kombu 5.7.0rc1

Source: https://github.com/celery/kombu
Tag scanned: v5.7.0rc1
Compared with: v5.7.0b1 (0 signals introduced since)
Files: 317 scanned, 17 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 17 info
Scan time: 16.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 09:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line docs/_templates/sidebardonations.html:5:1

line length 2589 characters (raw pass, confidence 0.65)
```
    <input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIHTwYJKoZIhvcNAQcEoIIHQDCCBzwCAQExggEwMIIBLAIBADCBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQ
```
likely benign LLM, confidence 0.95 A PayPal donation form's encrypted button parameter embedded as a hidden input.
Reasoning
The long line is a PayPal encrypted-button PKCS7 blob embedded in a hidden form field, a standard donation-button pattern. It is a long line of ordinary payment markup, not a payload.
info ~~warn~~ → info by review dynamic-attribute kombu/__init__.py:34:1

reach-by-name through `globals` (ast pass, confidence 0.60)
```
STATICA_HACK = True
globals()['kcah_acitats'[::-1].upper()] = False
if STATICA_HACK:  # pragma: no cover
    # This is never executed, but tricks static analyzers (PyDev, PyCharm,
```
likely benign LLM, confidence 0.80 A never-executed block that uses a reversed-string globals assignment to placate static analyzers in the kombu package init.
Reasoning
This is the known kombu idiom that tricks static analyzers into seeing a name (STATICA_HACK) that is never executed at runtime. The reversed-and-uppercased name is an odd obfuscation, but it is a deliberate, documented, benign hack in a well-known library, and it is not a dropper.
info ~~critical~~ → info by review dynamic-import kombu/__init__.py:78:22

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        if name in object_origins:
            module = __import__(object_origins[name], None, None, [name])
            for extra_name in all_by_module[module.__name__]:
                setattr(self, extra_name, getattr(module, extra_name))
```
likely benign LLM, confidence 0.90 Lazy submodule import inside kombu's attribute-access fallback, using a module name from an internal mapping.
Reasoning
This is kombu's lazy-loading __getattr__ pattern: the module name comes from a fixed internal mapping (object_origins) populated by the package itself, not from untrusted input. Dynamic import here is a legitimate lazy-loading mechanism.
info ~~critical~~ → info by review dynamic-import t/unit/conftest.py:86:17

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            try:
                __import__(module)
            except (ImportError, VersionMismatch, AttributeError):
                pass
```
likely benign LLM, confidence 0.85 Test helper that attempts to import a module and silently ignores import failures.
Reasoning
The try/except around __import__(module) with ImportError handling is a test helper that probes whether a module is available. The module name comes from test configuration, so this is ordinary test scaffolding.
info ~~critical~~ → info by review builtins-write t/unit/conftest.py:290:5

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
    builtins.__import__ = myimp
    try:
        yield
```
likely benign LLM, confidence 0.90 Test fixture that swaps in a custom import function to simulate import behavior, then restores it.
Reasoning
Temporarily replacing builtins.__import__ within a pytest fixture (paired with a restore in finally) is a standard mocking technique for simulating import failures or version mismatches in tests. It is confined to the test session.
info ~~critical~~ → info by review builtins-write t/unit/conftest.py:294:9

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
    finally:
        builtins.__import__ = realimport
```
likely benign LLM, confidence 0.90 Restores the original builtins.__import__ after a test fixture finishes.
Reasoning
This is the restore half of the same test fixture, reassigning the saved real __import__ in a finally block. It is a clean-up step, not an attack.
info ~~warn~~ → info by review decoder-decompress-payload t/unit/test_messaging.py:133:27

file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        import zlib
        assert json.loads(zlib.decompress(m).decode('utf-8')) == message

    def test_prepare_custom_content_type(self):
```
likely benign LLM, confidence 0.85 Unit test that decompresses a locally compressed message to verify JSON round-tripping.
Reasoning
zlib.decompress here round-trips a test message that the test itself compressed, then checks it against the expected value. It is an ordinary serialization test, not a runtime-embedded payload.
info ~~warn~~ → info by review encoding-base64 t/unit/test_serialization.py:64:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
msgpack_data = b64decode(str_to_bytes("""\
haNpbnQKpWZsb2F0y0AJIftTyNTxpGxpc3SUpmdlb3JnZaVqZXJyeaZlbGFpbmWlY29zbW+mc3Rya\
W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\
```
likely benign LLM, confidence 0.92 Base64-encoded msgpack test fixture in a serialization test.
Reasoning
The base64 blob is msgpack-encoded fixture data that decodes to plain readable test values (strings, floats, lists). It is a serialization test vector, not a hidden payload.
info ~~warn~~ → info by review encoding-base64 t/unit/test_serialization.py:65:1

