psycopg2-binary 2.9.13

Source: https://github.com/psycopg/psycopg2
Artifact scanned: psycopg2_binary-2.9.13.tar.gz (sdist · 369.2 KB · SHA-256 e324ecf60f95…)
Compared with: psycopg2_binary-2.9.12.tar.gz (0 signals introduced since)
Files: 160 scanned, 17 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 5.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 06:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info identifier-low-length psycopg/aix_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length psycopg/solaris_support.c:1:1

24 of 60 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info ~~critical~~ → info by review dynamic-execution scripts/build/strip_wheel.sh:39:1

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
Dependencies versions of '_psycopg.so' library:"
"${dir}/print_so_versions.sh" "$(find . -name \*_psycopg\*.so)"

find . -name \*.so -exec strip "$@" {} \;
```
likely benign LLM, confidence 0.93 Build script invokes a helper script located via a directory variable and strips shared libraries.
Reasoning
This is a psycopg build script. The variable command ${dir}/print_so_versions.sh is a sibling script resolved from the script's own directory, and find output is only passed as an argument. Standard build tooling pattern, not malicious.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:16:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    alpine)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 Runs a local libpq build helper chosen by OS case branch, with path derived from the script directory.
Reasoning
The dir variable is computed from the script location and used to run build_libpq.sh, a sibling build helper. This is ordinary cibuildwheel setup logic in a database driver repository.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_linux_before_all.sh:38:9

command name is a variable (`$dir`) and `dir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
    centos | rocky | almalinux)
        "${dir}/build_libpq.sh" > /dev/null
        ;;
```
likely benign LLM, confidence 0.93 Runs the libpq build helper for RHEL-family distributions via a script-relative directory variable.
Reasoning
Same pattern as the alpine branch: a sibling build script invoked via a script-relative directory variable in the centos/rocky/almalinux branch. Legitimate build logic.
info ~~critical~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:15:1

command name is a variable (`$prjdir`) and `prjdir` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
# Build dependency libraries
"${prjdir}/scripts/build/build_libpq.sh" > /dev/null

# Show dependency tree
```
likely benign LLM, confidence 0.92 macOS wheel build hook invokes the project's libpq build script via a project-directory variable.
Reasoning
prjdir is the project directory used to call the repository's own build_libpq.sh during macOS wheel building. Expected behavior of a build hook, with no network fetch or decoding shown.
info ~~warn~~ → info by review dynamic-execution scripts/build/wheel_macos_before_all.sh:28:3

`eval` called on a string literal (ast pass, confidence 0.85)
```
for i in $(seq 10 -1 0); do
  eval pg_isready && break
  if [ $i == 0 ]; then
      echo "PostgreSQL service not ready, giving up"
```
likely benign LLM, confidence 0.85 Retry loop in CI waits for PostgreSQL readiness, using an unnecessary eval on a fixed command.
Reasoning
eval is applied to the literal pg_isready in a retry loop waiting for PostgreSQL to start in CI. It is pointless but harmless and contains no obfuscated or attacker-controlled content.

info whitespace-anomaly tests/dbapi20.py:4:1

file mixes tab and space indentation (1 tab-indented and 707 space-indented lines) (raw pass, confidence 0.40)


    This software is Public Domain and may be used without restrictions.

 "Now we have booze and barflies entering the discussion, plus rumours of

info ~~warn~~ → info by review encoding-hex tests/test_types_extras.py:446:13

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        ok('(,"\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f'
           '\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !'
           '""#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]'
           '^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f")',
```
likely benign LLM, confidence 0.95 Unit test literal containing a sequence of byte escapes used as composite-type test input.
Reasoning
This is a test for PostgreSQL composite record parsing that deliberately feeds all control and printable ASCII bytes through escape sequences. The hex escapes are the test data itself, so the entropy hit is a false positive from a raw pass.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o psycopg2_binary-2.9.13.tar.gz https://files.pythonhosted.org/packages/ed/76/7b4383014be0fcc6c1c0e24292845a14e1672cf17fca62ca0a2bd5f4563d/psycopg2_binary-2.9.13.tar.gz
printf '%s  %s\n' e324ecf60f952d21dd11413b8bbed0951bbd99579a06fd06f28bfc37737cd373 psycopg2_binary-2.9.13.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf psycopg2_binary-2.9.13.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg