exceptiongroup 1.3.1

Source: https://github.com/agronholm/exceptiongroup
Tag scanned: 1.3.1
Compared with: 1.3.0 (0 signals introduced since)
Files: 18 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:32

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-import-with-exec tests/test_formatting.py:220:9

file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
    try:
        exec("//serser")
    except SyntaxError as exc:
        sys.excepthook(type(exc), exc, exc.__traceback__)
```
likely benign LLM, confidence 0.85 A formatting test file runs exec on a deliberately invalid string to exercise SyntaxError handling.
Reasoning
The snippet calls exec on the literal string "//serser", which is not valid Python, and catches SyntaxError to route it to sys.excepthook. That is a test pattern for handling syntax errors in code being formatted, not a payload being decoded or run. The flagged pickle import is a separate signal in the same file and does not show a decode-then-exec chain here. The file is a formatting test, which fits this reading. The residual doubt is that the rest of the file is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/agronholm/exceptiongroup exceptiongroup && cd exceptiongroup
git checkout 1.3.1
disclude scan --severity info --diff 1.3.0 .