base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
haNpbnQKpWZsb2F0y0AJIftTyNTxpGxpc3SUpmdlb3JnZaVqZXJyeaZlbGFpbmWlY29zbW+mc3Rya\
W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\
"""))
```
likely benign LLM, confidence 0.92 Continuation of the base64 msgpack serialization test vector.
Reasoning
This is a continuation of the same msgpack test fixture, which contains readable test strings in the encoded data.
info ~~warn~~ → info by review encoding-base64 t/unit/test_serialization.py:66:1

base64-like blob (58 bytes, compression ratio 1.19) (raw pass, confidence 0.60)
```
W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\
"""))
```
likely benign LLM, confidence 0.92 Final lines of the base64 msgpack serialization test vector.
Reasoning
This is the final continuation of the same msgpack test fixture, with no sign of executable or obfuscated content.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/SQS/conftest.py:101:34

4 rows of base64-like lines, lines 101-104 (first: base64-like blob (71 bytes, compression ratio 1.15)) (raw pass, confidence 0.60)
```
                'SessionToken': 'AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWs'
                                'KWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdee'
                                'hM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6'
```
likely benign LLM, confidence 0.88 Mock AWS session-token strings used as test fixtures for the SQS transport.
Reasoning
The strings are a fake AWS session token and related credential-like values built from the 'EXAMPLE' placeholder pattern. They are test fixture data in a mock SQS setup, not live credentials or code.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2571:30

base64-like blob (79 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
                            'wAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wU'
                            'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'
```
likely benign LLM, confidence 0.88 Fragment of placeholder AWS-style token data in an SQS unit test.
Reasoning
These are fragments of the same placeholder AWS-style token strings used in SQS transport tests. They are high-entropy test data, not an encoded dropper.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2572:30

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
                            'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'
                            '0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSI'
                            'lTJabIQwj2ICCR/oLxBA==',
```
likely benign LLM, confidence 0.88 Continuation of placeholder AWS-style token data in an SQS unit test.
Reasoning
This continues the same placeholder token string split across lines in an SQS unit test. It is test data with no execution path.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2573:30

base64-like blob (79 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
                            'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'
                            '0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSI'
                            'lTJabIQwj2ICCR/oLxBA==',
        }
```
likely benign LLM, confidence 0.85 Multi-line base64-like string literal in an SQS transport unit test.
Reasoning
Raw-pass base64 heuristic on a multi-line string literal in a unit test for the SQS transport. The blob is a test fixture with no decoding, execution, or dropper pipeline in the snippet, and raw findings have a high false-positive rate. Nothing indicates obfuscation.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:15:37

base64-like blob (90 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
URL_CREDS = 'azurestoragequeues://sas/key%@https://STORAGE_ACCOUNT_NAME.queue.core.windows.net/' # noqa
AZURITE_CREDS = 'azurestoragequeues://Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==@http://localhost:10001/devstoreaccount1'  # noqa
```
likely benign LLM, confidence 0.95 Azurite local-emulator storage account key embedded in a connection-string test constant.
Reasoning
The key is the publicly documented Azurite emulator account key (devstoreaccount1) used in the test suite to connect to a local emulator at localhost:10001. It is a well-known non-secret, and the file is a unit test with no decoding or execution behaviour.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:16:52

base64-like blob (90 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
AZURITE_CREDS_DOCKER_COMPOSE = 'azurestoragequeues://Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==@http://azurite:10001/devstoreaccount1'  # noqa
DEFAULT_AZURE_URL_CREDS = 'azurestoragequeues://DefaultAzureCredential@https://STORAGE_ACCOUNT_NAME.queue.core.windows.net/' # noqa
```
likely benign LLM, confidence 0.95 Azurite emulator key used in a docker-compose connection string for tests.
Reasoning
Same well-known Azurite devstoreaccount1 emulator key as the neighbouring constant, used for a docker-compose hostname variant in a test. It is a public default, not a live credential, and there is no obfuscation.
info ~~warn~~ → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:55:29

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            'account_name': 'devstoreaccount1',
            'account_key': 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=='  # noqa
        }
        assert channel._url == f'http://{hostname}:10001/devstoreaccount1' # noqa
```
likely benign LLM, confidence 0.95 Public Azurite emulator account key in a unit-test channel configuration.
Reasoning
The account_key is the public Azurite emulator key for devstoreaccount1, assigned in a test config dict and asserted against a localhost URL. This is a documented default, with no real secret and no obfuscated execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/celery/kombu kombu && cd kombu
git checkout v5.7.0rc1
disclude scan --severity info --diff v5.7.0b1 .