PyPI / propcache / 0.5.4

propcache 0.5.4

Source

https://github.com/aio-libs/propcache

Tag scanned

v0.5.4

Compared with

v0.5.3 (0 signals introduced since)

Files

41 scanned, 14 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:17

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:51:24

   [embedded bash] command name is a variable (`$propcache`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ propcache/__init__.py
          [dir:propcache] $ python -m towncrier build \
                         -- --version 'VERSION_WITHOUT_LEADING_V'

   likely benign LLM, confidence 0.93 Documentation example showing a towncrier release command in an embedded bash block.

   Reasoning

   This is a release guide in RST documentation. The embedded bash block uses a prompt-style directive showing a variable command name in a doc example. It is documentation text, not executed code in the package, and the variable reflects prompt placeholders rather than attacker-controlled execution.

2. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:52:24

   [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ propcache/__init__.py
          [dir:propcache] $ python -m towncrier build \
                         -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:propcache] $ git commit -v CHANGES{.rst,/} propcache/__init__.py

   likely benign LLM, confidence 0.93 Release guide documentation showing a python towncrier invocation and git commit.

   Reasoning

   Documentation of a release procedure with a python -m towncrier build example. The $python token is a generic interpreter placeholder in a docs code block; the finding is a false positive from the dynamic-execution heuristic applied to RST docs.

3. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:54:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

                         -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:propcache] $ git commit -v CHANGES{.rst,/} propcache/__init__.py

   likely benign LLM, confidence 0.93 Release guide git commit example in embedded bash documentation.

   Reasoning

   Standard git commit example in a contributor release guide. $git is a placeholder for the git binary in documentation prose; no malicious behavior or obfuscation is present.

4. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:73:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ git tag \
                         -s 'VERSION_WITH_LEADING_V' \
                         -m 'VERSION_WITH_LEADING_V' \

   likely benign LLM, confidence 0.93 Release guide example creating a signed git tag.

   Reasoning

   Documentation showing signed git tag creation for a release. This is an ordinary release procedure described in docs; the variable command name is a doc placeholder, not a dropper or hidden execution.

5. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:84:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ git push origin 'VERSION_WITH_LEADING_V'

   likely benign LLM, confidence 0.93 Release guide example pushing the release tag to origin.

   Reasoning

   Documentation of pushing a release tag to origin. Routine release instructions in a contributor guide with no obfuscation or malicious intent.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/aio-libs/propcache propcache && cd propcache
git checkout v0.5.4
disclude scan --severity info --diff v0.5.3 .