cloudpickle 3.1.2

Source: https://github.com/cloudpipe/cloudpickle
Tag scanned: v3.1.2
Compared with: v3.1.1 (0 signals introduced since)
Files: 24 scanned, 32 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 6.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 04:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import cloudpickle/cloudpickle.py:469:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    # module.
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.90 cloudpickle calls __import__ on a module name to reload a module during unpickling.
Reasoning
This is the dynamic module import helper inside cloudpickle's module-reconstruction code; __import__(name) on a module name is the expected way to import a module by name during unpickling. The name comes from the pickled module reference, so it is a legitimate pattern in a serialization library, though it is a real dynamic import.
info ~~warn~~ → info by review decoder-import-with-exec tests/cloudpickle_test.py:553:9

file imports decoder module(s) base64, pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        """
        exec(textwrap.dedent(code), mod.__dict__)
        mod2 = pickle_depickle(mod, protocol=self.protocol)
        self.assertEqual(mod.x, mod2.x)
```
likely benign LLM, confidence 0.93 Test executes a locally defined code string into a module namespace as part of a pickling round-trip test.
Reasoning
The test file imports pickle and base64 for round-trip testing and executes a dedented, test-defined code string into a module dict. This is a test fixture for dynamic module pickling, not a payload dropper.
info ~~warn~~ → info by review dynamic-execution tests/cloudpickle_test.py:553:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        """
        exec(textwrap.dedent(code), mod.__dict__)
        mod2 = pickle_depickle(mod, protocol=self.protocol)
        self.assertEqual(mod.x, mod2.x)
```
likely benign LLM, confidence 0.93 Test uses exec to define functions in a dynamic module before pickling them.
Reasoning
Same test pattern: exec of a test-authored code string into a dynamic module's __dict__ before pickling, which is the purpose of cloudpickle's tests.
info ~~warn~~ → info by review dynamic-execution tests/cloudpickle_test.py:678:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        """
        exec(textwrap.dedent(code), mod.__dict__)

        # This script will be ran in a separate child process. It will import
```
likely benign LLM, confidence 0.93 Test execs test-defined source into a dynamic module for a subprocess pickling check.
Reasoning
exec of a dedented test code string into a module dict, preparing a dynamic module for a child-process test. Expected in a serialization test suite.
info ~~warn~~ → info by review dynamic-execution tests/cloudpickle_test.py:1071:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        """.format(tup=", ".join(names))
        exec(textwrap.dedent(code), d, d)
        f = d["f"]
        res = f()
```
likely benign LLM, confidence 0.93 Test execs a formatted function definition to create a function for a pickling test.
Reasoning
exec with a formatted test snippet into a dict namespace to obtain a function under test. Legitimate testing of dynamically defined functions.
info ~~critical~~ → info by review dynamic-execution tests/cloudpickle_testpkg/_cloudpickle_testpkg/mod.py:50:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
exec(code, vars(submodule_three))

# What about a dynamic submodule inside a dynamic submodule inside an
```
likely benign LLM, confidence 0.85 Test package execs code into a dynamic submodule at import time to exercise nested dynamic module pickling.
Reasoning
Module-scope exec runs on import, which is unusual, but this is a test package deliberately creating dynamic submodules to test cloudpickle. The code is test-local, not fetched or decoded from an external source as far as the snippet shows.
info ~~warn~~ → info by review dynamic-execution tests/generate_old_pickles.py:64:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    """
    exec(s, vars(dynamic_module))
    assert dynamic_module.f(2, 1) == 3
    dump_obj(dynamic_module, "simple_module.pkl")
```
likely benign LLM, confidence 0.92 Fixture generator execs a local source string into a dynamic module before dumping it as a pickle.
Reasoning
Script that generates old pickle fixtures; exec of a local source string into a dynamic module, then asserts and dumps it. Legitimate test-data generation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/cloudpipe/cloudpickle cloudpickle && cd cloudpickle
git checkout v3.1.2
disclude scan --severity info --diff v3.1.1 .