platformdirs 4.13.0

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.0
Compared with: 4.12.4 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:266:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
likely benign LLM, confidence 0.90 RST how-to showing example console output of a platformdirs call on Windows.
Reasoning
This is a documentation example showing a Windows cmd session that sets an env var and runs python -c to print a path. The 'redirect writes to python' flag is an artifact of the doc's console-transcript formatting; the snippet contains no download, shell pipeline, or actual PATH manipulation. Benign doc content.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:267:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.90 Doc example line showing a Windows cache path output, misread as an obfuscated command name.
Reasoning
The flagged 'backslash-escape sequences' are just Windows path separators in a documentation output example (X:\appdata\Acme\...). Not a command obfuscation attempt; it is a rendered transcript line.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:61:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.80 Test helper that saves and monkeypatches PlatformDirs class attributes for test isolation.
Reasoning
This is a testing helper that temporarily patches PlatformDirs attributes via setattr and restores them from a saved dict. Reflective access via vars() is a common mocking pattern in test utilities for a library like platformdirs. Only mildly suspicious as a general pattern; the code is self-contained and legitimate for a testing module.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.80 Test code temporarily overriding builtins.__import__ to simulate module import behavior.
Reasoning
Replacing builtins.__import__ inside a test to simulate import failures or fake modules is a standard test technique. The code restores the original import afterward and clears sys.modules entries. The flag is accurate in describing the global effect, but within a test module this is expected, not malicious.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.85 Test cleanup restoring the original builtins.__import__ and sys.modules after a patched import test.
Reasoning
This is the restore step paired with the override at line 171, putting back the original builtin import and sys.modules entries. It is cleanup logic for a test-only monkeypatch, consistent with a legitimate test fixture.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.0
disclude scan --severity info --diff 4.12.4 .