google-cloud-aiplatform 2.6.0

Source: https://github.com/googleapis/python-aiplatform
Artifact scanned: google_cloud_aiplatform-2.6.0-py2.py3-none-any.whl (wheel · 9.0 MB · SHA-256 b54a0a2881b6…)
Compared with: google_cloud_aiplatform-2.5.0-py2.py3-none-any.whl (2 signals introduced since)
Files: 1705 scanned, 39 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 32 info
Scan time: 25.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:39

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info high-complexity agentplatform/_genai/types/common.py:25956:24 new in this release

compression ratio 0.857 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. If true, schedule the deployment workload on [spot VMs](https://cloud.google.com/kubernetes-engine/docs/concepts/spot-vms).""",
    )
    starting_replica_count: Optional[int] = Field(

info high-complexity agentplatform/_genai/types/common.py:25977:8 new in this release

compression ratio 0.857 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    spot: Optional[bool]
    """Optional. If true, schedule the deployment workload on [spot VMs](https://cloud.google.com/kubernetes-engine/docs/concepts/spot-vms)."""

    starting_replica_count: Optional[int]

info ~~warn~~ → info by review dynamic-attribute agentplatform/_genai/types/__init__.py:4709:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        prebuilt_metric_obj = getattr(module, name)
        globals()[name] = prebuilt_metric_obj
        return prebuilt_metric_obj
    raise AttributeError(f"module '{__name__}' has no attribute '{name}'")
```
likely benign LLM, confidence 0.90 A lazy-loading module __getattr__ that resolves prebuilt metric names and caches them in globals.
Reasoning
The snippet is a module-level __getattr__ that imports a prebuilt metric lazily by name, caches it in globals(), and raises AttributeError otherwise. This is the standard PEP 562 lazy-loading idiom, with no decoding, execution, or network access.

info high-complexity agentplatform/_genai/types/common.py:8083:24

compression ratio 0.838 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. Represents the type of the structured memories associated with the schema. If not set, then `STRUCTURED_PROFILE` will be used.""",
    )

info high-complexity agentplatform/_genai/types/common.py:8097:8

compression ratio 0.838 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    memory_type: Optional[MemoryType]
    """Optional. Represents the type of the structured memories associated with the schema. If not set, then `STRUCTURED_PROFILE` will be used."""

info high-complexity agentplatform/_genai/types/common.py:14359:24

compression ratio 0.827 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Weaviate DB instance HTTP endpoint. e.g. 34.56.78.90:8080 Vertex RAG only supports HTTP connection to Weaviate. This value cannot be changed after it's set.""",
    )

info high-complexity agentplatform/_genai/types/common.py:14370:8

compression ratio 0.827 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    http_endpoint: Optional[str]
    """Weaviate DB instance HTTP endpoint. e.g. 34.56.78.90:8080 Vertex RAG only supports HTTP connection to Weaviate. This value cannot be changed after it's set."""

info high-complexity agentplatform/_genai/types/common.py:15573:24

compression ratio 0.841 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Sets the RAG Engine backend to be RagManagedDb, built on top of Spanner. NOTE: This is the default mode (w/ Basic Tier) if not explicitly chosen.""",
    )
    unprovisioned: Optional[RagManagedDbConfigUnprovisioned] = Field(

info high-complexity agentplatform/_genai/types/common.py:15597:8

compression ratio 0.841 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    spanner: Optional[RagManagedDbConfigSpannerDict]
    """Sets the RAG Engine backend to be RagManagedDb, built on top of Spanner. NOTE: This is the default mode (w/ Basic Tier) if not explicitly chosen."""

    unprovisioned: Optional[RagManagedDbConfigUnprovisionedDict]

info high-complexity agentplatform/_genai/types/common.py:24541:24

compression ratio 0.857 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. If true, schedule the deployment workload on [spot VMs](https://cloud.google.com/kubernetes-engine/docs/concepts/spot-vms).""",
    )

info high-complexity agentplatform/_genai/types/common.py:24573:8

compression ratio 0.857 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    spot: Optional[bool]
    """Optional. If true, schedule the deployment workload on [spot VMs](https://cloud.google.com/kubernetes-engine/docs/concepts/spot-vms)."""

info high-complexity agentplatform/_genai/types/common.py:25012:24

compression ratio 0.821 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. The parent that this model was customized from. E.g., Vision API, Natural Language API, LaMDA, T5, etc. Foundation models don't have parents.""",
    )
    predict_schemata: Optional[PredictSchemata] = Field(

info high-complexity agentplatform/_genai/types/common.py:25051:8

compression ratio 0.821 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    parent: Optional[PublisherModelParentDict]
    """Optional. The parent that this model was customized from. E.g., Vision API, Natural Language API, LaMDA, T5, etc. Foundation models don't have parents."""

    predict_schemata: Optional[PredictSchemataDict]

info high-complexity agentplatform/_genai/types/common.py:26375:24

compression ratio 0.892 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Required. The coarse-grained type of feedback provided by the user. Must be set to a value other than `FEEDBACK_TYPE_UNSPECIFIED`.""",
    )
    name: Optional[str] = Field(

info high-complexity agentplatform/_genai/types/common.py:26418:8

compression ratio 0.892 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    feedback_type: Optional[FeedbackType]
    """Required. The coarse-grained type of feedback provided by the user. Must be set to a value other than `FEEDBACK_TYPE_UNSPECIFIED`."""

    name: Optional[str]

info high-complexity agentplatform/_genai/types/common.py:27834:24

compression ratio 0.822 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

        default=None,
        description="""Preset option controlling parameters for speed-precision trade-off when querying for examples. If omitted, defaults to `PRECISE`.""",
    )

info high-complexity agentplatform/_genai/types/common.py:27845:8

compression ratio 0.822 is >2σ above file mean 0.671 (raw pass, confidence 0.50)

    query: Optional[Literal["PRECISE", "FAST"]]
    """Preset option controlling parameters for speed-precision trade-off when querying for examples. If omitted, defaults to `PRECISE`."""

info ~~warn~~ → info by review frame-introspection google/cloud/aiplatform/initializer.py:775:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = inspect.currentframe()
    while frame:
        yield frame
```
likely benign LLM, confidence 0.85 A generator that walks call-stack frames via inspect.currentframe.
Reasoning
The code walks the call stack with inspect.currentframe() in a generator. This is typical for locating the calling module or class for telemetry, logging, or default-argument resolution. Nothing in the snippet is exfiltrating or executing anything.
info ~~warn~~ → info by review pth-executable-line google_cloud_aiplatform-2.6.0-py3.12-nspkg.pth:1:1

`.pth` line that Python's `site` executes at every interpreter start (ast pass, confidence 0.70)
```
import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('google',));importlib = __import__('importlib.util');__import__('importlib.machinery');m = sys.modules.setdefault('google', importlib.util.module_from_spec(importlib.machinery.PathFinder.find_spec('google', [os.path.dirname(p)])));m = m or s… (341 bytes total)
```
likely benign LLM, confidence 0.85 A namespace-package bootstrap line in a .pth file that registers the 'google' package.
Reasoning
This is the setuptools-generated namespace-package .pth line for 'google'. It locates the sitedir, builds a module spec with PathFinder, and registers the module in sys.modules. It does not decode payloads, spawn processes, or touch the network, so it fits the legitimate namespace-package pattern that the instructions allow for .pth files.
info ~~warn~~ → info by review frame-introspection google_cloud_aiplatform-2.6.0-py3.12-nspkg.pth:1:40

[embedded python] `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('google',));importlib = __import__('importlib.util');__import__('importlib.machinery');m = sys.modules.setdefault('google', importlib.util.module_from_spec(importlib.machinery.PathFinder.find_spec('google', [os.path.dirname(p)])));m = m or s
```
likely benign LLM, confidence 0.85 Frame introspection inside the google namespace-package .pth bootstrap to obtain sitedir.
Reasoning
sys._getframe(1) is used only to read 'sitedir' from the caller's locals, which is how the setuptools nspkg bootstrap finds the site-packages directory. It is part of the same benign namespace-package line.

info long-line google_cloud_aiplatform-2.6.0-py3.12-nspkg.pth:2:1

[embedded python] line length 547 characters (raw pass, confidence 0.50)

import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('google', 'cloud'));importlib = __import__('importlib.util');__import__('importlib.machinery');m = sys.modules.setdefault('google.cloud', importlib.util.module_from_spec(importlib.machinery.PathFinder.find_spec('google.cloud', [os.path.dirna

info ~~warn~~ → info by review pth-executable-line google_cloud_aiplatform-2.6.0-py3.12-nspkg.pth:2:1

`.pth` line that Python's `site` executes at every interpreter start (ast pass, confidence 0.70)
```
import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('google', 'cloud'));importlib = __import__('importlib.util');__import__('importlib.machinery');m = sys.modules.setdefault('google.cloud', importlib.util.module_from_spec(importlib.machinery.PathFinder.find_spec('google.cloud', [os.path.dirna… (341 bytes total)
```
likely benign LLM, confidence 0.85 A namespace-package bootstrap .pth line that registers the 'google.cloud' package.
Reasoning
This is the same setuptools namespace-package bootstrap, extended to 'google.cloud'. It only builds a module spec and registers it in sys.modules, with no execution or network activity.
info ~~warn~~ → info by review frame-introspection google_cloud_aiplatform-2.6.0-py3.12-nspkg.pth:2:40

[embedded python] `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('google', 'cloud'));importlib = __import__('importlib.util');__import__('importlib.machinery');m = sys.modules.setdefault('google.cloud', importlib.util.module_from_spec(importlib.machinery.PathFinder.find_spec('google.cloud', [os.path.dirna
```
likely benign LLM, confidence 0.85 Frame introspection in the google.cloud namespace-package .pth bootstrap to obtain sitedir.
Reasoning
The sys._getframe(1) call reads 'sitedir' from the caller's frame, the same benign setuptools namespace-package mechanism as the first line.
