google-cloud-bigquery 3.46.1

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-bigquery-v3.46.1
Directory: packages/google-cloud-bigquery (only this part of the repository was scanned)
Compared with: google-cloud-bigquery-v3.46.0 (0 signals introduced since)
Files: 446 scanned, 33 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 5.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:52

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/google-cloud-bigquery/CHANGELOG.md:123:1

line length 642 characters (raw pass, confidence 0.50)

* same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</cod

info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
likely benign LLM, confidence 0.90 Documentation showing how to install a Python package with pip from a virtualenv.
Reasoning
The AST pass flagged a bash example in reStructuredText docs. The snippet activates a virtualenv and runs <your-env>/bin/pip install google-cloud-bigquery, which is a standard installation instruction. The placeholder path is inside the user's own environment, so nothing is being shadowed or hijacked.
info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/docs/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
likely benign LLM, confidence 0.90 Documentation copy of the virtualenv pip install instructions.
Reasoning
This is a duplicate of the README.rst finding with the same snippet. It is an ordinary docs example for installing google-cloud-bigquery inside an activated virtualenv, and the path-command-shadow signal matches only because the filename is pip.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:745:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.85 Unit test that evals a SchemaField repr to verify round-tripping.
Reasoning
The eval call reads back a repr string produced by the library's own SchemaField in a unit test, then asserts equality. The input is generated locally in the test, not from an external or untrusted source, so this is a round-trip check rather than an attack vector.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:761:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.85 Unit test that evals a SchemaField repr to verify round-tripping.
Reasoning
Same pattern as the previous eval: a repr generated in the test is evaluated and compared for equality. No external input reaches the call.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1192:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.85 Unit test that evals a policy repr to verify round-tripping.
Reasoning
The eval reads a policy repr produced in the test and asserts it equals the original policy object. This is a serialization check in test code with no untrusted input.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1200:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.85 Unit test that evals a policy repr to verify round-tripping.
Reasoning
This is another policy repr round-trip eval in the same test file, with the same local-only input and equality assertion.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-bigquery-v3.46.1
disclude scan --severity info --diff google-cloud-bigquery-v3.46.0 packages/google-cloud-bigquery