PyPI / gitpython / 3.2.1

gitpython 3.2.1

Source

https://github.com/gitpython-developers/GitPython

Artifact scanned

gitpython-3.2.1-py3-none-any.whl (wheel · 226.1 KB · SHA-256 d66b0832aa87…)

Compared with

gitpython-3.2.0-py3-none-any.whl (0 signals introduced since)

Files

38 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 08:33

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review encoding-base64 git/cmd.py:771:36

   base64-like blob (68 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

       * :meth:`Git.execute` (on the ``shell`` parameter).
       * https://github.com/gitpython-developers/GitPython/commit/0d9390866f9ce42870d3116094cd49e0019a970a
       * https://learn.microsoft.com/en-us/windows/win32/procthread/process-creation-flags

   dismissed LLM, confidence 0.95 A commit hash inside a GitHub URL in a GitPython docstring was flagged as a base64-like blob.

   Reasoning

   The flagged 'base64-like blob' is actually a GitHub commit SHA (0d9390866f9ce42870d3116094cd49e0019a970a) inside a URL in a docstring. It is a hex string in a documentation comment, not an encoded payload. Raw-pass base64 heuristics produce false positives on such strings.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o gitpython-3.2.1-py3-none-any.whl https://files.pythonhosted.org/packages/6b/50/2a923c4dc02522ff9567f07c67ed1deca6d5fa9474f4708168b8088dfa37/gitpython-3.2.1-py3-none-any.whl
printf '%s  %s\n' d66b0832aa8755c1a84892937282df0befb16c97e5a64aeebd68be9c5e323f53 gitpython-3.2.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q gitpython-3.2.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg