PyPI / alembic / 1.20.1

alembic 1.20.1

Source

https://github.com/sqlalchemy/alembic

Artifact scanned

alembic-1.20.1-py3-none-any.whl (wheel · 264.0 KB · SHA-256 9970712cfb81…)

Compared with

alembic-1.20.0-py3-none-any.whl (0 signals introduced since)

Files

81 scanned, 22 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 07:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute alembic/autogenerate/render.py:943:18

   reach-by-name through `globals` (ast pass, confidence 0.60)

           if "_render_%s_type" % type_.__visit_name__ in globals():
               fn = globals()["_render_%s_type" % type_.__visit_name__]
               return fn(type_, autogen_context)
           else:

   likely benign LLM, confidence 0.93 Dispatches type rendering to a module-level _render_<visit_name>_type function via globals lookup.

   Reasoning

   The code looks up a module-level render function by a name built from the type's visit name, a common dispatch idiom. The name is derived from SQLAlchemy type metadata, not untrusted input, so there is no attacker-controlled execution path.

2. info warn → info by review dynamic-execution alembic/operations/base.py:185:13

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

   
               exec(func_text, globals_, lcl)
               setattr(cls, name, lcl[name])
               fn.__func__.__doc__ = (

   likely benign LLM, confidence 0.85 Builds Alembic operation method wrappers by exec-ing internally generated source text and attaching them to the class.

   Reasoning

   This is Alembic's operation-generation helper that builds wrapper functions from generated source text and attaches them to the class. The text is produced internally from the library's own function signatures, and the exec is used for signature-preserving wrappers, which is a known legitimate pattern. Still, exec on generated text is a dynamic execution pattern worth noting.

3. info warn → info by review dynamic-execution alembic/util/langhelpers.py:214:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

   
           exec(func_text, cast("Dict[str, Any]", globals_), lcl)
           return cast("Callable[..., Any]", lcl[name])

   likely benign LLM, confidence 0.85 Compiles a generated function from source text via exec and returns it, a signature-preserving helper in Alembic utilities.

   Reasoning

   This is a helper that compiles a generated function body with exec into a local namespace and returns the named function, used to create functions with specific signatures. The source text comes from the library itself, not from external input, so it matches a legitimate code-generation idiom.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o alembic-1.20.1-py3-none-any.whl https://files.pythonhosted.org/packages/11/3c/8740f5b4e1bd57333e4f84265b9b6363da4f7cf70f5622dd1e2fde7a0bd5/alembic-1.20.1-py3-none-any.whl
printf '%s  %s\n' 9970712cfb81ea26c8658d378aaa5b8f6ff9146e5bb111d70497c164016cf598 alembic-1.20.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q alembic-1.20.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg