mistune 3.4.0

Source: https://github.com/lepture/mistune
Tag scanned: v3.4.0
Compared with: v3.3.4 (0 signals introduced since)
Files: 128 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 4.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 08:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review narrow-file-charset benchmark/cases/normal_ul.txt:1:1

file uses only 10 distinct printable characters ("*+-ILeimst") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
- List Item
  - List Item
- List Item
```
likely benign LLM, confidence 0.95 A text fixture containing repeated markdown list items.
Reasoning
The file is a plain markdown-style list of repeated '- List Item' lines. Its low character diversity is simply a consequence of repetitive placeholder text, not character-constrained encoding or JSFuck-style obfuscation. It is a benchmark fixture of normal content.
info ~~warn~~ → info by review dynamic-attribute tests/test_directives.py:21:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestDirective.load_fixtures(filename + ".txt")
    globals()["TestDirective_" + filename] = TestDirective
```
likely benign LLM, confidence 0.85 Test code that registers dynamically named TestDirective classes via globals().
Reasoning
This is a test module that dynamically registers generated test classes into module globals based on fixture filenames. Reaching by name through globals() is a common test-generation idiom. No network, exec, or encoded payload is involved, and the names are derived from local fixture names.
info ~~warn~~ → info by review dynamic-attribute tests/test_plugins.py:19:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestPlugin2.load_fixtures(plugin_name + ".txt")
    globals()["TestPlugin1_" + plugin_name] = TestPlugin1
    globals()["TestPlugin2_" + plugin_name] = TestPlugin2
```
likely benign LLM, confidence 0.85 Test code that registers TestPlugin1/TestPlugin2 classes under generated names in globals().
Reasoning
Same test-generation pattern: fixture-derived names are assigned into globals() so pytest can discover generated test classes. The keys are built from a local plugin_name variable with no external input or execution of decoded content.
info ~~warn~~ → info by review dynamic-attribute tests/test_plugins.py:20:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    globals()["TestPlugin1_" + plugin_name] = TestPlugin1
    globals()["TestPlugin2_" + plugin_name] = TestPlugin2
```
likely benign LLM, confidence 0.85 Second globals() assignment registering TestPlugin2 under a generated name.
Reasoning
Continuation of the same test-class registration idiom in the same file; it only binds local test classes to module-level names for discovery and performs no sensitive operation.
info ~~warn~~ → info by review dynamic-attribute tests/test_renderers.py:15:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    TestRenderer.load_fixtures("renderer_" + name + ".txt")
    globals()["TestRenderer" + name.title()] = TestRenderer
```
likely benign LLM, confidence 0.85 Test code that binds a TestRenderer class to a name built from a fixture-derived string.
Reasoning
Generated TestRenderer subclasses are bound into module globals using a name derived from a local fixture name. This is a standard test-parametrization pattern with no malicious behavior visible.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/lepture/mistune mistune && cd mistune
git checkout v3.4.0
disclude scan --severity info --diff v3.3.4 .