python-discovery 1.6.4

Source: https://github.com/tox-dev/python-discovery
Tag scanned: 1.6.4
Compared with: 1.6.3 (0 signals introduced since)
Files: 44 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 04:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/windows/conftest.py:45:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    mock_value_str = (Path(__file__).parent / "winreg_mock_values.py").read_text(encoding="utf-8")
    exec(mock_value_str, glob, loc)  # ruff:ignore[exec-builtin]
    return loc["enum_collect"], loc["value_collect"], loc["key_open"], loc["hive_open"]  # ty: ignore[invalid-return-type]
```
likely benign LLM, confidence 0.93 Test conftest execs a local companion mock file to build winreg mock functions.
Reasoning
The exec reads a sibling test fixture file (winreg_mock_values.py) located next to conftest.py via Path(__file__).parent and executes it to populate mock functions for winreg testing. The ruff ignore comment indicates the developer deliberately acknowledged the exec. This is a test harness loading its own companion mock source, not obfuscated or hidden code; the source is a local, version-controlled file rather than attacker-controlled input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/tox-dev/python-discovery python-discovery && cd python-discovery
git checkout 1.6.4
disclude scan --severity info --diff 1.6.3 .