python-discovery 1.6.4

Source: https://github.com/tox-dev/python-discovery
Tag scanned: 1.6.4
Compared with: 1.6.3 (0 signals introduced since)
Files: 44 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 6.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 03:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/windows/conftest.py:45:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    mock_value_str = (Path(__file__).parent / "winreg_mock_values.py").read_text(encoding="utf-8")
    exec(mock_value_str, glob, loc)  # ruff:ignore[exec-builtin]
    return loc["enum_collect"], loc["value_collect"], loc["key_open"], loc["hive_open"]  # ty: ignore[invalid-return-type]
```
likely benign LLM, confidence 0.93 Test conftest execs a local mock-values file to construct fake winreg functions for Windows registry tests.
Reasoning
The exec call runs the contents of a sibling test fixture file (winreg_mock_values.py) read from the same directory via Path(__file__). It is a test helper that builds mock winreg functions into a namespace; the code is read from a fixed local file, not from network or encoded input. The ruff ignore comment indicates the authors intentionally accepted this. Benign test scaffolding pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/python-discovery python-discovery && cd python-discovery
git checkout 1.6.4
disclude scan --severity info --diff 1.6.3 .