PyPI · pypi.org

hgitaly

Py Import Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 19.0.1

Severity	Signal	Evidence
medium	Py Import Time Subprocess	subprocess call — process spawning. · hgitaly-19.0.1/functional_tests/__init__.py
medium	Credential file access	matched "aws_access_key" · hgitaly-19.0.1/heptapod/clone_bundles.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`19.0.1`	Review	12	2026-06-10
`19.0.0`	Review	12	2026-06-03
`18.11.4`	Review	21	2026-05-27

Block this in CI

PkgRadar gates hgitaly (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi hgitaly==19.0.1