PyPI / billiard / 4.3.2

billiard 4.3.2

Source

https://github.com/celery/billiard

Artifact scanned

billiard-4.3.2-py3-none-any.whl (wheel · 88.5 KB · SHA-256 37735a7b4117…)

Compared with

billiard-4.3.1-py3-none-any.whl (0 signals introduced since)

Files

30 scanned, 3 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

6.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-11-02 09:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution billiard/context.py:69:26

   `os.popen` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                   try:
                       with os.popen(comm) as p:
                           num = int(p.read())
                   except ValueError:

   likely benign LLM, confidence 0.85 os.popen runs a platform command to query the CPU count.

   Reasoning

   This is a CPU-count probe that runs a fixed system utility (such as sysctl or getconf) and parses an integer from its output. The command comes from an internal constant, not from untrusted input, and the ValueError handler fits a numeric parse. The non-literal argument is a false positive from the static pattern.

2. info critical → info by review dynamic-import billiard/forkserver.py:151:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(modname)
               except ImportError:
                   pass

   likely benign LLM, confidence 0.85 __import__ loads a configured module name for forkserver preloading.

   Reasoning

   The import sits in a try/except ImportError and is used to preload modules named in a list supplied by the multiprocessing configuration. Dynamic import of configured module names is a normal forkserver pattern, and nothing in the snippet is decoded or fetched from outside.

3. info warn → info by review dynamic-execution billiard/managers.py:889:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       for meth in exposed:
           exec('''def %s(self, *args, **kwds):
           return self._callmethod(%r, args, kwds)''' % (meth, meth), dic)

   likely benign LLM, confidence 0.90 exec generates proxy method wrappers for exposed manager methods.

   Reasoning

   This is the standard multiprocessing manager idiom: it generates proxy method bodies from a fixed list of exposed method names, using %s and %r formatting. The exec input is developer-controlled and no untrusted data reaches it.

4. info warn → info by review dynamic-execution billiard/sharedctypes.py:169:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

           d = {}
           exec(template % ((name, ) * 7), d)
           prop_cache[name] = d[name]
           return d[name]

   likely benign LLM, confidence 0.90 exec builds synchronized ctypes property accessors from a template.

   Reasoning

   This is the stdlib ctypes pattern for building synchronized property accessors from a fixed template, with the field name substituted in. The template is internal and the exec is not fed external input.

5. info critical → info by review dynamic-import billiard/spawn.py:78:19

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   
           project = __import__(project_name)
           try:
               project_dir = os.path.normpath(_module_parent_dir(project))

   likely benign LLM, confidence 0.88 __import__ loads the main project module while preparing a spawned child process.

   Reasoning

   The module is imported by name while the parent process prepares a spawned child, which is how multiprocessing spawn locates the __main__ project directory. The name comes from the running program's own main module, so this is expected behaviour.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o billiard-4.3.2-py3-none-any.whl https://files.pythonhosted.org/packages/21/05/3d445479b3f7e4ae0901cdf2c45f561b436d1a5b8ed1c5c97e260152ae50/billiard-4.3.2-py3-none-any.whl
printf '%s  %s\n' 37735a7b4117aafa73532b3b493db4c02fb85c0e69d5f3447f113fd30ff27872 billiard-4.3.2-py3-none-any.whl | shasum -a 256 -c -
unzip -q billiard-4.3.2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg