opentelemetry-api 1.45.1

Source: https://github.com/open-telemetry/opentelemetry-python
Tag scanned: v1.45.1
Directory: opentelemetry-api (only this part of the repository was scanned)
Compared with: v1.45.0 (0 signals introduced since)
Files: 73 scanned, 14 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:17

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:20:16

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_KEY_PATTERN = compile(_KEY_FORMAT)
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.95 Module-level regex compilation of a key-format pattern in OpenTelemetry baggage.
Reasoning
The snippet shows `compile(_KEY_FORMAT)` assigned to a module-level pattern variable, and the file is OpenTelemetry's baggage module. This is almost certainly `re.compile` from the standard library, building a regular expression from a constant format string. It is not dynamic code execution, and the AST rule matched only on the bare name `compile`.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:21:18

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_KEY_PATTERN = compile(_KEY_FORMAT)
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.95 Module-level regex compilation of a value-format pattern in OpenTelemetry baggage.
Reasoning
The line `_VALUE_PATTERN = compile(_VALUE_FORMAT)` is the same pattern as the other baggage regex compilations. The name `compile` refers to `re.compile`, and the argument is a format-string constant. Nothing here executes code.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:22:20

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.95 Module-level regex compilation of a baggage property pattern in OpenTelemetry.
Reasoning
The line `_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)` compiles a regex from a module-level format constant. This is standard `re.compile` usage in a telemetry library, and the flag comes from the rule matching the name `compile` rather than from any `eval`/`exec` behaviour.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/util/re.py:27:19

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_HEADER_PATTERN = compile(_KEY_VALUE_FORMAT)
_LIBERAL_HEADER_PATTERN = compile(rf"{_OWS}{_KEY_FORMAT}{_OWS}={_OWS}{_LIBERAL_VALUE_FORMAT}{_OWS}")
_DELIMITER_PATTERN = compile(r"[ \t]*,[ \t]*")
```
dismissed LLM, confidence 0.95 Module-level regex compilation for HTTP header parsing utilities in OpenTelemetry.
Reasoning
The snippet compiles regexes built from f-strings and constants, including `rf"{_OWS}{_KEY_FORMAT}..."`, and a literal delimiter pattern. This is ordinary `re.compile` for HTTP header parsing in OpenTelemetry. There is no evidence of dynamic code execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/open-telemetry/opentelemetry-python opentelemetry-python && cd opentelemetry-python
git checkout v1.45.1
disclude scan --severity info --diff v1.45.0 opentelemetry-api