google-genai 2.32.0

Source: https://github.com/googleapis/python-genai
Tag scanned: v2.32.0
Compared with: v2.31.0 (0 signals introduced since)
Files: 604 scanned, 22 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 11.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 13 of 13 warn and critical signals; 13 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 06:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute google/genai/__init__.py:51:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    module = importlib.import_module(f'.{name}', __name__)
    globals()[name] = module
    return module
  raise AttributeError(f'module {__name__!r} has no attribute {name!r}')
```
dismissed LLM, confidence 0.92 Lazy submodule loader in the package __init__ that imports a named submodule and caches it in globals().
Reasoning
This is the standard PEP 562 module __getattr__ pattern: it lazily imports a submodule by name, caches it in globals(), and raises AttributeError otherwise. It is a normal lazy-loading idiom with no execution of untrusted data.
info ~~warn~~ → info by review frame-introspection google/genai/_replay_api_client.py:211:19

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
  """Prints the current file path and line number."""
  current_frame = inspect.currentframe()
  if (
      current_frame is not None
```
dismissed LLM, confidence 0.92 Uses frame introspection to print the current file path and line number in a replay client helper.
Reasoning
inspect.currentframe() is used to read the current file and line number for a debug or replay print. This is benign diagnostic code and does not hide behavior.
info ~~warn~~ → info by review frame-introspection google/genai/tests/common/test_common.py:53:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
  with warnings.catch_warnings(record=True) as captured_warnings:
    call_line = inspect.currentframe().f_lineno + 1
    func()
```
dismissed LLM, confidence 0.92 Test helper reads the caller's line number via inspect.currentframe() to check warnings.
Reasoning
In a test helper, the current frame's line number is used to locate the call site for warning assertions. This is ordinary test scaffolding.
info ~~warn~~ → info by review encoding-hex google/genai/tests/models/test_compute_tokens.py:84:69

16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
        decoded_tokens
        == b'\xe8\xbf\x99\xe6\x98\xaf\xe4\xb8\x80\xe6\x9d\xa1unicode\xe6\xb5\x8b\xe8\xaf\x95\xf0\x9f\xa4\xaa\xe2\x9d\xa4\xe2\x98\x85'
    )
    assert decoded_tokens.decode('utf-8') == _UNICODE_STRING
```
dismissed LLM, confidence 0.88 Test assertion containing a UTF-8 byte literal of mixed Unicode text for token decoding checks.
Reasoning
The hex escapes encode a UTF-8 test string with CJK characters and emoji, compared against decoded token bytes. The high entropy reflects multibyte Unicode test data, not a hidden payload.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/transformers/test_bytes.py:8:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test module constant holding a binary byte sequence used as a transformer input.
Reasoning
This is a fixed binary test fixture in a test module for bytes transformers. It is data only, with no decoding, execution, or network use in the snippet, and sample binary blobs are expected in such tests.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/types/test_bytes_internal.py:36:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test constant containing raw binary bytes for internal bytes-type tests.
Reasoning
The same fixed binary test fixture appears here, a plain bytes constant in a unit test with no runtime action. It is consistent with byte-handling tests.
info ~~warn~~ → info by review payload-bytes-literal google/genai/tests/types/test_bytes_type.py:30:5

concatenated bytes literal contains 35 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
```
_RAW_BYTES = (
    b'\xfb\xf6\x9bq\xd7\x9f\x82\x18\xa3\x92Y\xa7\xa2\x9a\xab\xb2\xdb\xaf\xc3\x1c\xb3\x00\x10\x83\x10Q\x87'
    b' \x92\x8b0\xd3\x8fA\x14\x93QU\x97a\x9d5\xdb~9\xeb\xbf='
)
```
likely benign LLM, confidence 0.85 Test constant with a binary byte sequence for bytes-type behavior tests.
Reasoning
This is an identical binary test constant in a bytes-type test. It is static test data with no evident decoding or execution path.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:83:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = ClientSession
```
dismissed LLM, confidence 0.92 Lazy optional import of ClientSession via globals() in a module __getattr__, falling back to None.
Reasoning
This is a module-level __getattr__ that lazily imports an optional MCP ClientSession, caching None on ImportError. It is a standard optional-dependency pattern.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:85:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = ClientSession
    return ClientSession
  if name == 'McpCallToolResult':
```
dismissed LLM, confidence 0.92 Caches and returns the lazily imported ClientSession class.
Reasoning
Caches the lazily imported ClientSession in module globals and returns it, which is the same benign lazy-loading idiom.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:91:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = CallToolResult
```
dismissed LLM, confidence 0.92 Lazy optional import of CallToolResult via globals() with ImportError fallback.
Reasoning
Lazy optional import of CallToolResult from the MCP types with a None fallback on ImportError. This is a normal optional-dependency pattern.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:93:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = CallToolResult
    return CallToolResult
  if name == 'mcp_types':
```
dismissed LLM, confidence 0.92 Caches and returns the lazily imported CallToolResult class.
Reasoning
Caches and returns the lazily imported CallToolResult, consistent with the module's lazy-loading design.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:99:7

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    except ImportError:
      globals()[name] = None
      return None
    globals()[name] = mcp_types
```
dismissed LLM, confidence 0.92 Lazy optional import of the mcp_types module via globals() with ImportError fallback.
Reasoning
Lazy optional import of the mcp_types module with None fallback on ImportError. This is benign optional-dependency handling.
info ~~warn~~ → info by review dynamic-attribute google/genai/types.py:101:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
      return None
    globals()[name] = mcp_types
    return mcp_types
  raise AttributeError(f'module {__name__!r} has no attribute {name!r}')
```
dismissed LLM, confidence 0.92 Caches and returns the lazily imported mcp_types module, else raises AttributeError.
Reasoning
Caches and returns the lazily imported mcp_types module, ending in an AttributeError for unknown names. This is standard lazy loading.

info high-complexity google/genai/types.py:829:6

compression ratio 0.881 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

  REGEX_CONTAINS = 'REGEX_CONTAINS'
  """Equivalent to [GoogleSQL](https://cloud.google.com/bigquery/docs/reference/standard-sql/string_functions#regexp_contains) `REGEX_CONTAINS(target, expression)`."""
  PARTIAL_MATCH = 'PARTIAL_MATCH'

info high-complexity google/genai/types.py:15230:22

compression ratio 0.824 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

      default=None,
      description="""Required. BigQuery URI to a table, up to 2000 characters long. Accepted forms: * BigQuery path. For example: `bq://projectId.bqDatasetId.bqTableId`.""",
  )

info high-complexity google/genai/types.py:15241:6

compression ratio 0.824 is >2σ above file mean 0.681 (raw pass, confidence 0.50)

  input_uri: Optional[str]
  """Required. BigQuery URI to a table, up to 2000 characters long. Accepted forms: * BigQuery path. For example: `bq://projectId.bqDatasetId.bqTableId`."""

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/googleapis/python-genai python-genai && cd python-genai
git checkout v2.32.0
disclude scan --severity info --diff v2.31.0 .