google-cloud-core 2.8.0

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-core-v2.8.0
Directory: packages/google-cloud-core (only this part of the repository was scanned)
Compared with: google-cloud-core-v2.7.0 (0 signals introduced since)
Files: 37 scanned, 12 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 05:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution packages/google-cloud-core/setup.py:48:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
with open(os.path.join(package_root, "google/cloud/version.py")) as fp:
    exec(fp.read(), version)
version = version["__version__"]
```
likely benign LLM, confidence 0.88 A setup.py reads the package's local version.py and execs it into a dict to extract __version__ at build time.
Reasoning
The exec reads a version.py file located inside the package's own source tree (package_root joined with google/cloud/version.py) and runs it into a dict, then reads __version__ from that dict. This is a widely used setup.py idiom for extracting a version string without importing the package. The snippet has no network access, encoded payload, or shell call, and the target path is a fixed local file. The non-literal argument is the only concern, and the file context explains it. The flag is a true positive for the dynamic-execution signal but the code is most likely a legitimate build-time version read.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-core-v2.8.0
disclude scan --severity info --diff google-cloud-core-v2.7.0 packages/google-cloud-core