PyPI / propcache / 0.5.4

propcache 0.5.4

Source

https://github.com/aio-libs/propcache

Tag scanned

v0.5.4

Compared with

v0.5.3 (0 signals introduced since)

Files

41 scanned, 14 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

4.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 22:49

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:51:24

   [embedded bash] command name is a variable (`$propcache`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ propcache/__init__.py
          [dir:propcache] $ python -m towncrier build \
                         -- --version 'VERSION_WITHOUT_LEADING_V'

   likely benign LLM, confidence 0.93 Documentation showing release-process shell commands with a directive-style prefix.

   Reasoning

   This is a release guide in documentation. The bash blocks use $propcache, $python, $git as placeholder/command prefixes in a doc-directive notation for embedded shell examples. The scanner flagged variable command names in documentation, which is not executable code and not an attack.

2. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:52:24

   [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ propcache/__init__.py
          [dir:propcache] $ python -m towncrier build \
                         -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:propcache] $ git commit -v CHANGES{.rst,/} propcache/__init__.py

   likely benign LLM, confidence 0.93 Release guide example running towncrier build via python in docs.

   Reasoning

   Same release guide documentation; the flagged $python is a documented command in a code example for towncrier build. Not executed by the scanner context and no malicious payload shown.

3. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:54:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

                         -- --version 'VERSION_WITHOUT_LEADING_V'
          [dir:propcache] $ git commit -v CHANGES{.rst,/} propcache/__init__.py

   likely benign LLM, confidence 0.93 Release guide example of a git commit command.

   Reasoning

   Documentation example of git commit for changelog and version files in a release guide. Standard contributor instructions; the variable-command flag is a false positive from rst embedded bash parsing.

4. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:73:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ git tag \
                         -s 'VERSION_WITH_LEADING_V' \
                         -m 'VERSION_WITH_LEADING_V' \

   likely benign LLM, confidence 0.93 Release guide example creating a signed git tag.

   Reasoning

   Documentation of signed git tag creation for a release with placeholder version strings. Normal release procedure text, not malicious.

5. info warn → info by review dynamic-execution docs/contributing/release_guide.rst:84:24

   [embedded bash] command name is a variable (`$git`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          [dir:propcache] $ git push origin 'VERSION_WITH_LEADING_V'

   likely benign LLM, confidence 0.93 Release guide example pushing a git tag to origin.

   Reasoning

   Documentation of pushing a release tag to origin. Ordinary release instructions in a contributing guide with placeholder version.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/aio-libs/propcache propcache && cd propcache
git checkout v0.5.4
disclude scan --severity info --diff v0.5.3 .