PyPI / opentelemetry-api / 1.45.1

opentelemetry-api 1.45.1

Source

https://github.com/open-telemetry/opentelemetry-python

Artifact scanned

opentelemetry_api-1.45.1-py3-none-any.whl (wheel · 58.8 KB · SHA-256 b31553efa588…)

Compared with

opentelemetry_api-1.45.0-py3-none-any.whl (0 signals introduced since)

Files

31 scanned, 16 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 01:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution opentelemetry/baggage/__init__.py:20:16

   `compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   
   _KEY_PATTERN = compile(_KEY_FORMAT)
   _VALUE_PATTERN = compile(_VALUE_FORMAT)
   _PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)

   likely benign LLM, confidence 0.92 Module-level precompilation of regex patterns from format-string constants in OpenTelemetry's baggage module.

   Reasoning

   The call is `compile(_KEY_FORMAT)` at module scope. The file is OpenTelemetry's baggage module, and the sibling lines are the same pattern for regex format strings (_VALUE_FORMAT, _BAGGAGE_PROPERTY_FORMAT). That is almost certainly `re.compile` imported by name, which is a normal way to precompile regexes. The format constants are regex source and not an encoded payload. The critical severity comes from the scanner matching the bare name `compile` without resolving its import.

2. info critical → info by review dynamic-execution opentelemetry/baggage/__init__.py:21:18

   `compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   _KEY_PATTERN = compile(_KEY_FORMAT)
   _VALUE_PATTERN = compile(_VALUE_FORMAT)
   _PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)

   likely benign LLM, confidence 0.92 Precompiles a value regex from a module-level format string in OpenTelemetry's baggage module.

   Reasoning

   Same pattern as the other baggage finding: `compile(_VALUE_FORMAT)` builds a regex from a module constant. The file is OpenTelemetry's baggage module, and the call matches `re.compile` usage. Nothing here decodes or executes data.

3. info critical → info by review dynamic-execution opentelemetry/baggage/__init__.py:22:20

   `compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   _VALUE_PATTERN = compile(_VALUE_FORMAT)
   _PROPERT_PATTERN = compile(_BAGGAGE_PROPERTY_FORMAT)

   likely benign LLM, confidence 0.92 Precompiles the baggage property regex at import in OpenTelemetry's baggage module.

   Reasoning

   `compile(_BAGGAGE_PROPERTY_FORMAT)` at import time follows the same regex-precompilation idiom as the rest of the module. The code is consistent with `re.compile`, and no exec, eval, or decoding appears in the snippet.

4. info critical → info by review dynamic-execution opentelemetry/util/re.py:27:19

   `compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   
   _HEADER_PATTERN = compile(_KEY_VALUE_FORMAT)
   _LIBERAL_HEADER_PATTERN = compile(rf"{_OWS}{_KEY_FORMAT}{_OWS}={_OWS}{_LIBERAL_VALUE_FORMAT}{_OWS}")
   _DELIMITER_PATTERN = compile(r"[ \t]*,[ \t]*")

   likely benign LLM, confidence 0.90 Builds HTTP header-parsing regexes at module import in OpenTelemetry's util/re module.

   Reasoning

   The file is OpenTelemetry's regex utility. The snippet compiles format-string constants into header-parsing regexes, including an rf-string built from other constants and a literal delimiter pattern. This is ordinary regex construction for HTTP header parsing. The `compile` name is almost certainly `re.compile`, and the critical rating reflects an unresolved name, not dynamic execution.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o opentelemetry_api-1.45.1-py3-none-any.whl https://files.pythonhosted.org/packages/1e/41/f7dcf80b81ee8e71c1a2b59f14208bc723edbd89ed027a73b175abf6348e/opentelemetry_api-1.45.1-py3-none-any.whl
printf '%s  %s\n' b31553efa588ae44bc306f863c785c5333a9ecc091248c6ee68b4b6c87fdedfb opentelemetry_api-1.45.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q opentelemetry_api-1.45.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg