posthog 7.75.7

Source: https://github.com/posthog/posthog-python
Artifact scanned: posthog-7.75.7-py3-none-any.whl (wheel · 901.4 KB · SHA-256 d8eeb27405c0…)
Compared with: posthog-7.75.6-py3-none-any.whl (0 signals introduced since)
Files: 260 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 5.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection posthog/exception_utils.py:1060:21

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            frame = sys._getframe(depth)
            depth += 1
        except ValueError:
```
likely benign LLM, confidence 0.85 Walks the call stack via sys._getframe to collect frame information for exception reports.
Reasoning
sys._getframe(depth) in a loop walking up the stack with a ValueError guard is a standard way to collect frame info for exception reporting in a telemetry SDK. Legitimate and common.
info ~~warn~~ → info by review encoding-base64 posthog/test/mcp/test_session_token.py:68:15

base64-like blob (95 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    )
    frozen = "eyJzaWQiOiJzZXNfZml4dHVyZSIsImNuIjoiQ2xhdWRlIENvZGUiLCJjdiI6IjEuMi4zIiwicHYiOiIyMDI1LTA2LTE4In0"

    # Encode side: our output is byte-identical to the shared wire format.
```
likely benign LLM, confidence 0.90 Test fixture containing a base64url-encoded JSON session token.
Reasoning
A base64url-encoded JSON literal in a test fixture (sid, cn, cv, pv fields) used to check wire-format compatibility. Benign test data; the raw pass has a high false-positive rate for such strings.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_capture_v1.py:456:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(call["data"][0], 0x78)  # zlib header
        roundtripped = zlib.decompress(call["data"]).decode("utf-8")
        self.assertNotIn("api_key", json.loads(roundtripped))
```
likely benign LLM, confidence 0.92 Test decompresses a captured zlib request body to assert the API key is not leaked.
Reasoning
zlib.decompress is applied to a captured request body in a unit test to verify that the api_key is absent from the payload. This is test assertion code inspecting its own mock data, not a hidden payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_metrics.py:55:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    body = kwargs.get("data")
    return json.loads(gzip.decompress(body).decode("utf-8"))
```
likely benign LLM, confidence 0.92 Test helper gunzips and parses a mocked HTTP request body.
Reasoning
gzip.decompress of a mocked request body in a test helper to parse the JSON sent. Ordinary test plumbing.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_request.py:227:27

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(headers["Content-Encoding"], "gzip")
        body = json.loads(gzip.decompress(data))
        self.assertEqual(body["batch"], [])
        self.assertEqual(body["api_key"], TEST_API_KEY)
```
likely benign LLM, confidence 0.92 Test gunzips captured request data to check payload fields.
Reasoning
gzip.decompress of captured request data to verify batch and api_key contents in a unit test. Expected behavior for an SDK testing its compressed transport.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_client_traces.py:60:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    args, kwargs = session.post.call_args
    return json.loads(gzip.decompress(kwargs["data"])), args[0], kwargs
```
likely benign LLM, confidence 0.92 Test helper decompresses and parses a mocked gzip POST body.
Reasoning
Test helper decompresses the gzip body of a mocked session.post call and parses JSON for assertions. Benign.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_transport.py:71:27

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert kwargs["headers"]["Content-Type"] == "application/json"
        assert json.loads(gzip.decompress(kwargs["data"])) == PAYLOAD

    def test_falls_back_to_the_default_timeout(self):
```
likely benign LLM, confidence 0.92 Test asserts that the gzipped request body decodes to the expected payload.
Reasoning
Assertion that gunzipped mocked request data equals the expected payload. Ordinary test code.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o posthog-7.75.7-py3-none-any.whl https://files.pythonhosted.org/packages/cb/b5/77fa4bf593ac5effa880a0e86b6f7b6910bb2b2da65b50ba398b2540a84a/posthog-7.75.7-py3-none-any.whl
printf '%s  %s\n' d8eeb27405c07dc82bdaa18e02986fc2dafea73bbdac2f6873298ebfbafe0cb0 posthog-7.75.7-py3-none-any.whl | shasum -a 256 -c -
unzip -q posthog-7.75.7-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg