PyPI / databricks-sdk / 0.156.0

databricks-sdk 0.156.0

Source

https://github.com/databricks/databricks-sdk-py

Artifact scanned

databricks_sdk-0.156.0-py3-none-any.whl (wheel · 1.1 MB · SHA-256 1aa5e0cabfc5…)

Compared with

databricks_sdk-0.155.0-py3-none-any.whl (0 signals introduced since)

Files

98 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 10:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute databricks/sdk/runtime/__init__.py:130:9

   reach-by-name through `globals` (ast pass, confidence 0.60)

       for var in dbruntime_objects:
           globals()[var] = None
   
       # The next few try-except blocks are for initialising globals in a best effort

   likely benign LLM, confidence 0.85 Initialises module globals to None by name for optional Databricks runtime objects.

   Reasoning

   The loop sets globals() entries to None for names from dbruntime_objects, a standard best-effort initialisation pattern in the Databricks SDK runtime shim. Reaching names through globals() is unusual but is used here to pre-declare placeholders for optional runtime objects, with no decoding, network or process execution involved.

2. info high-complexity databricks/sdk/service/catalog.py:8028:12

   compression ratio 0.838 is >2σ above file mean 0.799 (raw pass, confidence 0.50)

       def as_dict(self) -> dict:
           """Serializes the ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth into a dictionary suitable for use as a JSON request body."""
           body = {}
           if self.api_key_name is not None:

3. info warn → info by review encoding-base64 databricks/sdk/service/iam.py:2298:37

   base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

             Examples | Summary :--- | :--- ``etag=`` | An empty etag can only be used in GET to indicate no
             freshness requirements. ``etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==`` | An
             etag encoded a specific version of the rule set to get or to be updated.

   dismissed LLM, confidence 0.95 A sample etag string inside an API docstring table.

   Reasoning

   The flagged blob is an etag example inside a docstring table describing the ETag format for rule-set versioning. It is documentation text, not executable or encoded payload, and the raw base64-like match is a known false positive.

4. info warn → info by review encoding-base64 databricks/sdk/service/iam.py:2414:37

   base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

             Examples | Summary :--- | :--- ``etag=`` | An empty etag can only be used in GET to indicate no
             freshness requirements. ``etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==`` | An
             etag encoded a specific version of the rule set to get or to be updated.

   dismissed LLM, confidence 0.95 A sample etag string inside an API docstring table.

   Reasoning

   Identical docstring example of an etag value in the same generated SDK file; it is documentation for the API parameter and carries no obfuscation or malicious behaviour.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o databricks_sdk-0.156.0-py3-none-any.whl https://files.pythonhosted.org/packages/d2/c1/631160994379b7baa4605c2a4ffa6bca374b3ef73213e43b2dfcbd6c2bb9/databricks_sdk-0.156.0-py3-none-any.whl
printf '%s  %s\n' 1aa5e0cabfc5626a886c9fa42bc1ce14a6166e8167ef34026dcc41f3c99e2a5a databricks_sdk-0.156.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q databricks_sdk-0.156.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg