gitpython 3.2.1

Source: https://github.com/gitpython-developers/GitPython
Tag scanned: 3.2.1
Compared with: 3.2.0 (0 signals introduced since)
Files: 183 scanned, 114 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 6.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:49

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution build-release.sh:12:5

command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
function release_with() {
    "$1" -m build --sdist --wheel
}
```
likely benign LLM, confidence 0.70 A release helper that invokes a caller-supplied interpreter or command with `-m build`.
Reasoning
The function runs whatever command the caller passes as $1 and then runs a standard python build. That is a release wrapper that forwards its argument, not hidden or encoded execution. The caller is trusted in a build script, so the risk is limited.
info ~~warn~~ → info by review encoding-base64 git/cmd.py:771:36

base64-like blob (68 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
```
    * :meth:`Git.execute` (on the ``shell`` parameter).
    * https://github.com/gitpython-developers/GitPython/commit/0d9390866f9ce42870d3116094cd49e0019a970a
    * https://learn.microsoft.com/en-us/windows/win32/procthread/process-creation-flags
```
dismissed LLM, confidence 0.95 Docstring text with links, flagged as a base64 blob by mistake.
Reasoning
The snippet is docstring prose with plain URLs and no encoded data. The base64 detection is a false positive from the raw pass.
info ~~warn~~ → info by review decoder-decompress-payload gitdb/gitdb/fun.py:409:11

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    decompress_size = 8192      # is used in cgit as well
    hdr = decompressobj().decompress(m, decompress_size)
    type_name, size = hdr[:hdr.find(NULL_BYTE)].split(BYTE_SPACE)
```
likely benign LLM, confidence 0.90 Decompresses a git object header to read its type and size.
Reasoning
The code decompresses the header of a git loose object, which is zlib-compressed by git's format. Parsing the type and size is the normal way to read git objects, and nothing here runs the decompressed data.
info ~~warn~~ → info by review decoder-decompress-payload gitdb/gitdb/stream.py:73:21

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self._m = m
        self._zip = zlib.decompressobj()
        self._buf = None                        # buffer of decompressed bytes
        self._buflen = 0                        # length of bytes in buffer
```
likely benign LLM, confidence 0.90 Creates a streaming zlib decompressor for reading git objects.
Reasoning
This creates a zlib decompressor to stream git object data from a file-like source. It is the standard implementation of git's object storage, and the decompressed bytes are only buffered as data.
info ~~warn~~ → info by review dynamic-execution test/fixtures/env_case.py:18:7

`subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
# Step 4: Create the non-Python grandchild that accesses the variable case-sensitively.
print(subprocess.check_output(["set", env_var_name], shell=True, text=True))
```
likely benign LLM, confidence 0.80 A test fixture that runs a fixed `set` command through a shell to check environment variables.
Reasoning
This is a test fixture for case-sensitive environment variable lookup. The command is a fixed literal list with shell=True, and the only input is a test variable name. It is not part of a dropper or hidden execution path.
info ~~warn~~ → info by review encoding-base64 test/test_commit.py:512:1

base64-like blob (724 bytes over 12 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
iQIcBAABAgAGBQJRk8zMAAoJEG5mS6x6i9IjsTEP/0v2Wx/i7dqyKban6XMIhVdj
uI0DycfXqnCCZmejidzeao+P+cuK/ZAA/b9fU4MtwkDm2USvnIOrB00W0isxsrED
sdv6uJNa2ybGjxBolLrfQcWutxGXLZ1FGRhEvkPTLMHHvVriKoNFXcS7ewxP9MBf
```
dismissed LLM, confidence 0.90 Armored PGP signature test data flagged as a base64 blob.
Reasoning
The lines are a PGP signature block (the 'iQIc...' prefix is a typical armored signature). It is test data for commit signature parsing, and the raw pass flagged ordinary armored content.
info unicode-homoglyph test/test_exc.py:56:6

identifier `ομορφο` contains homoglyph candidates: ο (03BF)→o, ο (03BF)→o, ρ (03C1)→p, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)
```
    "stream",
    "ομορφο stream",
)
```
info unicode-mixed-script test/test_exc.py:56:6

identifier `ομορφο` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
    "stream",
    "ομορφο stream",
)
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/gitpython-developers/GitPython GitPython && cd GitPython
git checkout 3.2.1
disclude scan --severity info --diff 3.2.0 .