platformdirs 4.13.2

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.2
Compared with: 4.13.1 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 5.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 17:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:266:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
likely benign LLM, confidence 0.85 Documentation code sample showing a python invocation and its printed output in a Windows shell.
Reasoning
This is a documentation example showing a Windows cmd session where a user sets an env var and runs python -c with platformdirs. The 'redirect writes to python' flag is a misreading of a shell prompt/output in an RST doc; there is no PATH hijack setup, just an illustrative example of output.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:267:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.90 Documentation output line containing a Windows filesystem path, falsely parsed as an escaped command name.
Reasoning
The backslash sequences are Windows path separators in an output sample (X:\appdata\Acme\MyApp\Cache), not an escaped command name. The finding misinterprets documentation text as a command obfuscation.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:61:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.80 Test utility that saves and overrides PlatformDirs class attributes via vars/setattr for patching during tests.
Reasoning
This is a test helper that temporarily monkeypatches PlatformDirs class attributes with saved originals, a common and legitimate test pattern. Reading via vars() and setattr is ordinary for mocking in a testing module of a library.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.80 Test code temporarily replacing builtins.__import__ and clearing sys.modules to simulate import behavior.
Reasoning
Replacing builtins.__import__ with a fake import in a test to simulate missing modules is a known test technique, and the code restores the original afterward. It is risky in principle but appears to be intentional test isolation rather than malicious persistence.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.80 Test cleanup restoring the original builtins.__import__ and sys.modules entries after a patched-import test.
Reasoning
This restores builtins.__import__ to its original value and reinstates saved sys.modules entries, which is the cleanup counterpart of the test's import patching. It is consistent with legitimate test isolation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.2
disclude scan --severity info --diff 4.13.1 .