PyPI / frozenlist / 1.8.0

frozenlist 1.8.0

Source

https://github.com/aio-libs/frozenlist

Tag scanned

v1.8.0

Compared with

v1.7.0 (0 signals introduced since)

Files

33 scanned, 13 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

4.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 23:07

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:51:25

   [embedded bash] command name is a variable (`$frozenlist`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ frozenlist/__init__.py
          [dir:frozenlist] $ python -m towncrier build \
                               -- --version 'VERSION_WITHOUT_LEADING_V'

   likely benign LLM, confidence 0.90 Release guide example showing a dev workflow with towncrier and git commands in an rst code block.

   Reasoning

   This is a shell example in release documentation for the frozenlist project. The 'variable' command name is just the doc's prompt-style placeholder for ordinary commands like python, git, and towncrier; there is no obfuscation or hidden execution, only a documentation code block the scanner misread as dynamic execution.

2. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:52:25

   [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ frozenlist/__init__.py
          [dir:frozenlist] $ python -m towncrier build \
                               -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:frozenlist] $ git commit -v CHANGES{.rst,/} frozenlist/__init__.py

   likely benign LLM, confidence 0.90 Documented command 'python -m towncrier build' in a release guide.

   Reasoning

   The flagged token is the standard 'python' invocation in a documented release procedure. Plain documentation of a build command, not malicious dynamic execution.

3. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:54:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

                               -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:frozenlist] $ git commit -v CHANGES{.rst,/} frozenlist/__init__.py

   likely benign LLM, confidence 0.90 Documented 'git commit' step in the frozenlist release guide.

   Reasoning

   The flagged 'git commit' line is an ordinary release-procedure instruction in project documentation. The scanner flagged a bare command name in a doc block, which is a false positive.

4. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:73:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ git tag \
                               -s 'VERSION_WITH_LEADING_V' \
                               -m 'VERSION_WITH_LEADING_V' \

   likely benign LLM, confidence 0.90 Documented 'git tag -s' release step with version placeholder.

   Reasoning

   This is a documented signed git tag command for a release. It is legitimate maintainer guidance in a docs file, not an execution vector.

5. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:84:25

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:frozenlist] $ git push origin 'VERSION_WITH_LEADING_V'

   likely benign LLM, confidence 0.90 Documented 'git push' release step in the frozenlist release guide.

   Reasoning

   This is a documented 'git push origin' release step. The flagged command is a plain git invocation in prose documentation, so the finding is a false positive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/aio-libs/frozenlist frozenlist && cd frozenlist
git checkout v1.8.0
disclude scan --severity info --diff v1.7.0 .