platformdirs 4.13.5

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.5
Compared with: 4.13.4 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 5.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:267:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.90 RST doc showing a Windows console session calling python to print a platformdirs cache path.
Reasoning
This is a documentation example showing a Windows cmd session setting an env var and running python -c to print a path. The 'redirect writes to python' flag is a false positive from the embedded bash parser misreading the '>' prompt marker in an RST console transcript. No dropper or PATH hijack setup is present.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:268:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.90 Doc output line containing a Windows filesystem path, misread as an obfuscated command name.
Reasoning
The flagged 'backslash-escape' command name is just a Windows path (X:\appdata\Acme\MyApp\Cache) shown as program output in a docs transcript. The escape-sequence heuristic misfires on Windows paths; there is no hidden command.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:63:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.80 Test utility that saves and overrides PlatformDirs class attributes with setattr for mocking.
Reasoning
This is a test helper that temporarily patches PlatformDirs attributes via setattr, saving originals via vars() for restoration. That is a standard monkeypatch-and-restore pattern in a testing module; it is dynamic but scoped and benign in context.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.80 Test fixture that temporarily swaps builtins.__import__ and clears sys.modules to test imports.
Reasoning
Test code replaces builtins.__import__ with a fake importer to simulate missing or altered platform modules, and deletes sys.modules entries to force reimport. Global builtin patching is unusual but is a known test technique for import-path testing, and the code is restored in a paired block. Not a supply-chain attack pattern.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.85 Restores original builtins.__import__ and sys.modules after an import-mocking test.
Reasoning
This is the restore half of the same test fixture, reinstating the original builtins.__import__ and sys.modules entries. It is the cleanup of a benign, scoped import-mocking test.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.5
disclude scan --severity info --diff 4.13.4 .