PyPI / psycopg / 3.3.7

psycopg 3.3.7

Source

https://github.com/psycopg/psycopg

Artifact scanned

psycopg-3.3.7-py3-none-any.whl (wheel · 211.1 KB · SHA-256 d592e88a077e…)

Compared with

psycopg-3.3.6-py3-none-any.whl (0 signals introduced since)

Files

86 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-11-03 05:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute psycopg/waiting.py:544:12

   reach-by-name through `globals` (ast pass, confidence 0.60)

           )
       wait = globals()[fname]
   
   # On Windows, for the moment, avoid using wait_c, because it was reported to

   likely benign LLM, confidence 0.90 psycopg selects its platform-specific wait implementation by looking up a function name in globals().

   Reasoning

   The code selects a wait function by name from globals() after choosing an implementation (wait_c, wait_epoll, etc.) based on platform/availability. This is a common, legitimate dispatch pattern in psycopg for selecting the best I/O wait backend; the name comes from a fixed set of internal function names, not untrusted input. The AST flag is a generic dynamic-attribute heuristic.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o psycopg-3.3.7-py3-none-any.whl https://files.pythonhosted.org/packages/b0/2a/2e05cc01b2817b8baff419823774bb928efd0a36de12da78f19482cfa329/psycopg-3.3.7-py3-none-any.whl
printf '%s  %s\n' d592e88a077e01ff57f22d59f16e828b92f2b2d9f439b6679d582b48d74cf306 psycopg-3.3.7-py3-none-any.whl | shasum -a 256 -c -
unzip -q psycopg-3.3.7-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg