click 8.5.0

Source: https://github.com/pallets/click
Tag scanned: 8.5.0
Compared with: 8.4.2 (0 signals introduced since)
Files: 119 scanned, 30 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 3.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution docs/shell-completion.md:45:13

[markup prose] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
            eval "$(_FOO_BAR_COMPLETE=bash_source foo-bar)"
```
likely benign LLM, confidence 0.93 Markdown docs instruct users to eval the shell completion script generated by their own CLI tool.
Reasoning
This is Click documentation showing the standard shell completion setup, where users eval the output of their own CLI's completion-script generator. It is a documented, benign pattern in a markdown file; the eval target is a locally installed tool the user chose to install. Not a dropper or obfuscation.
info ~~critical~~ → info by review dynamic-execution docs/shell-completion.md:53:13

[markup prose] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
            eval "$(_FOO_BAR_COMPLETE=zsh_source foo-bar)"
```
likely benign LLM, confidence 0.93 Markdown docs show eval of zsh completion script generated by the CLI tool itself.
Reasoning
Same documented shell completion pattern for zsh, eval of the output of the tool's own completion generator. Standard practice in CLI documentation and not malicious.
info ~~warn~~ → info by review frame-introspection src/click/decorators.py:485:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    if version is None and package_name is None:
        frame = inspect.currentframe()
        f_back = frame.f_back if frame is not None else None
        f_globals = f_back.f_globals if f_back is not None else None
```
likely benign LLM, confidence 0.90 Click's version decorator inspects the caller's frame globals to determine the package name and version.
Reasoning
Click's version option uses inspect.currentframe and f_back to find the caller's module globals to auto-detect the package version. This is a well-known, legitimate use of frame introspection in a CLI library with no network or execution behavior.
info ~~warn~~ → info by review frame-introspection tests/test_chain.py:10:12

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    click.echo(
        f"{sys._getframe(1).f_code.co_name}"
        f"={'|'.join(click.get_current_context().args)}"
    )
```
likely benign LLM, confidence 0.90 Test helper in Click's test suite reads the caller's function name via sys._getframe.
Reasoning
This is a test file in Click's test suite using sys._getframe(1) to get the calling function name for an assertion-style echo. Benign test helper code with no malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pallets/click click && cd click
git checkout 8.5.0
disclude scan --severity info --diff 8.4.2 .