PyPI / beautifulsoup4 / 4.15.0

beautifulsoup4 4.15.0

Artifact scanned

beautifulsoup4-4.15.0-py3-none-any.whl (wheel · 107.3 KB · SHA-256 d6f88de62e1d…)

Compared with

beautifulsoup4-4.14.3-py3-none-any.whl (1 signals introduced since)

Files

15 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 04:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection bs4/element.py:1330:26 new in this release

   `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

           stacklevel = 0
           for frameinfo in inspect.stack(context=0):
               if (frameinfo.frame is not None
                   and frameinfo.frame.f_globals is not None

   likely benign LLM, confidence 0.95 BeautifulSoup walks the call stack with inspect.stack to determine the correct warning stacklevel.

   Reasoning

   inspect.stack(context=0) iterated to compute a warnings stacklevel, skipping frames inside the bs4 package. This is ordinary library code for warning attribution with no execution, network, or obfuscation involved.

2. info warn → info by review frame-introspection bs4/__init__.py:402:30

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

                   try:
                       caller = sys._getframe(1)
                   except ValueError:
                       pass

   likely benign LLM, confidence 0.95 BeautifulSoup retrieves the immediate caller frame via sys._getframe to attribute warnings.

   Reasoning

   sys._getframe(1) inside a try/except ValueError is a standard idiom in BeautifulSoup to find the caller's module for warning stacklevel. No network, decoding, or process spawning; it is legitimate introspection used for warnings.

3. info unicode-zero-width bs4/dammit.py:1253:31

   U+00AD SOFT HYPHEN in source (in string/comment) (raw pass, confidence 0.45)

           0xAC: b"\xc2\xac",  # ¬
           0xAD: b"\xc2\xad",  # ⟨U+00AD⟩
           0xAE: b"\xc2\xae",  # ®
           0xAF: b"\xc2\xaf",  # ¯

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o beautifulsoup4-4.15.0-py3-none-any.whl https://files.pythonhosted.org/packages/88/c6/92fcd42f1ba33e1184263f25bfabf3d27c383410470f169e4b8163bf9c17/beautifulsoup4-4.15.0-py3-none-any.whl
printf '%s  %s\n' d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9 beautifulsoup4-4.15.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q beautifulsoup4-4.15.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg