celery 5.7.0rc1

Source: https://github.com/celery/celery
Artifact scanned: celery-5.7.0rc1-py3-none-any.whl (wheel · 496.0 KB · SHA-256 e45c9f755fc6…)
Compared with: celery-5.7.0b1-py3-none-any.whl (0 signals introduced since)
Files: 163 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 1 warn · 10 info
Scan time: 10.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 6 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 12:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn dynamic-execution celery/utils/functional.py:436:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Tasks are rarely, if ever, created at runtime - exec here is fine.
    exec(definition, namespace)
    result = namespace[name]
    result._source = definition
```
inconclusive LLM, confidence 0.55 Executes a source definition string in a namespace to build a task object and retain its source.
Reasoning
exec on a string definition is inherently dangerous if the input is untrusted. The comment indicates intentional dynamic task creation, and the caller is not shown. Whether the definition is attacker-controlled cannot be determined from the snippet.
info ~~critical~~ → info by review builtins-write celery/__init__.py:68:5

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        return real_import(name, locals, globals, fromlist, level)
    builtins.__import__ = debug_import

if TYPE_CHECKING:
```
likely benign LLM, confidence 0.70 Installs a wrapper around builtins.__import__ that logs imports and delegates to the real import function.
Reasoning
Replacing builtins.__import__ is a global side effect and warrants scrutiny. The surrounding code looks like an opt-in import-debugging wrapper that chains to real_import, which is a common legitimate debugging pattern. The guard controlling it isn't shown, so a doubt remains.
info ~~warn~~ → info by review frame-introspection celery/app/base.py:130:20

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame, level = sys._getframe(1), 1
    while frame is not None and frame_is_celery(frame):
        frame, level = frame.f_back, level + 1
```
likely benign LLM, confidence 0.92 Walks the call stack past celery's own frames to find the calling module.
Reasoning
sys._getframe(1) walking up while frames belong to celery is a standard way to find the caller's module for naming the app. Nothing here is hidden or malicious.

info unicode-homoglyph celery/canvas.py:330:37

identifier `сhord` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

    def on_chord_header_start(self, sig, **header) -> dict:
        """Method that is called on сhord header stamping start.

         Arguments:

info unicode-mixed-script celery/canvas.py:330:37

identifier `сhord` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

    def on_chord_header_start(self, sig, **header) -> dict:
        """Method that is called on сhord header stamping start.

         Arguments:

info unicode-homoglyph celery/canvas.py:343:37

identifier `сhord` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

    def on_chord_header_end(self, sig, **header) -> None:
        """Method that is called on сhord header stamping end.

           Arguments:

info unicode-mixed-script celery/canvas.py:343:37

identifier `сhord` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

    def on_chord_header_end(self, sig, **header) -> None:
        """Method that is called on сhord header stamping end.

           Arguments:

info ~~warn~~ → info by review frame-introspection celery/contrib/rdb.py:172:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # this raises a BdbQuit exception that we're unable to catch.
        sys.settrace(None)
```
likely benign LLM, confidence 0.92 Clears the trace function on exit from the remote pdb debugger.
Reasoning
This is the teardown of celery's remote debugger, which uses sys.settrace to stop tracing. It is a legitimate debugging facility.
info ~~critical~~ → info by review dynamic-import celery/local.py:462:22

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        if name in self._object_origins:
            module = __import__(self._object_origins[name], None, None,
                                [name])
            for item in self._all_by_module[module.__name__]:
```
likely benign LLM, confidence 0.90 Lazily imports a celery submodule named in an internal origins table when an attribute is first accessed.
Reasoning
The module name comes from the package's own _object_origins mapping, which implements lazy attribute loading. The import target is internal and not attacker-controlled in this context.
info ~~critical~~ → info by review dynamic-import celery/local.py:468:22

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        elif name in self._direct:  # pragma: no cover
            module = __import__(self._direct[name], None, None, [name])
            setattr(self, name, module)
            return module
```
likely benign LLM, confidence 0.90 Lazily imports a direct-mapped celery submodule on first attribute access.
Reasoning
This is the same lazy-loading mechanism, importing a module named in the internal _direct table. It is a standard pattern for package lazy imports.
info ~~warn~~ → info by review decoder-decompress-payload celery/worker/state.py:364:49

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        if zrevoked:
            self._merge_revoked_v1(pickle.loads(self.decompress(zrevoked)))

    def _merge_revoked_v2(self, saved):
```
likely benign LLM, confidence 0.72 Decompresses and unpickles saved revoked-task state when merging worker state.
Reasoning
The payload is a zlib-compressed blob loaded from the worker's own saved state, which is the revoked-task persistence path. Unpickling local state is a known risk but matches legitimate celery design. The data source is not shown, so the risk is not fully excluded.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o celery-5.7.0rc1-py3-none-any.whl https://files.pythonhosted.org/packages/98/f4/761cab8b3b12dc6afbdf447593b49df6c7e15fdb458ca7153992eae65288/celery-5.7.0rc1-py3-none-any.whl
printf '%s  %s\n' e45c9f755fc6e86d9fedc89d4bc9e855fe43400eb9160e7c1fb878aed70959bd celery-5.7.0rc1-py3-none-any.whl | shasum -a 256 -c -
unzip -q celery-5.7.0rc1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg