posthog 7.75.9

Source: https://github.com/posthog/posthog-python
Artifact scanned: posthog-7.75.9-py3-none-any.whl (wheel · 921.2 KB · SHA-256 1d64ec3ea644…)
Compared with: posthog-7.75.8-py3-none-any.whl (0 signals introduced since)
Files: 262 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection posthog/exception_utils.py:1060:21

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            frame = sys._getframe(depth)
            depth += 1
        except ValueError:
```
likely benign LLM, confidence 0.85 Walks the call stack via sys._getframe to collect frame metadata for exception reporting.
Reasoning
sys._getframe(depth) in a loop walking up the stack with a ValueError guard is a standard way to collect frame info for exception reporting; no decoding or execution of payloads.
info ~~warn~~ → info by review encoding-base64 posthog/test/mcp/test_session_token.py:68:15

base64-like blob (95 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
    )
    frozen = "eyJzaWQiOiJzZXNfZml4dHVyZSIsImNuIjoiQ2xhdWRlIENvZGUiLCJjdiI6IjEuMi4zIiwicHYiOiIyMDI1LTA2LTE4In0"

    # Encode side: our output is byte-identical to the shared wire format.
```
likely benign LLM, confidence 0.90 Test fixture containing a base64url-encoded JSON session token for encode-format verification.
Reasoning
A base64url-encoded JSON string literal in a test fixture (decodes to session id, client name, version, timestamp) used to check wire-format compatibility; typical test data, not a hidden payload.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_capture_v1.py:456:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(call["data"][0], 0x78)  # zlib header
        roundtripped = zlib.decompress(call["data"]).decode("utf-8")
        self.assertNotIn("api_key", json.loads(roundtripped))
```
likely benign LLM, confidence 0.92 Test decompresses a captured zlib request body to assert the API key is not leaked.
Reasoning
zlib.decompress is applied to captured request data in a test assertion to verify that the api_key is absent from the payload; it operates on the test's own mock output, not an embedded payload executed at runtime.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_metrics.py:55:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    body = kwargs.get("data")
    return json.loads(gzip.decompress(body).decode("utf-8"))
```
likely benign LLM, confidence 0.92 Test helper gunzips and parses a mocked HTTP request body for assertions.
Reasoning
gzip.decompress on a mocked request body in a test helper to parse JSON for assertions; ordinary test plumbing.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/test_request.py:227:27

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self.assertEqual(headers["Content-Encoding"], "gzip")
        body = json.loads(gzip.decompress(data))
        self.assertEqual(body["batch"], [])
        self.assertEqual(body["api_key"], TEST_API_KEY)
```
likely benign LLM, confidence 0.92 Test decompresses a captured gzip request body to verify its JSON contents.
Reasoning
gzip.decompress of captured request data in a unit test to check batch and api_key fields; expected behavior for testing a compressing HTTP client.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_client_traces.py:60:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    args, kwargs = session.post.call_args
    return json.loads(gzip.decompress(kwargs["data"])), args[0], kwargs
```
likely benign LLM, confidence 0.92 Test helper gunzips a mocked POST body to inspect the sent trace payload.
Reasoning
Helper decompresses gzip request data from a mocked session.post call to parse and check the sent trace payload; standard test code.
info ~~warn~~ → info by review decoder-decompress-payload posthog/test/tracing/test_transport.py:71:27

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert kwargs["headers"]["Content-Type"] == "application/json"
        assert json.loads(gzip.decompress(kwargs["data"])) == PAYLOAD

    def test_falls_back_to_the_default_timeout(self):
```
likely benign LLM, confidence 0.92 Transport test gunzips the mocked request body and compares it to the expected payload.
Reasoning
gzip.decompress of the mocked request body to compare against the expected PAYLOAD in a transport test; ordinary verification of compressed output.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o posthog-7.75.9-py3-none-any.whl https://files.pythonhosted.org/packages/92/53/b54a611324bda3d4709defaef4e372dbbcb3391da8711a5294aa1710bd79/posthog-7.75.9-py3-none-any.whl
printf '%s  %s\n' 1d64ec3ea644dc3427bace1b113cd855149f5a60ee6a2567c03e8a99eaeffd5b posthog-7.75.9-py3-none-any.whl | shasum -a 256 -c -
unzip -q posthog-7.75.9-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg