msgpack 1.2.3

Source: https://github.com/msgpack/msgpack-python
Tag scanned: v1.2.3
Compared with: v1.2.2 (0 signals introduced since)
Files: 44 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 6.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:38

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import docker/buildwheel.sh:3:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
DOCKER_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "$DOCKER_DIR/shared.env"

set -e -x
```
likely benign LLM, confidence 0.90 Build script sources shared.env relative to its own directory.
Reasoning
Sourcing a shared env file via a path derived from the script's own directory is a standard build-script idiom; no remote fetch or decoding is involved.
info dynamic-execution docker/buildwheel.sh:15:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/python -m build -w
done
```
info ~~warn~~ → info by review dynamic-import docker/runtests.sh:3:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
DOCKER_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "$DOCKER_DIR/shared.env"

set -e -x
```
likely benign LLM, confidence 0.90 Bash script sources shared.env located relative to its own directory.
Reasoning
Sourcing a script path derived from the script's own directory via BASH_SOURCE is a common, benign build-script idiom; the path is not attacker-controlled input and shared.env is a sibling config file.

info dynamic-execution docker/runtests.sh:9:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYBIN=/opt/python/$V/bin
    $PYBIN/python setup.py install
    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/pip install pytest

info dynamic-execution docker/runtests.sh:11:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/pip install pytest
    pushd test          # prevent importing msgpack package in current directory.
    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'

info dynamic-execution docker/runtests.sh:13:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    pushd test          # prevent importing msgpack package in current directory.
    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .

info dynamic-execution docker/runtests.sh:14:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .
    popd

info dynamic-execution docker/runtests.sh:15:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .
    popd
done
```
info ~~warn~~ → info by review encoding-hex test/test_case.py:114:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            tuple(range(15)),
            b"\x9f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e",
        ),
        (
```
likely benign LLM, confidence 0.93 Test fixture bytes encoding a msgpack-like sequence in a serialization test.
Reasoning
The byte string is a sequence of sequential hex bytes 0x00..0x0e preceded by 0x9f, which is a deliberate test vector for a msgpack-style serialization library. Sequential counting bytes are typical test data, not obfuscated payload.
info ~~warn~~ → info by review encoding-hex test/test_case.py:118:15

19 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
            tuple(range(16)),
            b"\xdc\x00\x10\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
        ),
        ({}, b"\x80"),
```
likely benign LLM, confidence 0.93 Test fixture bytes for a msgpack array header followed by sequential data.
Reasoning
The bytes are a msgpack header (0xdc, 16-bit length 0x0010) followed by sequential counter bytes, a clear hand-written encoding test vector in a serialization test file.
info ~~warn~~ → info by review payload-bytes-literal test/test_format.py:73:9

concatenated bytes literal contains 37 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    check(
        b"\x96"
        b"\xde\x00\x00"
        b"\xde\x00\x01\xc0\xc2"
```
likely benign LLM, confidence 0.93 Test case byte literal representing msgpack-encoded data passed to a format check.
Reasoning
The concatenated bytes literal is a msgpack format test vector (0x96 fixarray, 0xde map16 headers) inside a test check call; binary-shaped content is expected for a serialization format test and there is no execution or decoding of it.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/msgpack/msgpack-python msgpack-python && cd msgpack-python
git checkout v1.2.3
disclude scan --severity info --diff v1.2.2 .