PyPI / anyio / 4.15.1

anyio 4.15.1

Source

https://github.com/agronholm/anyio

Tag scanned

4.15.1

Compared with

4.15.0 (0 signals introduced since)

Files

105 scanned, 3 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 7 info

Scan time

6.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 21:04

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review frame-introspection src/anyio/_lazyimport.py:19:22

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

   def install_lazy_importer() -> bool:
       module_globals = sys._getframe(1).f_globals
       module_name = module_globals["__name__"]
       module_prefix = module_name + "."

   likely benign LLM, confidence 0.93 Caller-globals access inside anyio's lazy-import helper.

   Reasoning

   sys._getframe(1).f_globals is the standard technique for lazy-import installers that set module-level __getattr__ in the caller's namespace. Flagged only because the file also contains exec/eval-like shape; the context is a well-known anyio utility with no network, encoding, or payload behavior.

2. info critical → info by review frame-introspection src/anyio/_lazyimport.py:71:22

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

   def fix_package_names() -> None:
       module_globals = sys._getframe(1).f_globals
       module_prefix = module_globals["__name__"] + "."
       del module_globals[fix_package_names.__name__]

   likely benign LLM, confidence 0.93 Frame globals access used to fix package names in anyio's lazy importer.

   Reasoning

   Retrieves caller globals to rewrite package names and delete a helper function reference, a normal cleanup pattern in lazy-import code. No malicious indicators.

3. info critical → info by review frame-introspection src/anyio/_lazyimport.py:92:22

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

   def set_deprecated_aliases(aliases: dict[str, str]) -> None:
       module_globals = sys._getframe(1).f_globals
       module_name = module_globals["__name__"]
       del module_globals[set_deprecated_aliases.__name__]

   likely benign LLM, confidence 0.93 Frame globals access used to register deprecated aliases in anyio.

   Reasoning

   Caller globals used to install deprecated aliases and remove the helper name. Standard module-management code in a legitimate library.

4. info warn → info by review dynamic-execution src/anyio/_lazyimport.py:120:12

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

   
       tree = compile(source, module.__file__ or "", "exec", ast.PyCF_ONLY_AST)
       assert isinstance(tree, ast.Module)
       out: dict[str, tuple[str, str]] = {}

   likely benign LLM, confidence 0.85 Parses a module's source file into an AST for static inspection.

   Reasoning

   compile with ast.PyCF_ONLY_AST parses a module's source into an AST for static analysis of imports (for lazy import checking). It does not execute the code, so the non-literal argument is expected here.

5. info warn → info by review decoder-import-with-exec src/anyio/to_interpreter.py:71:17

   file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)

   
       _run_func = compile(
           """
   import _interpqueues

   likely benign LLM, confidence 0.85 Compiles a bootstrap script run in a subinterpreter for anyio's to_interpreter feature.

   Reasoning

   compile of a triple-quoted string containing code for running in a subinterpreter via _interpqueues. This is a legitimate way to bootstrap a subinterpreter worker; the pickle import is for passing data between interpreters. The snippet shows no encoded blob or download, so the multi-stage dropper reading is weak.

6. info warn → info by review frame-introspection tests/conftest.py:178:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

       def no_other_refs() -> list[object]:
           return [sys._getframe(1).f_generator]
   
   elif sys.version_info >= (3, 11):

   likely benign LLM, confidence 0.90 Test helper that retrieves a generator frame to verify no lingering references.

   Reasoning

   Test helper returning the generator frame reference to check for leaked references in tests. Standard test utility for garbage-collection checks.

7. info warn → info by review frame-introspection tests/conftest.py:187:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

       def no_other_refs() -> list[object]:
           return [sys._getframe(1)]

   likely benign LLM, confidence 0.90 Test helper capturing a frame to check for reference leaks.

   Reasoning

   Test helper returning the current frame to check reference cycles in tests. Standard testing practice with no malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/agronholm/anyio anyio && cd anyio
git checkout 4.15.1
disclude scan --severity info --diff 4.15.0 .