python-dateutil 2.9.0

Source: https://github.com/dateutil/dateutil
Tag scanned: 2.9.0
Compared with: 2.8.2 (0 signals introduced since)
Files: 64 scanned, 12 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 2.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 20:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution ci_tools/retry.sh:6:5

command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
for i in `seq 1 $n_retries`; do
    "$@" && exit 0
    sleep $sleep_time
done
```
likely benign LLM, confidence 0.93 A bash retry helper in a CI tools directory that re-runs whatever command it is given a set number of times.
Reasoning
The snippet is a standard retry wrapper: it loops a fixed number of times, runs the passed-in command, exits on success, and sleeps between attempts. Running "$@" is the intended behavior of a generic retry helper in CI tooling. The flagged signal is a generic dynamic-execution heuristic that fires on any pass-through of arguments, and nothing here is encoded, hidden, or fetched from elsewhere. It is benign.
info dynamic-execution ci_tools/run_tz_master_env.sh:88:1

command name is a variable (`$CITOOLS_DIR`) that this file sets only to plain text (ast pass, confidence 0.40)
```
ZONEFILE_METADATA_NAME=zonefile_metadata_master.json
${CITOOLS_DIR}/make_zonefile_metadata.py \
    $TARBALL_NAME \
    $VERSION \
```
info identifier-low-length src/dateutil/easter.py:1:1

26 of 54 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)

info unicode-homoglyph tests/test_isoparser.py:268:17

identifier `Т12` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)

    ('2013366', ValueError),                    # Invalid ordinal day
    ('2014-03-12Т12:30:14', ValueError),        # Cyrillic T
    ('2014-04-21T24:00:01', ValueError),        # Invalid use of 24 for midnight
    ('2014_W01-1', ValueError),                 # Invalid separator

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/dateutil/dateutil dateutil && cd dateutil
git checkout 2.9.0
disclude scan --severity info --diff 2.8.2 .