PyPI / frozenlist / 1.8.0

frozenlist 1.8.0

Source

https://github.com/aio-libs/frozenlist

Tag scanned

v1.8.0

Compared with

v1.7.0 (0 signals introduced since)

Files

33 scanned, 13 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:51:25

   [embedded bash] command name is a variable (`$frozenlist`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ frozenlist/__init__.py
          [dir:frozenlist] $ python -m towncrier build \
                               -- --version 'VERSION_WITHOUT_LEADING_V'

   likely benign LLM, confidence 0.90 Release guide documentation showing shell prompt lines for building a frozenlist release.

   Reasoning

   The flagged token is a shell prompt in an RST doc code block, where '$' is the prompt marker and 'frozenlist' is a directory label; the finding misreads prompt syntax as a variable command name. The file is documentation for a release process with no executable payload.

2. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:52:25

   [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ frozenlist/__init__.py
          [dir:frozenlist] $ python -m towncrier build \
                               -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:frozenlist] $ git commit -v CHANGES{.rst,/} frozenlist/__init__.py

   likely benign LLM, confidence 0.90 Documented shell command to build the changelog with towncrier during release.

   Reasoning

   The '$python' match is the documented prompt marker followed by a normal towncrier invocation in a docs code block. It is an ordinary release instruction, not a dynamic execution dropper.

3. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:54:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

                               -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:frozenlist] $ git commit -v CHANGES{.rst,/} frozenlist/__init__.py

   likely benign LLM, confidence 0.90 Documented git commit command in the release guide.

   Reasoning

   The '$git' match is a prompt-prefixed git commit example in release documentation. Nothing in the snippet is obfuscated or malicious.

4. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:73:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ git tag \
                               -s 'VERSION_WITH_LEADING_V' \
                               -m 'VERSION_WITH_LEADING_V' \

   likely benign LLM, confidence 0.90 Documentation of signed git tag creation for a release.

   Reasoning

   This is a documented signed git tag command with placeholder version text in an RST release guide. The flagged 'git' is a normal command name, and the snippet shows no hidden behavior.

5. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:84:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ git push origin 'VERSION_WITH_LEADING_V'

   likely benign LLM, confidence 0.90 Documented git push of the release tag to origin.

   Reasoning

   A documented git push of the release tag in a contributor guide. This is standard release instructions with no evasion or payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/aio-libs/frozenlist frozenlist && cd frozenlist
git checkout v1.8.0
disclude scan --severity info --diff v1.7.0 .