opentelemetry-api 1.45.1

Source: https://github.com/open-telemetry/opentelemetry-python
Tag scanned: v1.45.1
Directory: opentelemetry-api (only this part of the repository was scanned)
Compared with: v1.45.0 (0 signals introduced since)
Files: 73 scanned, 14 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 5.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 22:46

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:20:16

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_KEY_PATTERN = compile(_KEY_FORMAT)
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.93 Module-level re.compile of baggage key/value regex patterns in OpenTelemetry.
Reasoning
The snippet shows `compile` applied to module-level regex format constants (_KEY_FORMAT, _VALUE_FORMAT). OpenTelemetry's baggage module imports compile from the re module to build header-parsing patterns. Pattern compilation is not code execution, and the expression is built from local constants, not untrusted input. The AST rule matched on the bare name `compile` and misread it as the builtin.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:21:18

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_KEY_PATTERN = compile(_KEY_FORMAT)
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.93 Module-level regex compilation of the baggage value pattern.
Reasoning
Same line of code as the previous finding: `_VALUE_PATTERN = compile(_VALUE_FORMAT)`. It compiles a regex from a module constant at import time. This is a standard regex precompilation idiom, not dynamic execution.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/baggage/__init__.py:22:20

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_VALUE_PATTERN = compile(_VALUE_FORMAT)
_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)
```
dismissed LLM, confidence 0.93 Module-level regex compilation of the baggage property pattern.
Reasoning
`_PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)` compiles a regex from a constant format string. Nothing here evaluates arbitrary strings or spawns processes. The critical severity comes from a name match on `compile`, not from risky behavior.
info ~~critical~~ → info by review dynamic-execution opentelemetry-api/src/opentelemetry/util/re.py:27:19

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_HEADER_PATTERN = compile(_KEY_VALUE_FORMAT)
_LIBERAL_HEADER_PATTERN = compile(rf"{_OWS}{_KEY_FORMAT}{_OWS}={_OWS}{_LIBERAL_VALUE_FORMAT}{_OWS}")
_DELIMITER_PATTERN = compile(r"[ \t]*,[ \t]*")
```
dismissed LLM, confidence 0.93 Module-level regex compilation for HTTP header parsing in OpenTelemetry's util.re.
Reasoning
The snippet compiles regexes built from module constants and an f-string of those constants (_OWS, _KEY_FORMAT, etc.) to parse HTTP headers. This is the re module used as intended, with no eval, exec, or external input. The flag is a false positive from matching the name `compile`.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/open-telemetry/opentelemetry-python opentelemetry-python && cd opentelemetry-python
git checkout v1.45.1
disclude scan --severity info --diff v1.45.0 opentelemetry-api