_without_evaluating_annotations. It exercises reflection behaviour and is not a dropper.

6. info warn → info by review dynamic-execution tests/test_utils/test_reflection.py:16:10

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       # dont_inherit: this module's `from __future__ import annotations` would turn the annotations into strings.
       exec(compile(source, "<func>", "exec", dont_inherit=True), namespace)
   
       signature = signature_without_evaluating_annotations(namespace["func"])

   likely benign LLM, confidence 0.85 compile call producing the code object for the reflection test function exec.

   Reasoning

   The compile call is the other half of the exec(compile(...)) fixture pattern in a reflection test, with the same documented reason for dont_inherit. No sign of hidden payload or runtime fetch appears in the snippet.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/anthropics/anthropic-sdk-python anthropic-sdk-python && cd anthropic-sdk-python
git checkout v1.15.0
disclude scan --severity info --diff v1.14.0 .