zstandard 0.25.0

Source: https://github.com/indygreg/python-zstandard
Artifact scanned: zstandard-0.25.0.tar.gz (sdist · 694.8 KB · SHA-256 7713e1179d16…)
Compared with: zstandard-0.24.0.tar.gz (1 signals introduced since)
Files: 87 scanned, 17 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex tests/test_compressor_compress.py:201:15 new in this release

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            result,
            b"\x28\xb5\x2f\xfd\x23\x27\x42\xfc\x42\x03\x19\x00\x00\x66\x6f\x6f",
        )
```
likely benign LLM, confidence 0.95 Test asserting against a precomputed zstd frame.
Reasoning
Expected compressed output bytes (zstd magic and frame) asserted in a compression test; legitimate test data.
info ~~warn~~ → info by review encoding-hex tests/test_compressor_chunker.py:133:19

16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
            [
                b"\x28\xb5\x2f\xfd\x00\x58\x8c\x00\x00\x30\x66\x6f\x6f\x62\x61\x72"
                b"\x02\x00\xfa\x03\xfe\xd0\x9f\xbe\x1b\x02"
            ],
```
likely benign LLM, confidence 0.95 Test fixture containing a literal zstd-compressed byte sequence.
Reasoning
Hex escapes form a zstd frame header in a test fixture for compressed data; expected in a compression library's test suite.
info ~~warn~~ → info by review payload-bytes-literal tests/test_compressor_stream_writer.py:539:13

concatenated bytes literal contains 43 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
            # Frame 1.
            b"\x28\xb5\x2f\xfd\x00\x58\x75\x00\x00\x30\x66\x6f\x6f"
            b"\x62\x61\x72\x01\x00\xf7\xbf\xe8\xa5\x08"
            # Frame 2.
```
likely benign LLM, confidence 0.93 Test fixture holding multi-frame zstd binary data.
Reasoning
Concatenated bytes literal is a zstd frame sequence with comments labeling frames; expected test data for a streaming compressor, not a dropper.
info ~~warn~~ → info by review dynamic-execution tests/test_decompressor_decompress.py:162:14

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
    def test_max_window_size(self):
        with open(__file__, "rb") as fh:
            source = fh.read()
```
likely benign LLM, confidence 0.93 Test that reads the file's own bytes as input data.
Reasoning
Test reads its own source to check a max window size behavior; no payload extraction or execution occurs in the snippet.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:5587:46

two identifiers collapse to visual skeleton `to` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
                                           * to preserve host's memory from unreasonable requirements.
                                           * This limit can be overridden using ZSTD_DCtx_setParameter(,ZSTD_d_windowLogMax,).
```
likely benign LLM, confidence 0.93 Comment text in vendored zstd flagged by confusable skeleton heuristic.
Reasoning
Confusable collision on words in a comment ('to' with a homoglyph-like skeleton); typical of prose in vendored zstd docs, not identifier obfuscation.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:11333:9

two identifiers collapse to visual skeleton `do` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
        do {
            v1 = XXH32_round(v1, XXH_get32bits(input)); input += 4;
            v2 = XXH32_round(v2, XXH_get32bits(input)); input += 4;
```
likely benign LLM, confidence 0.85 Ordinary do-while loop in vendored xxhash code.
Reasoning
Standard do-while loop in XXH32 implementation; the skeleton collision is a false positive from the heuristic on ordinary identifiers.
info ~~warn~~ → info by review macro-keyword-override zstd/zstd.c:12005:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
   || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
#    define inline __inline__  /* circumvent a clang bug */
#    include <arm_neon.h>
#    undef inline
```
likely benign LLM, confidence 0.85 Compatibility macro around a NEON header include in vendored xxhash.
Reasoning
Temporary #define inline __inline__ around an arm_neon.h include with #undef afterward is a known compatibility workaround in xxhash; benign in context, though it does rebind a keyword.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:12890:23

two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    XXH_ASSERT(9 <= len && len <= 16);
    {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
        xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
        xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
```
likely benign LLM, confidence 0.85 Standard XXH3 bitflip local variables in vendored hashing code.
Reasoning
Local variables bitflip1/bitflip2 share a skeleton with bitflip-like names; ordinary XXH3 hashing code, heuristic false positive.
info ~~warn~~ → info by review identifier-confusable-collision zstd/zstd.c:24208:27

two identifiers collapse to visual skeleton `d|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
{
    ZSTD_localDict* const dl = &cctx->localDict;
    if (dl->dict == NULL) {
        /* No local dictionary. */
```
likely benign LLM, confidence 0.85 Ordinary local dictionary pointer in vendored zstd source.
Reasoning
Local variable dl pointing at a local dictionary struct; the collision with a neighboring identifier is a heuristic artifact in ordinary zstd code.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o zstandard-0.25.0.tar.gz https://files.pythonhosted.org/packages/fd/aa/3e0508d5a5dd96529cdc5a97011299056e14c6505b678fd58938792794b1/zstandard-0.25.0.tar.gz
printf '%s  %s\n' 7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b zstandard-0.25.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf zstandard-0.25.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg