PyPI / googleapis-common-protos / 1.75.5

googleapis-common-protos 1.75.5

Source: https://github.com/googleapis/google-cloud-python
Artifact scanned: googleapis_common_protos-1.75.5-py3-none-any.whl (wheel · 300.5 KB · SHA-256 d7285525c230…)
Compared with: googleapis_common_protos-1.75.4-py3-none-any.whl (0 signals introduced since)
Files: 132 scanned, 67 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 02:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-octal google/longrunning/operations_proto_pb2.py:73:31

8 consecutive `\NNN` octal escapes (entropy 3.0 bits/byte) (raw pass, confidence 0.65)
```
    ]._serialized_options = (
        b"\332A\013name,filter\202\323\344\223\002\027\022\025/v1/{name=operations}"
    )
    _globals["_OPERATIONS"].methods_by_name["GetOperation"]._loaded_options = None
```
dismissed LLM, confidence 0.95 Generated protobuf serialized method options for the longrunning GetOperation RPC.
Reasoning
This is a standard protoc-generated _pb2 module. The octal escapes are the serialized protobuf option bytes (HTTP annotation and method signature) for the GetOperation RPC, assigned to _serialized_options. The raw pass flags the escape density, but the content is ordinary generated protobuf data with no decoding, execution, or network behavior.
info ~~warn~~ → info by review encoding-octal google/longrunning/operations_proto_pb2.py:79:24

8 consecutive `\NNN` octal escapes (entropy 3.0 bits/byte) (raw pass, confidence 0.65)
```
    ]._serialized_options = (
        b"\332A\004name\202\323\344\223\002\032\022\030/v1/{name=operations/**}"
    )
    _globals["_OPERATIONS"].methods_by_name["DeleteOperation"]._loaded_options = None
```
dismissed LLM, confidence 0.95 Generated protobuf serialized options for the DeleteOperation RPC.
Reasoning
Same generated protobuf module. The octal-escaped bytes encode the HTTP rule and method signature for DeleteOperation and are attached to the descriptor's options. This is a serialization format, not a payload, and the raw-pass encoding signal is a known false positive for generated code.
info ~~warn~~ → info by review encoding-octal google/longrunning/operations_proto_pb2.py:85:24

6 consecutive `\NNN` octal escapes (entropy 2.6 bits/byte) (raw pass, confidence 0.65)
```
    ]._serialized_options = (
        b"\332A\004name\202\323\344\223\002\032*\030/v1/{name=operations/**}"
    )
    _globals["_OPERATIONS"].methods_by_name["CancelOperation"]._loaded_options = None
```
dismissed LLM, confidence 0.95 Generated protobuf serialized options for the CancelOperation RPC.
Reasoning
Generated protobuf descriptor bytes for the CancelOperation RPC's HTTP annotation and method signature, in the standard protoc output layout. Nothing here executes or reaches out. The raw-pass octal-escape count is a false positive on machine-generated code.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o googleapis_common_protos-1.75.5-py3-none-any.whl https://files.pythonhosted.org/packages/65/b9/6b29500a1c581ff4d77fd83c6568d068bee06f1b139fb6eb0a4f2d4bce8a/googleapis_common_protos-1.75.5-py3-none-any.whl
printf '%s  %s\n' d7285525c23039db98f2463e6d5a4f9b958b94d497f03a844ece3259c4e72d5d googleapis_common_protos-1.75.5-py3-none-any.whl | shasum -a 256 -c -
unzip -q googleapis_common_protos-1.75.5-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg