google-cloud-bigquery 3.46.2

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-bigquery-v3.46.2
Directory: packages/google-cloud-bigquery (only this part of the repository was scanned)
Compared with: google-cloud-bigquery-v3.46.1 (0 signals introduced since)
Files: 449 scanned, 31 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 6.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 06:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/google-cloud-bigquery/CHANGELOG.md:132:1

line length 642 characters (raw pass, confidence 0.50)

* same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</cod

info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
dismissed LLM, confidence 0.95 RST documentation showing how to install google-cloud-bigquery into a virtualenv with its own pip.
Reasoning
The snippet is a documentation example: it activates a virtualenv and then runs `<your-env>/bin/pip install google-cloud-bigquery`. The placeholder `<your-env>` is a virtualenv path, not a PATH hijack. The rule fired only because the target filename is `pip`, so this is a false positive on a benign install instruction.
info ~~critical~~ → info by review path-command-shadow packages/google-cloud-bigquery/docs/README.rst:93:14

[embedded bash] redirect writes to `pip` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    source <your-env>/bin/activate
    <your-env>/bin/pip install google-cloud-bigquery
```
dismissed LLM, confidence 0.95 Duplicate docs copy of the virtualenv pip install example in the BigQuery README.
Reasoning
This is the same embedded bash example as README.rst. It is a virtualenv pip install instruction in documentation, and the path-command-shadow match comes only from the filename `pip`. No redirect or hijack is present.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:745:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.88 Test evaluates a SchemaField repr string to check that repr round-trips.
Reasoning
In a unit test, `eval(field_repr)` round-trips the repr of a SchemaField the test itself created, then asserts equality. The input is the library's own repr output, not attacker-controlled data, so this is a test idiom rather than dynamic execution of untrusted code.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:761:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_field = eval(field_repr)

        assert field == evaled_field
```
likely benign LLM, confidence 0.88 Test evals a SchemaField repr string to verify round-trip equality.
Reasoning
Same pattern as line 745: eval of a locally generated repr inside a unit test, followed by an equality assertion. There is no untrusted input or obfuscation.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1192:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.88 Test evals a policy repr string to check round-trip equality.
Reasoning
The test evals `policy_repr`, a repr of a policy object it built, and asserts equality with the original. This is a self-consistency test on the library's own output.
info ~~warn~~ → info by review dynamic-execution packages/google-cloud-bigquery/tests/unit/test_schema.py:1200:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        evaled_policy = eval(policy_repr)

        assert policy == evaled_policy
```
likely benign LLM, confidence 0.88 Test evals a policy repr string to check round-trip equality.
Reasoning
Same as the other policy-repr eval at line 1192: a unit test round-tripping locally produced repr output, with no external input or concealment.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-bigquery-v3.46.2
disclude scan --severity info --diff google-cloud-bigquery-v3.46.1 packages/google-cloud-bigquery