psycopg2-binary 2.9.13

Source: https://github.com/psycopg/psycopg2
Tag scanned: 2.9.13
Compared with: 2.9.12 (0 signals introduced since)
Files: 158 scanned, 21 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 7.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:35

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info identifier-low-length psycopg/aix_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length psycopg/solaris_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info ~~critical~~ → info by review dynamic-execution scripts/build/strip_wheel.sh:39:1

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
Dependencies versions of '_psycopg.so' library:"
"${dir}/print_so_versions.sh" "$(find . -name \*_psycopg\*.so)"

find . -name \*.so -exec strip "$@" {} \;
```
likely benign LLM, confidence 0.93 Build script invoking a sibling helper script via a directory variable, plus a find/strip of shared objects.
Reasoning
This is a psycopg build script. The variable dir is set to the script's own directory (typically via dirname/pwd), so calling "${dir}/print_so_versions.sh" runs a sibling script in the repo. The find/strip line is standard wheel stripping. Flagged pattern is a normal build idiom, not malicious.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:16:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    alpine)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 Distro-specific branch calling the repo's build_libpq.sh via a script-directory variable.
Reasoning
Within a case statement selecting by distro, dir is the script's own directory and the invoked build_libpq.sh is a repository build helper. Standard cibuildwheel pattern; the runtime-determined command is a path derived from the repo, not attacker-controlled input.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:38:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    centos | rocky | almalinux)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 RHEL-family branch invoking the repo's build_libpq.sh via a script-directory variable.
Reasoning
Same pattern as the other finding in this file: a centos/rocky/almalinux branch invoking the repo's own build_libpq.sh through the script directory variable. Legitimate build logic.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:15:1

command name is a variable (`$prjdir`) and `prjdir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
# Build dependency libraries
"${prjdir}/scripts/build/build_libpq.sh" > /dev/null

# Show dependency tree
```
likely benign LLM, confidence 0.92 macOS wheel build step calling the project's build_libpq.sh via a project-directory variable.
Reasoning
prjdir points to the project root and the script runs the bundled build_libpq.sh to compile dependencies before wheel build. This is ordinary CI build orchestration within the repository.
info ~~warn~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:28:3

`eval` called on a string literal (ast pass, confidence 0.85)
```
for i in $(seq 10 -1 0); do
  eval pg_isready && break
  if [ $i == 0 ]; then
      echo "PostgreSQL service not ready, giving up"
```
likely benign LLM, confidence 0.85 Retry loop using eval on a hardcoded command name to wait for PostgreSQL readiness.
Reasoning
eval is applied to the literal string pg_isready inside a retry loop waiting for PostgreSQL to start. It is pointless, not a dropper or obfuscation; the literal is hardcoded so no untrusted input reaches eval. Poor style rather than malicious.

info whitespace-anomaly tests/dbapi20.py:4:1

file mixes tab and space indentation (1 tab-indented and 707 space-indented lines) (raw pass, confidence 0.40)


    This software is Public Domain and may be used without restrictions.

 "Now we have booze and barflies entering the discussion, plus rumours of

info ~~warn~~ → info by review encoding-hex tests/test_types_extras.py:446:13

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        ok('(,"\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f'
           '\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !'
           '""#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]'
           '^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f")',
```
likely benign LLM, confidence 0.90 Python test string literal enumerating ASCII control characters as hex escapes for an escaping test.
Reasoning
This is a test fixture expressing expected bytes for a COPY/composite-type round-trip, deliberately spelling out control characters 0x01 through 0x7f as escapes. Sequential hex escapes of all ASCII control bytes are expected in a test for escaping behavior; no encoded payload or execution is involved.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/psycopg/psycopg2 psycopg2 && cd psycopg2
git checkout 2.9.13
disclude scan --severity info --diff 2.9.12 .