zstandard 0.25.0

Source: https://github.com/indygreg/python-zstandard
Tag scanned: 0.25.0
Compared with: 0.24.0 (1 signals introduced since)
Files: 107 scanned, 20 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 7.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 11 of 11 warn and critical signals; 11 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex tests/test_compressor_compress.py:201:15 new in this release

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            result,
            b"\x28\xb5\x2f\xfd\x23\x27\x42\xfc\x42\x03\x19\x00\x00\x66\x6f\x6f",
        )
```
likely benign LLM, confidence 0.90 Test expected-output bytes for zstd compression.
Reasoning
Hex-escaped zstd frame bytes used as expected output in a compression test.
info ~~warn~~ → info by review decoder-decompress-payload bench.py:354:9

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        zctx = zstd.ZstdDecompressor(**opts)
        zctx.decompress(chunk)
```
likely benign LLM, confidence 0.85 Benchmark code calling zstd decompress on a data chunk.
Reasoning
This is a zstd benchmark script calling decompress on data chunks it reads; decompression of input data is the normal purpose of the tool, not a hidden payload.
info ~~warn~~ → info by review dynamic-execution ci/conda/build.sh:5:1

command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
$PYTHON setup.py install
```
likely benign LLM, confidence 0.80 Conda build step invoking the Python interpreter from the build environment.
Reasoning
Conda build script runs $PYTHON setup.py install; the interpreter variable is set by conda-build, a standard pattern.
info ~~warn~~ → info by review encoding-hex tests/test_compressor_chunker.py:133:19

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            [
                b"\x28\xb5\x2f\xfd\x00\x58\x8c\x00\x00\x30\x66\x6f\x6f\x62\x61\x72"
                b"\x02\x00\xfa\x03\xfe\xd0\x9f\xbe\x1b\x02"
            ],
```
likely benign LLM, confidence 0.90 Test fixture bytes for a zstd compressed frame.
Reasoning
Hex escapes form a zstd frame header with 'foobar' text in a test fixture; expected binary test vectors.
info ~~warn~~ → info by review payload-bytes-literal tests/test_compressor_stream_writer.py:539:13

concatenated bytes literal contains 43 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            # Frame 1.
            b"\x28\xb5\x2f\xfd\x00\x58\x75\x00\x00\x30\x66\x6f\x6f"
            b"\x62\x61\x72\x01\x00\xf7\xbf\xe8\xa5\x08"
            # Frame 2.
```
likely benign LLM, confidence 0.88 Test fixture of multi-frame zstd binary data.
Reasoning
Concatenated bytes literal is a zstd frame fixture with comments labeling frames; standard test data for the python-zstandard library.
info ~~warn~~ → info by review dynamic-execution tests/test_decompressor_decompress.py:162:14

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
    def test_max_window_size(self):
        with open(__file__, "rb") as fh:
            source = fh.read()
```
likely benign LLM, confidence 0.85 Test reading its own file as input data.
Reasoning
Test reads its own source as an input file for a max window size test; no extraction of hidden payloads from comments is evident.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:5587:46

two identifiers collapse to visual skeleton `to` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
                                           * to preserve host's memory from unreasonable requirements.
                                           * This limit can be overridden using ZSTD_DCtx_setParameter(,ZSTD_d_windowLogMax,).
```
dismissed LLM, confidence 0.92 Comment text flagged for visually confusable identifiers in zstd documentation.
Reasoning
Confusable collision is an artifact of comparing English words in comments/docs; 'to' appears as normal prose, a raw-style false positive of identifier skeletoning.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:11333:9

two identifiers collapse to visual skeleton `do` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
        do {
            v1 = XXH32_round(v1, XXH_get32bits(input)); input += 4;
            v2 = XXH32_round(v2, XXH_get32bits(input)); input += 4;
```
dismissed LLM, confidence 0.92 Standard do-while loop in xxhash code flagged by skeleton collision.
Reasoning
'do' is the C keyword in a standard XXH32 loop; the skeleton collision is spurious.
info ~~warn~~ → info by review macro-keyword-override zstd/zstd.c:12005:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
   || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
#    define inline __inline__  /* circumvent a clang bug */
#    include <arm_neon.h>
#    undef inline
```
likely benign LLM, confidence 0.85 Temporary workaround redefining inline around an arm_neon include.
Reasoning
The inline macro redefinition is a known workaround for a clang bug when including arm_neon.h, guarded and undone immediately; legitimate compatibility code.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:12890:23

two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    XXH_ASSERT(9 <= len && len <= 16);
    {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
        xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
        xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
```
dismissed LLM, confidence 0.90 Ordinary xxhash bitflip local variables flagged by skeleton collision.
Reasoning
Local variable names bitflip1/bitflip2 are ordinary; the skeleton collision is a false positive from normal xxhash code.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:24208:27

two identifiers collapse to visual skeleton `d|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
{
    ZSTD_localDict* const dl = &cctx->localDict;
    if (dl->dict == NULL) {
        /* No local dictionary. */
```
dismissed LLM, confidence 0.90 Local dictionary pointer code flagged by skeleton collision.
Reasoning
Identifier 'dl' and its neighbor are normal short names in zstd local dictionary code; collision is spurious.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/indygreg/python-zstandard python-zstandard && cd python-zstandard
git checkout 0.25.0
disclude scan --severity info --diff 0.24.0 .