PyPI / filelock / 4.2.4

filelock 4.2.4

Source

https://github.com/tox-dev/py-filelock

Artifact scanned

filelock-4.2.4-py3-none-any.whl (wheel · 158.7 KB · SHA-256 301241438c57…)

Compared with

filelock-4.2.3-py3-none-any.whl (0 signals introduced since)

Files

23 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 01:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute filelock/__init__.py:124:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

               value = getattr(module, f"Async{_FileLock.__name__}" if name == "AsyncFileLock" else name)
       globals()[name] = value
       return value

   likely benign LLM, confidence 0.93 Lazy attribute resolution in filelock's package __init__ that caches imported names in globals().

   Reasoning

   This is the standard lazy-import pattern for a package: a module-level __getattr__ resolves names like AsyncFileLock from submodules and caches them in globals(). The name lookup is bounded to the package's own attribute set and has no decoding, execution or network behavior.

2. info warn → info by review frame-introspection filelock/_api.py:1323:31

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

                   return
               state.releasing = inspect.currentframe()
               try:
                   _LOGGER.debug("Attempting to release lock %s on %s", id(self), self.lock_file)

   likely benign LLM, confidence 0.95 Stores the current call frame on lock state during release for bookkeeping.

   Reasoning

   inspect.currentframe() is stored on the lock state to record which code is releasing the lock, a common diagnostic for re-entrancy and debugging. It is used with a logger debug call and does nothing malicious.

3. info warn → info by review frame-introspection filelock/_api.py:1466:35

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

           attempt = 0
           self._context.acquiring = inspect.currentframe()
           try:
               # Created once, so a directory that disappears while the acquisition waits fails it, not builds a second

   likely benign LLM, confidence 0.95 Records the acquiring call frame on the lock context during acquisition.

   Reasoning

   Storing the current frame on the context object while acquiring a lock is the same legitimate diagnostic/bookkeeping pattern used in the release path of filelock's own API. No exfiltration or dynamic execution is present.

4. info warn → info by review frame-introspection filelock/_api.py:1775:14

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

           return False
       caller = inspect.currentframe()
       while caller is not None and caller is not frame:
           caller = caller.f_back

   likely benign LLM, confidence 0.95 Walks the call stack via f_back to locate a specific caller frame.

   Reasoning

   Walking f_back from the current frame to locate a caller frame is a benign utility for finding the calling context, here used to locate a frame in the stack. It is ordinary introspection with no malicious effect.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o filelock-4.2.4-py3-none-any.whl https://files.pythonhosted.org/packages/e0/1b/5e74289a1878e666bb4b65fe5805a04cafcac2aa5f519ef1ead67ef91c56/filelock-4.2.4-py3-none-any.whl
printf '%s  %s\n' 301241438c57936ef93f4243a94f2559022268bfcf9b375a9a72eb0f8db8358e filelock-4.2.4-py3-none-any.whl | shasum -a 256 -c -
unzip -q filelock-4.2.4-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg