PyPI / smmap / 5.0.3

smmap 5.0.3

Source

https://github.com/gitpython-developers/smmap

Tag scanned

v5.0.3

Compared with

v5.0.2 (0 signals introduced since)

Files

20 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution build-release.sh:9:5

   command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   function release_with() {
       $1 -m build --sdist --wheel
   }

   likely benign LLM, confidence 0.85 A bash helper function executes a caller-supplied command name ($1) with python build arguments to produce sdist and wheel packages.

   Reasoning

   The snippet is a small helper that runs whatever command the caller passes as $1, then invokes it with python-style build flags (-m build --sdist --wheel). This looks like a generic wrapper that lets the caller choose the Python interpreter (e.g., python3, uv run python). The flagged pattern is dynamic command invocation, but the argument is supplied by the caller rather than fetched from an external or encoded source, and the behavior matches a normal release build script. Residual doubt remains because the caller is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/gitpython-developers/smmap smmap && cd smmap
git checkout v5.0.3
disclude scan --severity info --diff v5.0.2 .