posthog 7.75.8

Source: https://github.com/posthog/posthog-python
Artifact scanned: posthog-7.75.8-py3-none-any.whl (wheel · 907.0 KB · SHA-256 1afb8180ec41…)
Compared with: posthog-7.75.7-py3-none-any.whl (0 signals introduced since)
Files: 261 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 7.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection posthog/exception_utils.py:1060:21

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            frame = sys._getframe(depth)
            depth += 1
        except ValueError:
```
likely benign LLM, confidence 0.90 Walks the call stack with sys._getframe inside exception-reporting utilities.
Reasoning
The loop calls sys._getframe(depth) with incrementing depth and stops on ValueError, the standard way to walk the call stack to a frame when building exception context. It is ordinary introspection in an SDK's exception-reporting code, with no execution, network, or process spawning nearby.
info ~~warn~~ → info by review encoding-base64 posthog/test/mcp/test_session_token.py:68:15

base64-like blob (95 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    )
    frozen = "eyJzaWQiOiJzZXNfZml4dHVyZSIsImNuIjoiQ2xhdWRlIENvZGUiLCJjdiI6IjEuMi4zIiwicHYiOiIyMDI1LTA2LTE4In0"

    # Encode side: our output is byte-identical to the shared wire format.
```
likely benign LLM, confidence 0.92 A base64url-encoded JSON session-token test fixture.
Reasoning
The string is a base64url-encoded JSON session fixture (decodes to fields like sid, cn, cv, pv), assigned in a test and followed by a comment about checking encoder output against a shared wire format. It is test data for token encoding, not a hidden payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_capture_v1.py:456:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(call["data"][0], 0x78)  # zlib header
        roundtripped = zlib.decompress(call["data"]).decode("utf-8")
        self.assertNotIn("api_key", json.loads(roundtripped))
```
likely benign LLM, confidence 0.93 Test decompresses a captured mock request body to check its contents.
Reasoning
zlib.decompress is applied to a request body captured from a mocked HTTP call, and the test asserts the API key is absent from the decoded JSON. This is verification of outbound payload content in a unit test, not runtime decoding of an embedded payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_metrics.py:55:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    body = kwargs.get("data")
    return json.loads(gzip.decompress(body).decode("utf-8"))
```
likely benign LLM, confidence 0.93 Test helper gunzips a mocked request body to parse its JSON.
Reasoning
gzip.decompress is applied to the 'data' kwarg of a mocked POST so the test can parse the JSON body. This is a test helper decoding captured traffic, with no dynamic execution or dropper behavior.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_request.py:227:27

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(headers["Content-Encoding"], "gzip")
        body = json.loads(gzip.decompress(data))
        self.assertEqual(body["batch"], [])
        self.assertEqual(body["api_key"], TEST_API_KEY)
```
likely benign LLM, confidence 0.93 Test gunzips captured request data to assert its batch and API key fields.
Reasoning
gzip.decompress decodes request data captured by the test, and the test then asserts on batch contents and the API key. This is ordinary test verification of the SDK's compressed request format.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_client_traces.py:60:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    args, kwargs = session.post.call_args
    return json.loads(gzip.decompress(kwargs["data"])), args[0], kwargs
```
likely benign LLM, confidence 0.93 Test helper gunzips a mocked trace export body for assertions.
Reasoning
The helper gunzips kwargs['data'] from a mocked session.post call and returns parsed JSON for assertions. It is test-only plumbing for checking the trace export payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_transport.py:71:27

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert kwargs["headers"]["Content-Type"] == "application/json"
        assert json.loads(gzip.decompress(kwargs["data"])) == PAYLOAD

    def test_falls_back_to_the_default_timeout(self):
```
likely benign LLM, confidence 0.93 Transport test gunzips the mocked request body and compares it to an expected payload.
Reasoning
gzip.decompress is applied to a mocked request's data and compared against an expected PAYLOAD constant. This is a transport unit test verifying compression round-trips correctly.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o posthog-7.75.8-py3-none-any.whl https://files.pythonhosted.org/packages/99/41/37ae1d46db2e7d350fa34161e08dead232e4c06ea9e08bbe585f4895df3f/posthog-7.75.8-py3-none-any.whl
printf '%s  %s\n' 1afb8180ec41b527c278dfe88a04a0123953ab10136386f6839607d8337aca10 posthog-7.75.8-py3-none-any.whl | shasum -a 256 -c -
unzip -q posthog-7.75.8-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg