PyPI / pathspec / 1.1.1

pathspec 1.1.1

Source

https://github.com/cpburnz/python-pathspec

Tag scanned

v1.1.1

Compared with

v1.1.0 (0 signals introduced since)

Files

111 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import dev/venv.sh:29:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   # Activate venv.
   . "$venv/bin/activate"
   
   # Execute command.

   likely benign LLM, confidence 0.90 Dev helper sources the venv activate script via a variable path.

   Reasoning

   Sourcing a virtualenv activate script from a variable path is the standard pattern for a dev helper script; the path is built from the venv directory the developer controls. Low risk.

2. info warn → info by review dynamic-execution dev/venv.sh:32:1

   command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   # Execute command.
   "$@"

   likely benign LLM, confidence 0.90 Wrapper executes the caller-supplied command arguments inside the venv.

   Reasoning

   A wrapper script that runs "$@" after activating a venv is a normal pass-through runner; the command comes from the invoking user, not from untrusted input embedded in the file.

3. info warn → info by review payload-bytes-literal tests/test_03_gitignore_basic.py:522:4

   concatenated bytes literal contains 158 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)

   		expected = (
   			b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10'
   			b'\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f'
   			b' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\'

   likely benign LLM, confidence 0.95 Test fixture expecting a sequence of all byte values as bytes literal.

   Reasoning

   The bytes literal is a sequential 0x00 to 0x7e ASCII/byte table used as expected test output for gitignore round-trip or encoding tests. The high escape density is expected for a byte-range fixture, not a hidden payload.

4. info warn → info by review payload-bytes-literal tests/test_04_gitignore_spec.py:526:4

   concatenated bytes literal contains 158 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)

   		expected = (
   			b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10'
   			b'\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f'
   			b' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\'

   likely benign LLM, confidence 0.95 Test fixture expecting a sequence of all byte values as bytes literal.

   Reasoning

   Same byte-range test fixture as the sibling test file, a sequential byte table used as expected output. Legitimate test data, not a payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/cpburnz/python-pathspec python-pathspec && cd python-pathspec
git checkout v1.1.1
disclude scan --severity info --diff v1.1.0 .