exceptiongroup 1.3.1

Source: https://github.com/agronholm/exceptiongroup
Tag scanned: 1.3.1
Compared with: 1.3.0 (0 signals introduced since)
Files: 18 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 02:31

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-import-with-exec tests/test_formatting.py:220:9

file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
    try:
        exec("//serser")
    except SyntaxError as exc:
        sys.excepthook(type(exc), exc, exc.__traceback__)
```
likely benign LLM, confidence 0.85 A test in a formatting test file execs a deliberately invalid literal to trigger a SyntaxError and exercise the excepthook formatter.
Reasoning
The snippet runs exec on a deliberately invalid literal string, "//serser", which always raises SyntaxError. The except block passes that error to sys.excepthook, which is the shape of a test that checks how syntax errors are formatted and displayed. The string is a fixed literal with no decoding, no network access and no payload. The pickle import is the only decoder-related signal and does not make this code a dropper. The file name also points to a formatting test. The flagged pattern is a legitimate test idiom, and the ast-pass rule matched only on surface features.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/agronholm/exceptiongroup exceptiongroup && cd exceptiongroup
git checkout 1.3.1
disclude scan --severity info --diff 1.3.0 .