PyPI / cloudpickle / 3.1.2

cloudpickle 3.1.2

Source

https://github.com/cloudpipe/cloudpickle

Artifact scanned

cloudpickle-3.1.2-py3-none-any.whl (wheel · 21.7 KB · SHA-256 9acb47f6afd7…)

Compared with

cloudpickle-3.1.1-py3-none-any.whl (0 signals introduced since)

Files

3 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 07:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import cloudpickle/cloudpickle.py:469:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       # module.
       __import__(name)
       return sys.modules[name]

   likely benign LLM, confidence 0.90 A helper in cloudpickle that dynamically imports a module by name and returns it from sys.modules.

   Reasoning

   The snippet is from cloudpickle's subimport helper, which imports a module by name (name is a module path previously pickled by cloudpickle) and then returns sys.modules[name]. This is the standard idiom for ensuring a submodule is loaded during unpickling; the non-literal argument is inherent to a dynamic import helper, and no decoding, network, or process spawning appears. Severity is critical only because the pattern matched, not because of malicious behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o cloudpickle-3.1.2-py3-none-any.whl https://files.pythonhosted.org/packages/88/39/799be3f2f0f38cc727ee3b4f1445fe6d5e4133064ec2e4115069418a5bb6/cloudpickle-3.1.2-py3-none-any.whl
printf '%s  %s\n' 9acb47f6afd73f60dc1df93bb801b472f05ff42fa6c84167d25cb206be1fbf4a cloudpickle-3.1.2-py3-none-any.whl | shasum -a 256 -c -
unzip -q cloudpickle-3.1.2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg