watchdog 7.0.0

Source: https://github.com/gorakhargosh/watchdog
Artifact scanned: watchdog-7.0.0.tar.gz (sdist · 203.7 KB · SHA-256 128583e0ffa0…)
Compared with: watchdog-6.0.0.tar.gz (11 signals introduced since)
Files: 95 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 14 info
Scan time: 9.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 13 of 13 warn and critical signals; 13 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-31 08:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line changelog.rst:80:1 new in this release

line length 696 characters (raw pass, confidence 0.50)

- Thanks to our beloved contributors: @BoboTiG, @Corentin-pro, @Liam-DeVoe, @kirkhansen, @JoachimCoenen, @HaoZeke, @LincolnPuzey, @adicohen1005, @zastrowm, @ngoldbaum, @QWERTIOX, @cclauss, @blitztide, @nascheme, @Prosperibe12, @bysiber, @abra-code, @toroleapinc, @maxtaran2010, @gorakhargosh, @Sanjays2402, @prateek-daga

info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:68:11 new in this release

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    (venv)$ python -m pip install -r requirements-dev.txt
```
likely benign LLM, confidence 0.90 Developer-setup docs showing a pip install command in an embedded bash block.
Reasoning
This is a documentation code block showing a developer how to run pip inside a venv. The variable-looking command name is ordinary doc prose and nothing in the file runs it automatically.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:75:11 new in this release

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Run Ruff to check and format code
    (venv)$ python -m ruff format src tests docs/source/examples
    (venv)$ python -m ruff check --fix src tests docs/source/examples
```
likely benign LLM, confidence 0.90 Contributor docs showing Ruff lint and format commands.
Reasoning
The lines are standard Ruff format and check commands in contributor documentation. The flag reflects only a shell-style prompt in rst, not executable malicious logic.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:76:11 new in this release

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    (venv)$ python -m ruff format src tests docs/source/examples
    (venv)$ python -m ruff check --fix src tests docs/source/examples
```
likely benign LLM, confidence 0.90 Contributor docs showing Ruff check invocation.
Reasoning
Same ordinary contributor documentation of Ruff commands; the rst code block is passive text.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:82:11 new in this release

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    (venv)$ python -m mypy src docs/source/examples
```
likely benign LLM, confidence 0.90 Contributor docs showing a mypy invocation.
Reasoning
Documentation of a mypy type-check command for contributors. Benign prose in an rst file.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:89:11 new in this release

[embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Run pytest
    (venv)$ python -m pytest

    # Or run the entire suite using tox (if installed in your venv)
```
likely benign LLM, confidence 0.90 Contributor docs showing how to run pytest.
Reasoning
Documentation telling developers to run pytest; this is standard test instruction text with no hidden behaviour.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:92:11 new in this release

[embedded bash] command name is a variable (`$tox`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Or run the entire suite using tox (if installed in your venv)
    (venv)$ tox

    # Or run using uv without installing tox locally
```
likely benign LLM, confidence 0.90 Contributor docs mentioning running tox.
Reasoning
Doc text suggesting tox run; benign instructional content in an rst file.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:95:11 new in this release

[embedded bash] command name is a variable (`$uvx`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Or run using uv without installing tox locally
    (venv)$ uvx tox
```
likely benign LLM, confidence 0.90 Contributor docs showing uvx tox usage.
Reasoning
Doc text showing uvx tox as an alternative runner; standard developer guidance.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:102:11 new in this release

[embedded bash] command name is a variable (`$sphinx`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Build using sphinx-build directly
    (venv)$ sphinx-build -b html docs/source docs/build/html

    # Or build using tox via uv without installing tox locally
```
likely benign LLM, confidence 0.90 Contributor docs showing a sphinx-build command.
Reasoning
Documentation of a sphinx-build command to build HTML docs. Ordinary and not executed by the scanner target.
info ~~warn~~ → info by review dynamic-execution docs/source/hacking.rst:105:11 new in this release

[embedded bash] command name is a variable (`$uvx`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
    # Or build using tox via uv without installing tox locally
    (venv)$ uvx tox -e docs
```
likely benign LLM, confidence 0.90 Contributor docs showing uvx tox docs build.
Reasoning
Doc example of uvx tox -e docs for building docs; benign instructional text.
info ~~critical~~ → info by review dynamic-execution src/watchdog/tricks/__init__.py:158:24 new in this release

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        command = Template(command).safe_substitute(**context)
        self.process = subprocess.Popen(
            command,
            shell=True,
```
likely benign LLM, confidence 0.80 Watchdog trick that runs a user-configured shell command on file events.
Reasoning
This is the ExecuteCommand trick in watchdog, which by design runs a user-configured command on filesystem events. The command is supplied by the library user via a template and is not hidden or fetched remotely. shell=True with a user-supplied string is a known, documented design choice, though it carries injection risk if untrusted input reaches the template.
info ~~critical~~ → info by review dynamic-import src/watchdog/utils/__init__.py:130:9

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        __import__(module_name)
    except ImportError as e:
        error = f"No module named {module_name}"
```
likely benign LLM, confidence 0.80 Optional-module availability check using __import__ inside a try/except.
Reasoning
The __import__ call sits inside a try/except ImportError, which is the standard pattern for probing whether an optional module is available. The module name comes from the library's own code path, not from an encoded or hidden payload.
info ~~warn~~ → info by review dynamic-execution tests/shell.py:114:5

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
def mount_tmpfs(path):
    os.system(f"sudo mount -t tmpfs none {path}")
```
likely benign LLM, confidence 0.75 Test helper that runs sudo mount for a tmpfs using os.system.
Reasoning
This is a test helper that mounts a tmpfs via sudo. The shell string is built from a path argument, so it is an injection-prone pattern, but it lives in a test utility and has no obfuscation or hidden intent.
info ~~warn~~ → info by review dynamic-execution tests/shell.py:118:5

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
def unmount(path):
    os.system(f"sudo umount {path}")
```
likely benign LLM, confidence 0.75 Test helper that runs sudo umount using os.system.
Reasoning
Companion test helper that unmounts a path via sudo umount with os.system. Same test-only context, no malicious indicators.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o watchdog-7.0.0.tar.gz https://files.pythonhosted.org/packages/92/68/6477c65315fd5b58ea5c7fbfe871c3ca6e5ec951be6c48c2f5fe8ee5e34d/watchdog-7.0.0.tar.gz
printf '%s  %s\n' 128583e0ffa0e5c0531f9f37e2e24be1e7b0503561f6aa8b0aac5a1d646e2bf2 watchdog-7.0.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf watchdog-7.0.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg