psycopg2-binary 2.9.13

Source: https://github.com/psycopg/psycopg2
Tag scanned: 2.9.13
Compared with: 2.9.12 (0 signals introduced since)
Files: 159 scanned, 20 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 5.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 03:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info identifier-low-length psycopg/aix_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length psycopg/solaris_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info ~~critical~~ → info by review dynamic-execution scripts/build/strip_wheel.sh:39:1

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
Dependencies versions of '_psycopg.so' library:"
"${dir}/print_so_versions.sh" "$(find . -name \*_psycopg\*.so)"

find . -name \*.so -exec strip "$@" {} \;
```
likely benign LLM, confidence 0.93 Build script that runs a sibling helper script and strips shared libraries after a wheel build.
Reasoning
Snippet is a standard psycopg build script: dir is set from a script-location computation and invoked as a helper; the strip and find usage is typical wheel-building. The dynamic command is a normal bash idiom for calling sibling scripts, not obfuscation.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:16:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    alpine)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 Build hook that invokes a local libpq build script per Linux distribution.
Reasoning
The variable command runs build_libpq.sh from a directory variable within a distro case statement, consistent with cibuildwheel setup for Alpine. Legitimate build orchestration.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:38:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    centos | rocky | almalinux)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 Build hook invoking local libpq build script for RPM-based distributions.
Reasoning
Same pattern as the other finding in this file, invoking the bundled build_libpq.sh for CentOS/Rocky/Alma. The helper path is local to the repository and not fetched from elsewhere.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:15:1

command name is a variable (`$prjdir`) and `prjdir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
# Build dependency libraries
"${prjdir}/scripts/build/build_libpq.sh" > /dev/null

# Show dependency tree
```
likely benign LLM, confidence 0.92 macOS wheel build step calling the bundled libpq build script.
Reasoning
Runs a project-local build_libpq.sh via a project-directory variable in a macOS wheel build. Standard build tooling; the variable is derived from the repo location.
info ~~warn~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:28:3

`eval` called on a string literal (ast pass, confidence 0.85)
```
for i in $(seq 10 -1 0); do
  eval pg_isready && break
  if [ $i == 0 ]; then
      echo "PostgreSQL service not ready, giving up"
```
likely benign LLM, confidence 0.85 CI retry loop waiting for a PostgreSQL service using a needlessly eval'd command.
Reasoning
eval on the literal 'pg_isready' is a harmless, odd construction in a retry loop waiting for PostgreSQL to start in CI. It is poor style but does not execute attacker-controlled content.

info whitespace-anomaly tests/dbapi20.py:4:1

file mixes tab and space indentation (1 tab-indented and 707 space-indented lines) (raw pass, confidence 0.40)


    This software is Public Domain and may be used without restrictions.

 "Now we have booze and barflies entering the discussion, plus rumours of

info ~~warn~~ → info by review encoding-hex tests/test_types_extras.py:446:13

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        ok('(,"\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f'
           '\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !'
           '""#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]'
           '^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f")',
```
likely benign LLM, confidence 0.90 Test expectation string containing a sequence of ASCII and control-character hex escapes.
Reasoning
A test fixture spells out control bytes and ASCII as hex escapes to check COPY/composite text escaping. The hex run is an expected literal in a test of byte handling, not an encoded payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/psycopg/psycopg2 psycopg2 && cd psycopg2
git checkout 2.9.13
disclude scan --severity info --diff 2.9.12 .