PyPI / click / 8.5.0

click 8.5.0

Source

https://github.com/pallets/click

Artifact scanned

click-8.5.0-py3-none-any.whl (wheel · 122.3 KB · SHA-256 255bc9599cf7…)

Compared with

click-8.4.2-py3-none-any.whl (0 signals introduced since)

Files

18 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-22 23:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection click/decorators.py:485:17

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       if version is None and package_name is None:
           frame = inspect.currentframe()
           f_back = frame.f_back if frame is not None else None
           f_globals = f_back.f_globals if f_back is not None else None

   likely benign LLM, confidence 0.95 click's version_option uses inspect.currentframe to read the caller's globals for package name lookup.

   Reasoning

   This is the standard idiom click uses in version_option to find the calling module's globals so it can locate the package name and version. The use of currentframe with None guards is defensive and matches the library's documented behavior. No network, exec, or dropper behavior is present. Frame introspection alone is a common legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o click-8.5.0-py3-none-any.whl https://files.pythonhosted.org/packages/58/50/6c0d534c5f134586a8e1ba4e330569e32f057e33372ae556463212fb4cd3/click-8.5.0-py3-none-any.whl
printf '%s  %s\n' 255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 click-8.5.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q click-8.5.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg