mistune 3.4.0

Source: https://github.com/lepture/mistune
Tag scanned: v3.4.0
Compared with: v3.3.4 (0 signals introduced since)
Files: 125 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 5.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 06:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review narrow-file-charset benchmark/cases/normal_ul.txt:1:1

file uses only 10 distinct printable characters ("*+-ILeimst") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
- List Item
  - List Item
- List Item
```
dismissed LLM, confidence 0.95 A small text fixture containing a simple bulleted list.
Reasoning
A plain Markdown-style list in a text fixture. The charset heuristic fires on a tiny set of characters that are natural for list markup; this is a raw-pass false positive on benign content with no obfuscation.
info ~~warn~~ → info by review dynamic-attribute tests/test_directives.py:21:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestDirective.load_fixtures(filename + ".txt")
    globals()["TestDirective_" + filename] = TestDirective
```
likely benign LLM, confidence 0.85 Test module registering generated TestDirective classes in globals() by name.
Reasoning
Test code that dynamically registers test classes into module globals based on fixture filenames, a common test-generation idiom. The name is built from a fixed prefix and a filename loop variable, with no decoding or hidden payload. Benign metaprogramming in tests.
info ~~warn~~ → info by review dynamic-attribute tests/test_plugins.py:19:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestPlugin2.load_fixtures(plugin_name + ".txt")
    globals()["TestPlugin1_" + plugin_name] = TestPlugin1
    globals()["TestPlugin2_" + plugin_name] = TestPlugin2
```
likely benign LLM, confidence 0.85 Test module binding generated TestPlugin classes into globals() by name.
Reasoning
Same test-generation pattern: fixed class names prefixed onto a plugin name and assigned into globals() so pytest discovers them. Not obfuscation or malicious intent.
info ~~warn~~ → info by review dynamic-attribute tests/test_plugins.py:20:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    globals()["TestPlugin1_" + plugin_name] = TestPlugin1
    globals()["TestPlugin2_" + plugin_name] = TestPlugin2
```
likely benign LLM, confidence 0.85 Test module binding a second generated TestPlugin class into globals().
Reasoning
Second assignment in the same test-generation idiom, binding TestPlugin2 variants into globals(). Benign.
info ~~warn~~ → info by review dynamic-attribute tests/test_renderers.py:15:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestRenderer.load_fixtures("renderer_" + name + ".txt")
    globals()["TestRenderer" + name.title()] = TestRenderer
```
likely benign LLM, confidence 0.85 Test module registering per-renderer TestRenderer classes in globals().
Reasoning
Test helper creating a TestRenderer class per renderer name in globals(), using a title-cased suffix. Standard pytest parametrization-by-generation with no hidden or encoded behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/lepture/mistune mistune && cd mistune
git checkout v3.4.0
disclude scan --severity info --diff v3.3.4 .