google-cloud-core 2.8.0

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-core-v2.8.0
Directory: packages/google-cloud-core (only this part of the repository was scanned)
Compared with: google-cloud-core-v2.7.0 (0 signals introduced since)
Files: 36 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution packages/google-cloud-core/setup.py:48:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
with open(os.path.join(package_root, "google/cloud/version.py")) as fp:
    exec(fp.read(), version)
version = version["__version__"]
```
likely benign LLM, confidence 0.82 setup.py execs the package's own local version.py file to read __version__ at install time.
Reasoning
The exec reads google/cloud/version.py from the package's own source tree under package_root and runs it into a dict to extract __version__. This is a long-standing idiom in Google Cloud client library setup.py files. It reads no network data, decodes nothing, and does not fetch or spawn anything. The exec does run at install time on a non-literal expression, which is the reason for the critical severity, but the input is a trusted in-tree file. A malicious version.py would require the package to already be tampered with, so the residual risk is low but not zero.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-core-v2.8.0
disclude scan --severity info --diff google-cloud-core-v2.7.0 packages/google-cloud-core