PyPI / pre-commit / 4.7.0

pre-commit 4.7.0

Source

https://github.com/pre-commit/pre-commit

Tag scanned

v4.7.0

Compared with

v4.6.2 (0 signals introduced since)

Files

162 scanned, 19 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution pre_commit/resources/hook-tmpl:14:5

   `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

   if [ -x "$INSTALL_PYTHON" ]; then
       exec "$INSTALL_PYTHON" -mpre_commit "${ARGS[@]}"
   elif command -v pre-commit > /dev/null; then
       exec pre-commit "${ARGS[@]}"

   likely benign LLM, confidence 0.85 Shell hook template that execs the pre-commit tool via a variable-selected interpreter path.

   Reasoning

   This is the standard pre-commit hook template. It execs the installed python interpreter or the pre-commit binary with forwarded arguments. The dynamic path comes from the installer-substituted INSTALL_PYTHON variable, which is normal for a generated hook launcher. No download or decode pipeline is present.

2. info unicode-mixed-script tests/commands/run_test.py:59:16

   identifier `啊あ아` mixes scripts: Han + Hiragana + Hangul (in string/comment) (raw pass, confidence 0.40)

       ret = _full_msg(
           start='啊あ아',
           end_msg='end',
           end_color='',

3. info unicode-mixed-script tests/commands/run_test.py:66:20

   identifier `啊あ아` mixes scripts: Han + Hiragana + Hangul (in string/comment) (raw pass, confidence 0.40)

       # 5 dots: 15 - 6 - 3 - 1
       assert ret == '啊あ아.....end\n'

4. info warn → info by review encoding-base64 tests/languages/golang_test.py:66:38

   base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

       go_sum = '''\
   github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
   github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
   '''  # noqa: E501

   dismissed LLM, confidence 0.95 Go module checksum lines embedded in a test fixture string.

   Reasoning

   The blob is a go.sum entry: a base64-encoded SHA-256 module hash in a test fixture. The 44-byte length and low compression ratio are typical of hash digests, and the surrounding text is a Go module checksum listing.

5. info warn → info by review encoding-base64 tests/languages/golang_test.py:67:45

   base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

   github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
   github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
   '''  # noqa: E501
       hello_world_go = '''\

   dismissed LLM, confidence 0.95 Duplicate go.sum hash lines in the same Go test fixture.

   Reasoning

   Same go.sum content as the previous finding, repeated in a test string. The base64 values are standard module hashes, not an obfuscated payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pre-commit/pre-commit pre-commit && cd pre-commit
git checkout v4.7.0
disclude scan --severity info --diff v4.6.2 .