PyPI / fsspec / 2026.9.0

fsspec 2026.9.0

Source

https://github.com/fsspec/filesystem_spec

Artifact scanned

fsspec-2026.9.0-py3-none-any.whl (wheel · 216.5 KB · SHA-256 8dd6e646e99e…)

Compared with

fsspec-2026.7.0-py3-none-any.whl (0 signals introduced since)

Files

58 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 00:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload fsspec/compression.py:137:16

   file imports decoder module(s) bz2, gzip, lzma and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           data = self.infile.read(end - start)
           return self.codec.decompress(data)

   likely benign LLM, confidence 0.93 A seekable file wrapper that decompresses a byte range read from a compressed file using the configured codec.

   Reasoning

   This is the standard file-like wrapper in fsspec's compression module: it reads a byte range from the underlying file and decompresses it with the codec chosen for the file format (gzip, bz2, lzma). The decompress call operates on data read from a user-supplied file, not an embedded payload executed at runtime. Legitimate compression handling.

2. info warn → info by review dynamic-execution fsspec/tests/abstract/mv.py:36:9

   `os.system` called with a literal shell command (ast pass, confidence 0.70)

       if os.name == "nt":
           os.system(f'icacls "{protected_path}" /deny Everyone:(W)')
       else:
           os.chmod(protected_path, 0o555)  # Sets the directory to read-only

   likely benign LLM, confidence 0.95 Test code that runs icacls on Windows to deny write access to a protected directory.

   Reasoning

   This is a test helper that makes a directory read-only on Windows using icacls to test permission-denied behaviour during move operations. The command is a fixed string with only a test path interpolated, and it is in a test suite. Legitimate test setup.

3. info warn → info by review dynamic-execution fsspec/tests/abstract/mv.py:55:9

   `os.system` called with a literal shell command (ast pass, confidence 0.70)

       if os.name == "nt":
           os.system(f'icacls "{protected_path}" /remove:d Everyone')
       else:
           os.chmod(protected_path, 0o755)  # Restore write permission for cleanup

   likely benign LLM, confidence 0.95 Test cleanup that runs icacls on Windows to remove the deny rule and restore access.

   Reasoning

   This is the cleanup counterpart of the previous finding, removing the icacls deny entry on Windows and restoring permissions. It is a test-suite teardown step with no network or obfuscation involved.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o fsspec-2026.9.0-py3-none-any.whl https://files.pythonhosted.org/packages/6c/c0/a98505f18594f1bce828bb159cec0fcf9860562f1a2c85913409fc8f3d9e/fsspec-2026.9.0-py3-none-any.whl
printf '%s  %s\n' 8dd6e646e99ea382bd85f97a45e6b526a442d79423a7dc673f1e2756d05fcb5f fsspec-2026.9.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q fsspec-2026.9.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg