PyPI / pre-commit / 4.7.0

pre-commit 4.7.0

Source

https://github.com/pre-commit/pre-commit

Tag scanned

v4.7.0

Compared with

v4.6.2 (0 signals introduced since)

Files

162 scanned, 19 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

4.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 06:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution pre_commit/resources/hook-tmpl:14:5

   `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

   if [ -x "$INSTALL_PYTHON" ]; then
       exec "$INSTALL_PYTHON" -mpre_commit "${ARGS[@]}"
   elif command -v pre-commit > /dev/null; then
       exec pre-commit "${ARGS[@]}"

   likely benign LLM, confidence 0.93 Shell hook template that execs the pre-commit tool from a located interpreter or PATH.

   Reasoning

   This is the standard pre-commit hook launcher template. It execs a Python interpreter path it located itself, or falls back to a pre-commit binary found on PATH via command -v. The dynamic path is an ordinary interpreter-selection pattern, not a dropper or obfuscated payload, and the arguments are passed through as an array.

2. info unicode-mixed-script tests/commands/run_test.py:59:16

   identifier `啊あ아` mixes scripts: Han + Hiragana + Hangul (in string/comment) (raw pass, confidence 0.40)

       ret = _full_msg(
           start='啊あ아',
           end_msg='end',
           end_color='',

3. info unicode-mixed-script tests/commands/run_test.py:66:20

   identifier `啊あ아` mixes scripts: Han + Hiragana + Hangul (in string/comment) (raw pass, confidence 0.40)

       # 5 dots: 15 - 6 - 3 - 1
       assert ret == '啊あ아.....end\n'

4. info warn → info by review encoding-base64 tests/languages/golang_test.py:66:38

   base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

       go_sum = '''\
   github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
   github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
   '''  # noqa: E501

   dismissed LLM, confidence 0.95 Go module checksum lines (go.sum content) used as test data.

   Reasoning

   The flagged text is a go.sum excerpt embedded as a test fixture. The base64 strings are the h1: module checksums that Go writes in go.sum files. They are expected data, not an encoded payload, and the raw-pass base64 signal is a known false positive for hash strings.

5. info warn → info by review encoding-base64 tests/languages/golang_test.py:67:45

   base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

   github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
   github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
   '''  # noqa: E501
       hello_world_go = '''\

   dismissed LLM, confidence 0.95 Go module checksum lines (go.sum content) used as test data.

   Reasoning

   This is the same go.sum fixture block, offset by one line. The base64 blobs are standard Go module hashes inside a Python multiline string in a test file, so the finding is a false positive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pre-commit/pre-commit pre-commit && cd pre-commit
git checkout v4.7.0
disclude scan --severity info --diff v4.6.2 .