PyPI / fastjsonschema / 2.22.3

fastjsonschema 2.22.3

Source

https://github.com/horejsek/python-fastjsonschema

Artifact scanned

fastjsonschema-2.22.3-py3-none-any.whl (wheel · 27.8 KB · SHA-256 f670b443830b…)

Compared with

fastjsonschema-2.22.2-py3-none-any.whl (0 signals introduced since)

Files

12 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-11-01 21:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution fastjsonschema/__init__.py:172:12

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       """
       return compile(definition, handlers, formats, use_default, use_formats, detailed_exceptions, fast_fail)(data)

   likely benign LLM, confidence 0.90 A public JSON Schema compile function that builds a validator from a schema and applies it to data.

   Reasoning

   The snippet is a thin wrapper: `compile` builds a validator from a JSON schema definition and then calls it on the data. fastjsonschema is a known, legitimate JSON Schema validation library whose core design is generating validator code from schemas. The flagged call is its public API entry point, not a payload decoded from an attacker-controlled source. The finding is a generic non-literal dynamic-execution signal on a library's intended behaviour.

2. info warn → info by review dynamic-execution fastjsonschema/__init__.py:294:5

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       # Do not pass local state so it can recursively call itself.
       exec(code_generator.func_code, global_state)
       func = global_state[resolver.get_scope_name()]
       if formats:

   likely benign LLM, confidence 0.90 Executes generated validator source code in a global namespace to produce a schema-specific validation function.

   Reasoning

   The `exec` runs code generated internally by fastjsonschema's CodeGenerator from the schema, then reads the resulting function from a scope dictionary. The comment about not passing local state shows deliberate design for recursive calls. This is the library's documented code-generation mechanism for building fast validators, and the code is not decoded from an obfuscated blob or fetched from the network. It matches a known legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o fastjsonschema-2.22.3-py3-none-any.whl https://files.pythonhosted.org/packages/d7/0d/6caab33488dc9d26440c24221fa610c7c8b83c30715ab45d31f0e004308e/fastjsonschema-2.22.3-py3-none-any.whl
printf '%s  %s\n' f670b443830b75aca3f00b75949efa20f4b2a80302ec7a21505c28dd54cffd43 fastjsonschema-2.22.3-py3-none-any.whl | shasum -a 256 -c -
unzip -q fastjsonschema-2.22.3-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg