google-cloud-bigquery 3.46.2

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-bigquery-v3.46.2
Directory: packages/google-cloud-bigquery (only this part of the repository was scanned)
Compared with: google-cloud-bigquery-v3.46.1 (0 signals introduced since)
Files: 447 scanned, 33 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 21:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/google-cloud-bigquery/CHANGELOG.md:132:1

line length 642 characters (raw pass, confidence 0.50)

* same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</cod

info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
dismissed LLM, confidence 0.92 Documentation example showing pip installation inside a virtualenv.
Reasoning
The snippet is a standard setup example: activate a virtualenv, then run its pip. The redirect-to-pip signal fires only because the path ends in a system command name. Inside a virtualenv that is the intended usage, and the file is documentation, so this is not a PATH hijack.
info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/docs/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
dismissed LLM, confidence 0.92 Duplicate documentation example of pip use inside a virtualenv.
Reasoning
This is the same documentation snippet duplicated under docs/. It shows venv activation followed by the venv's pip, which is a normal install instruction and not a malicious PATH setup.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:745:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.85 Test evaluates a field's repr to check that it round-trips.
Reasoning
This is a unit test that round-trips a schema field through its repr() and eval() and then asserts equality. The input is the library's own repr output in a test file, not attacker-controlled data, so this is a legitimate test pattern.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:761:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.85 Test evaluates a field's repr to verify round-trip equality.
Reasoning
Same round-trip test pattern: eval of the library's own repr output, followed by an equality assertion. No external input reaches the eval call.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1192:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.85 Test evaluates a policy repr to verify round-trip equality.
Reasoning
The eval runs on a policy repr produced in the test itself and checks that the result equals the original object. This is a test verifying serialization, not a dropper or obfuscated execution.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1200:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.85 Test evaluates a policy repr to verify round-trip equality.
Reasoning
Same policy repr round-trip in the test suite. The eval input is generated locally by the code under test, so there is no malicious input path.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-bigquery-v3.46.2
disclude scan --severity info --diff google-cloud-bigquery-v3.46.1 packages/google-cloud-bigquery