typing-inspection 0.4.4

Source: https://github.com/pydantic/typing-inspection
Tag scanned: v0.4.4
Compared with: v0.4.3 (0 signals introduced since)
Files: 19 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution build-docs.sh:9:1

pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
curl -LsSf https://astral.sh/uv/install.sh | sh
uv python install 3.13
uv sync --python 3.13 --frozen --group docs
```
likely benign LLM, confidence 0.80 Installs the uv package manager by piping its official install script from astral.sh into sh.
Reasoning
This is the official uv installer, fetched over HTTPS from astral.sh, the project's own domain. Piping a remote install script into sh is a known supply-chain risk, but it is the documented install method for uv and the rest of the script uses uv normally. Nothing here is obfuscated or hides intent.
info ~~warn~~ → info by review dynamic-execution src/typing_inspection/typing_objects.py:112:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    locals_: dict[str, Any] = {}
    exec(func_code, globals_, locals_)
    return locals_[function_name]
```
likely benign LLM, confidence 0.80 Executes generated function source code via exec to build a typing helper function and returns it by name.
Reasoning
This is the typing-inspection library, which builds small helper functions from source text and runs them with exec. The code string is assembled inside the module from fixed templates and names rather than external input. The exec call is not literal, which justifies the warning, but the pattern is a known metaprogramming technique in typing utilities and nothing suggests attacker-controlled input.
info ~~warn~~ → info by review dynamic-execution src/typing_inspection/typing_objects.py:153:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    locals_: dict[str, Any] = {}
    exec(func_code, globals_, locals_)
    return locals_[function_name]
```
likely benign LLM, confidence 0.80 Executes generated function source code via exec to construct a second typing helper function and returns it by name.
Reasoning
This is the same exec-based helper-generation pattern as the other finding in this file, with the same structure and no sign of external input or encoded payloads. It is a legitimate, if unusual, technique for building functions with specific signatures in a typing library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pydantic/typing-inspection typing-inspection && cd typing-inspection
git checkout v0.4.4
disclude scan --severity info --diff v0.4.3 .