posthog 7.75.10

Source: https://github.com/posthog/posthog-python
Artifact scanned: posthog-7.75.10-py3-none-any.whl (wheel · 922.5 KB · SHA-256 131813b5413e…)
Compared with: posthog-7.75.9-py3-none-any.whl (0 signals introduced since)
Files: 263 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 8.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection posthog/exception_utils.py:1060:21

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            frame = sys._getframe(depth)
            depth += 1
        except ValueError:
```
likely benign LLM, confidence 0.97 Walks the call stack with sys._getframe to gather frame information for exception reporting.
Reasoning
sys._getframe(depth) is used in a loop that walks up the call stack until ValueError, a standard way to collect frame info for exception reporting. Nothing decodes, executes, or reaches the network here.
info ~~warn~~ → info by review encoding-base64 posthog/test/mcp/test_session_token.py:68:15

base64-like blob (95 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    )
    frozen = "eyJzaWQiOiJzZXNfZml4dHVyZSIsImNuIjoiQ2xhdWRlIENvZGUiLCJjdiI6IjEuMi4zIiwicHYiOiIyMDI1LTA2LTE4In0"

    # Encode side: our output is byte-identical to the shared wire format.
```
likely benign LLM, confidence 0.93 A base64url-encoded JSON test fixture for a session token in a unit test.
Reasoning
The raw-pass blob is a short base64url-encoded JSON fixture (session id, client name, version, date) in a test that checks wire-format compatibility. It is test data, not a hidden payload, and the high-FP raw pass fits this pattern.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_capture_v1.py:456:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(call["data"][0], 0x78)  # zlib header
        roundtripped = zlib.decompress(call["data"]).decode("utf-8")
        self.assertNotIn("api_key", json.loads(roundtripped))
```
likely benign LLM, confidence 0.95 Test helper that decompresses a captured zlib request body to verify its contents.
Reasoning
zlib.decompress is applied to a request body captured from a mocked HTTP call so the test can assert that api_key is absent from the payload. This is a round-trip check on the SDK's own output, not an embedded runtime payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_metrics.py:55:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    body = kwargs.get("data")
    return json.loads(gzip.decompress(body).decode("utf-8"))
```
likely benign LLM, confidence 0.95 Test helper that gunzips and parses a mocked request body to check the sent JSON.
Reasoning
gzip.decompress on the mocked request body, followed by json.loads, lets the test inspect what was sent. It is ordinary test verification of the SDK's compressed transport.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_request.py:227:27

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(headers["Content-Encoding"], "gzip")
        body = json.loads(gzip.decompress(data))
        self.assertEqual(body["batch"], [])
        self.assertEqual(body["api_key"], TEST_API_KEY)
```
likely benign LLM, confidence 0.95 Test that gunzips a captured request body and asserts on its batch and api_key fields.
Reasoning
The code gunzips a captured request body and asserts on batch contents and the API key. It is test assertion logic over the SDK's own outgoing payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_client_traces.py:60:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    args, kwargs = session.post.call_args
    return json.loads(gzip.decompress(kwargs["data"])), args[0], kwargs
```
likely benign LLM, confidence 0.95 Test helper that gunzips and parses a mocked POST body for trace assertions.
Reasoning
A helper gunzips the kwargs data of a mocked session.post call and parses it so the test can inspect the trace payload. This is routine test inspection with no execution of decoded content.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_transport.py:71:27

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert kwargs["headers"]["Content-Type"] == "application/json"
        assert json.loads(gzip.decompress(kwargs["data"])) == PAYLOAD

    def test_falls_back_to_the_default_timeout(self):
```
likely benign LLM, confidence 0.95 Test that gunzips a mocked transport request body and compares it to the expected payload.
Reasoning
gzip.decompress on the mocked request data is compared to an expected PAYLOAD, a standard round-trip check for the transport's compression. The decoded data is only compared, never executed.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o posthog-7.75.10-py3-none-any.whl https://files.pythonhosted.org/packages/f8/c1/9d025db501fbc4e06ef294075d47b67ae8c1ea0460d25298fe83c9f39ced/posthog-7.75.10-py3-none-any.whl
printf '%s  %s\n' 131813b5413e36338a24fc3dc9a55aa11f416e77e3ba3f70152f9d041d90790e posthog-7.75.10-py3-none-any.whl | shasum -a 256 -c -
unzip -q posthog-7.75.10-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg