python-discovery 1.6.2

Source: https://github.com/tox-dev/python-discovery
Tag scanned: 1.6.2
Compared with: 1.6.1 (0 signals introduced since)
Files: 44 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 1.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/windows/conftest.py:45:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    mock_value_str = (Path(__file__).parent / "winreg_mock_values.py").read_text(encoding="utf-8")
    exec(mock_value_str, glob, loc)  # ruff:ignore[exec-builtin]
    return loc["enum_collect"], loc["value_collect"], loc["key_open"], loc["hive_open"]  # ty: ignore[invalid-return-type]
```
likely benign LLM, confidence 0.93 Test fixture that exec()s a local mock-definitions file to build fake winreg functions for Windows tests.
Reasoning
The exec call runs the contents of a sibling test fixture file (winreg_mock_values.py) read from the same directory via Path(__file__).parent. This is a test helper that builds a mock winreg module for Windows registry tests; the exec target is a fixed local file, not attacker-controlled input or downloaded data. The ruff ignore comment and the type-checker ignore show the exec was a deliberate choice by developers. No encoding, network, or shell activity is present.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/python-discovery python-discovery && cd python-discovery
git checkout 1.6.2
disclude scan --severity info --diff 1.6.1 .