google-genai 2.32.0

Source: https://github.com/googleapis/python-genai
Tag scanned: v2.32.0
Compared with: v2.31.0 (0 signals introduced since)
Files: 604 scanned, 22 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 9.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 13 of 13 warn and critical signals; 13 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 09:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute google/genai/__init__.py:51:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    module = importlib.import_module(f'.{name}', __name__)
    globals()[name] = module
    return module
  raise AttributeError(f'module {__name__!r} has no attribute {name!r}')
```
likely benign LLM, confidence 0.90 Module-level __getattr__ that lazily imports submodules and caches them in globals().
Reasoning
Lazy-loading module __getattr__ pattern using importlib.import_module and globals() caching is a standard idiom for deferred imports in a large package; no malicious payload or obfuscation.
info ~~warn~~ → info by review frame-introspection google/genai/_replay_api_client.py:211:19

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
  """Prints the current file path and line number."""
  current_frame = inspect.currentframe()
  if (
      current_frame is not None
```
likely benign LLM, confidence 0.92 Debug helper that reads the current frame to report file path and line number.
Reasoning
inspect.currentframe is used to print the current file and line number for debugging/replay logging; ordinary introspection with no suspicious behavior.
info ~~warn~~ → info by review frame-introspection google/genai/tests/common/test_common.py:53:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
  with warnings.catch_warnings(record=True) as captured_warnings:
    call_line = inspect.currentframe().f_lineno + 1
    func()
```
likely benign LLM, confidence 0.92 Test code reading the caller's line number to validate warning emission location.
Reasoning
Test helper uses currentframe().f_lineno to compute the call line for asserting warning locations; a normal testing technique.
info ~~warn~~ → info by review encoding-hex google/genai/tests/models/test_compute_tokens.py:84:69

16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
        decoded_tokens
        == b'\xe8\xbf\x99\xe6\x98\xaf\xe4\xb8\x80\xe6\x9d\xa1unicode\xe6\xb5\x8b\xe8\xaf\x95\xf0\x9f\xa4\xaa\xe2\x9d\xa4\xe2\x98\x85'
    )
    assert decoded_tokens.decode('utf-8') == _UNICODE_STRING
```
likely benign LLM, confidence 0.93 Test assertion comparing decoded tokens against a UTF-8 byte literal containing unicode text.
Reasoning
The hex escapes encode a UTF-8 test string (Chinese characters, emoji) used to verify token decoding; expected in unicode test fixtures, with no execution or hidden payload.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/transformers/test_bytes.py:8:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test fixture of raw binary bytes used to exercise bytes transformers.
Reasoning
Byte literal is test fixture data for bytes transformation tests; it is a random-looking binary sample used as input, with no decoding into execution. The payload shape is expected for such tests.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/types/test_bytes_internal.py:36:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test fixture of raw binary bytes for internal bytes type tests.
Reasoning
Same binary byte fixture duplicated across test files for testing bytes handling; no execution or decoding pipeline present.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/types/test_bytes_type.py:30:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test fixture of raw binary bytes for bytes type tests.
Reasoning
Duplicate binary byte fixture in a type test; benign test data consistent with the other bytes tests.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:83:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = ClientSession
```
likely benign LLM, confidence 0.90 Lazy loader for optional ClientSession import, caching None on ImportError.
Reasoning
Lazy optional-import pattern for the MCP dependency: on ImportError it caches None in globals. Standard, benign handling of optional dependencies.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:85:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = ClientSession
    return ClientSession
  if name == 'McpCallToolResult':
```
likely benign LLM, confidence 0.90 Caches the lazily imported ClientSession symbol into module globals.
Reasoning
Same lazy optional-import idiom caching the ClientSession class in globals; no malicious behavior.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:91:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = CallToolResult
```
likely benign LLM, confidence 0.90 Lazy loader for optional CallToolResult import with None fallback.
Reasoning
Lazy optional-import for CallToolResult with None fallback; standard dependency-guard pattern.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:93:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = CallToolResult
    return CallToolResult
  if name == 'mcp_types':
```
likely benign LLM, confidence 0.90 Caches lazily imported CallToolResult symbol in module globals.
Reasoning
Caches the lazily imported CallToolResult into globals; benign optional-dependency handling.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:99:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = mcp_types
```
likely benign LLM, confidence 0.90 Lazy loader for optional mcp_types module with None fallback.
Reasoning
Lazy optional import of mcp_types with None fallback on ImportError; standard pattern.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:101:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = mcp_types
    return mcp_types
  raise AttributeError(f'module {__name__!r} has no attribute {name!r}')
```
likely benign LLM, confidence 0.90 Caches lazily imported mcp_types module in module globals.
Reasoning
Caches the lazily imported mcp_types module in globals and returns it; benign and consistent with the surrounding lazy-import code.

info high-complexity google/genai/types.py:829:6

compression ratio 0.881 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

  REGEX_CONTAINS = 'REGEX_CONTAINS'
  """Equivalent to [GoogleSQL](https://cloud.google.com/bigquery/docs/reference/standard-sql/string_functions#regexp_contains) `REGEX_CONTAINS(target, expression)`."""
  PARTIAL_MATCH = 'PARTIAL_MATCH'

info high-complexity google/genai/types.py:15230:22

compression ratio 0.824 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

      default=None,
      description="""Required. BigQuery URI to a table, up to 2000 characters long. Accepted forms: * BigQuery path. For example: `bq://projectId.bqDatasetId.bqTableId`.""",
  )

info high-complexity google/genai/types.py:15241:6

compression ratio 0.824 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

  input_uri: Optional[str]
  """Required. BigQuery URI to a table, up to 2000 characters long. Accepted forms: * BigQuery path. For example: `bq://projectId.bqDatasetId.bqTableId`."""

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/python-genai python-genai && cd python-genai
git checkout v2.32.0
disclude scan --severity info --diff v2.31.0 .