info ~~warn~~ → info by review dynamic-attribute vertexai/_genai/types/__init__.py:2951:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        prebuilt_metric_obj = getattr(module, name)
        globals()[name] = prebuilt_metric_obj
        return prebuilt_metric_obj
    raise AttributeError(f"module '{__name__}' has no attribute '{name}'")
```
likely benign LLM, confidence 0.90 A lazy-loading module __getattr__ that resolves prebuilt metric names and caches them in globals.
Reasoning
This is the same module-level __getattr__ lazy-loading idiom with globals caching as the agentplatform finding. It is standard and contains no malicious behavior.

info high-complexity vertexai/_genai/types/common.py:773:24

compression ratio 0.834 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. Input only. The TTL (Time To Live) for the task. If not set, the task will expire in 24 hours by default. Valid range: (0 seconds, 1000 days]""",
    )

info high-complexity vertexai/_genai/types/common.py:811:8

compression ratio 0.834 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

    ttl: Optional[str]
    """Optional. Input only. The TTL (Time To Live) for the task. If not set, the task will expire in 24 hours by default. Valid range: (0 seconds, 1000 days]"""

info high-complexity vertexai/_genai/types/common.py:1021:24

compression ratio 0.812 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. A field mask indicating which paths in the Struct were changed. If not set, all fields will be updated. go/aip-internal/cloud-standard/2412""",
    )

info high-complexity vertexai/_genai/types/common.py:1032:8

compression ratio 0.812 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

    update_mask: Optional[str]
    """Optional. A field mask indicating which paths in the Struct were changed. If not set, all fields will be updated. go/aip-internal/cloud-standard/2412"""

info high-complexity vertexai/_genai/types/common.py:7778:24

compression ratio 0.838 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

        default=None,
        description="""Optional. Represents the type of the structured memories associated with the schema. If not set, then `STRUCTURED_PROFILE` will be used.""",
    )

info high-complexity vertexai/_genai/types/common.py:7792:8

compression ratio 0.838 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

    memory_type: Optional[MemoryType]
    """Optional. Represents the type of the structured memories associated with the schema. If not set, then `STRUCTURED_PROFILE` will be used."""

info high-complexity vertexai/_genai/types/common.py:19123:24

compression ratio 0.815 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

        default=None,
        description="""Output only. The state of the Skill at this revision. TODO(b/503772996) Use a different proto for skill data included in skill revision""",
    )
    state: Optional[SkillState] = Field(

info high-complexity vertexai/_genai/types/common.py:19139:8

compression ratio 0.815 is >2σ above file mean 0.682 (raw pass, confidence 0.50)

    skill: Optional[SkillDict]
    """Output only. The state of the Skill at this revision. TODO(b/503772996) Use a different proto for skill data included in skill revision"""

    state: Optional[SkillState]

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o google_cloud_aiplatform-2.6.0-py2.py3-none-any.whl https://files.pythonhosted.org/packages/d0/e2/8a96ce0474359a28a304e1c099745d305634d55bfcb6f3fdc6a3efdfb8e6/google_cloud_aiplatform-2.6.0-py2.py3-none-any.whl
printf '%s  %s\n' b54a0a2881b6a4311e86f39cc5e2f652c2242c117a2d03fad839810bb2882e1e google_cloud_aiplatform-2.6.0-py2.py3-none-any.whl | shasum -a 256 -c -
unzip -q google_cloud_aiplatform-2.6.0-py2.py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg