python-discovery 1.6.3

Source: https://github.com/tox-dev/python-discovery
Tag scanned: 1.6.3
Compared with: 1.6.2 (0 signals introduced since)
Files: 46 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 17:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/windows/conftest.py:45:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    mock_value_str = (Path(__file__).parent / "winreg_mock_values.py").read_text(encoding="utf-8")
    exec(mock_value_str, glob, loc)  # ruff:ignore[exec-builtin]
    return loc["enum_collect"], loc["value_collect"], loc["key_open"], loc["hive_open"]  # ty: ignore[invalid-return-type]
```
likely benign LLM, confidence 0.93 Test conftest execs a sibling in-repo mock-definitions file to build winreg mock functions.
Reasoning
The exec call runs the contents of a sibling test fixture file (winreg_mock_values.py) read from the same directory via Path(__file__).parent. It is a test helper that builds mock winreg functions into a namespace, with an explicit lint-suppression comment. The argument is non-literal but comes from a trusted, in-repo test file, not from network input or an encoded payload. This is a legitimate test-harness pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/python-discovery python-discovery && cd python-discovery
git checkout 1.6.3
disclude scan --severity info --diff 1.6.2 .