msgpack 1.2.3

Source: https://github.com/msgpack/msgpack-python
Tag scanned: v1.2.3
Compared with: v1.2.2 (0 signals introduced since)
Files: 44 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 4.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 03:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import docker/buildwheel.sh:3:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
DOCKER_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "$DOCKER_DIR/shared.env"

set -e -x
```
likely benign LLM, confidence 0.90 Bash build script sources shared.env from its own directory.
Reasoning
Sourcing a shared.env file located relative to the script's own directory is a standard build-helper pattern; the path is derived from BASH_SOURCE, not external input, and the file is a local repo artifact.
info dynamic-execution docker/buildwheel.sh:15:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/python -m build -w
done
```
info ~~warn~~ → info by review dynamic-import docker/runtests.sh:3:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
DOCKER_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "$DOCKER_DIR/shared.env"

set -e -x
```
likely benign LLM, confidence 0.90 Test runner script sources shared.env from its own directory.
Reasoning
Same pattern as buildwheel.sh: a sibling shared.env is sourced via a path computed from BASH_SOURCE. Ordinary repository plumbing with no network or encoded content.

info dynamic-execution docker/runtests.sh:9:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYBIN=/opt/python/$V/bin
    $PYBIN/python setup.py install
    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/pip install pytest

info dynamic-execution docker/runtests.sh:11:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    rm -rf build/       # Avoid lib build by narrow Python is used by wide python
    $PYBIN/pip install pytest
    pushd test          # prevent importing msgpack package in current directory.
    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'

info dynamic-execution docker/runtests.sh:13:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    pushd test          # prevent importing msgpack package in current directory.
    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .

info dynamic-execution docker/runtests.sh:14:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)

    $PYBIN/python -c 'import sys; print(hex(sys.maxsize))'
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .
    popd

info dynamic-execution docker/runtests.sh:15:5

command name is a variable (`$PYBIN`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    $PYBIN/python -c 'from msgpack import _cmsgpack'  # Ensure extension is available
    $PYBIN/pytest -v .
    popd
done
```
info ~~warn~~ → info by review encoding-hex test/test_case.py:114:15

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
            tuple(range(15)),
            b"\x9f\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e",
        ),
        (
```
likely benign LLM, confidence 0.92 Test fixture bytes literal containing msgpack encoded bytes.
Reasoning
A hex-escaped bytes literal encoding msgpack data in a test fixture for a serialization library. Test vectors for binary formats naturally contain such escapes; the raw-pass encoding signal is a high-false-positive heuristic here.
info ~~warn~~ → info by review encoding-hex test/test_case.py:118:15

19 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
            tuple(range(16)),
            b"\xdc\x00\x10\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
        ),
        ({}, b"\x80"),
```
likely benign LLM, confidence 0.92 Test fixture bytes literal with msgpack encoding vectors.
Reasoning
Sequential byte escapes forming a msgpack array header and counting values, part of a serializer's test vectors. Expected format data in a unit test, not obfuscation.
info ~~warn~~ → info by review payload-bytes-literal test/test_format.py:73:9

concatenated bytes literal contains 37 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
    check(
        b"\x96"
        b"\xde\x00\x00"
        b"\xde\x00\x01\xc0\xc2"
```
likely benign LLM, confidence 0.90 Test checks serialized msgpack bytes via concatenated bytes literal.
Reasoning
Concatenated bytes literals in a format test representing msgpack encodings checked against a serializer. The binary-payload shape reflects the test's purpose, and the content is a fixed expected value passed to check().

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/msgpack/msgpack-python msgpack-python && cd msgpack-python
git checkout v1.2.3
disclude scan --severity info --diff v1.2.2 .