greenlet 3.5.6

Source: https://github.com/python-greenlet/greenlet
Artifact scanned: greenlet-3.5.6.tar.gz (sdist · 202.8 KB · SHA-256 8e67c43bdfc8…)
Compared with: greenlet-3.5.5.tar.gz (0 signals introduced since)
Files: 113 scanned, 19 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 7.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 03:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review recursive-main-call src/greenlet/TThreadStateDestroy.cpp:166:21

`main` is called from within a function — recursion through main is an IOCCC pattern (ast pass, confidence 0.90)
```
#ifndef NDEBUG
        PyGreenlet* main(state->borrow_main_greenlet());
        assert(main);
        assert(main->pimpl->thread_state() == nullptr);
```
likely benign LLM, confidence 0.85 Debug-only local variable named `main` holding the main greenlet, used in asserts.
Reasoning
The declaration `PyGreenlet* main(state->borrow_main_greenlet());` is a local variable named main inside a debug-only assert block. It is a variable declaration, not a recursive call through main, and the snippet shows no recursion. Naming a local 'main' is unusual but harmless; the IOCCC framing does not fit.
info ~~warn~~ → info by review frame-introspection src/greenlet/tests/test_greenlet.py:356:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def f1():
            f = sys._getframe(0) # pylint:disable=protected-access
            self.assertEqual(f.f_back, None)
            greenlet.getcurrent().parent.switch(f)
```
likely benign LLM, confidence 0.95 Test helper that retrieves its own frame to verify f_back behaviour across greenlet switches.
Reasoning
Greenlet test code using sys._getframe(0) to check frame back-links. This is ordinary testing of the greenlet library's frame behaviour, with a pylint disable comment.
info ~~warn~~ → info by review frame-introspection src/greenlet/tests/test_greenlet.py:968:25

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def inner():
            main.switch(sys._getframe(0))

        hub = RawGreenlet(outer)
```
likely benign LLM, confidence 0.95 Test inner function sends its frame to the main greenlet.
Reasoning
Test code passing the current frame to another greenlet to check frame handling. Legitimate use of sys._getframe in a test suite.
info ~~warn~~ → info by review frame-introspection src/greenlet/tests/test_greenlet.py:1013:19

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def outer():
            inner(sys._getframe(0))

        def inner(frame):
```
likely benign LLM, confidence 0.95 Test outer function passes its frame to inner for a greenlet frame test.
Reasoning
Same pattern: the test passes its own frame to another function to exercise greenlet behaviour. Benign test scaffolding.
info ~~warn~~ → info by review dynamic-execution src/greenlet/tests/test_greenlet.py:1062:18

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
            # critical sections to get suspended
            with open(__file__, "rt", encoding='utf-8') as f:
                f.read()
```
likely benign LLM, confidence 0.90 Test reads its own source file and discards the contents.
Reasoning
The file reads itself with a read and discards the result, with no decoding, execution or payload extraction. The read is part of a test that exercises suspension during critical sections. Flagged as payload extraction, but nothing in the snippet extracts or runs anything.
info ~~warn~~ → info by review frame-introspection src/greenlet/tests/test_tracing.py:105:25

`sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def __enter__(self):
        self.oldtrace = sys.setprofile(self)
        return self.actions
```
likely benign LLM, confidence 0.95 Context manager that installs a profile hook to record greenlet switch actions in tests.
Reasoning
Tracing test installs itself as a profile function via sys.setprofile and saves the old one, a standard pattern for testing greenlet tracing hooks.
info ~~warn~~ → info by review frame-introspection src/greenlet/tests/test_tracing.py:109:9

`sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def __exit__(self, *args):
        sys.setprofile(self.oldtrace)

def tpt_callback():
```
likely benign LLM, confidence 0.95 Context manager exit restoring the previous profile hook.
Reasoning
Restores the previous profile function on exit, which is the matching cleanup for the test context manager above.
info ~~critical~~ → info by review dynamic-execution src/greenlet/tests/test_version.py:36:14

`os.popen` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        invoke_setup = "%s %s --version" % (sys.executable, setup_py)
        with os.popen(invoke_setup) as f:
            sversion = f.read().strip()
```
likely benign LLM, confidence 0.85 Test runs setup.py --version through os.popen to read the package version.
Reasoning
The command is built from sys.executable and a setup.py path to query the package version, run in a test. The shell is invoked with a runtime string, but the inputs are local and trusted, and it is only a version check. Using os.popen is poor practice, but this is not malicious. The critical severity is overstated.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o greenlet-3.5.6.tar.gz https://files.pythonhosted.org/packages/3e/6e/0091f175ccd02b02bc8811bbcbcc6ac2e980be116e3b2f7a736ca322bf84/greenlet-3.5.6.tar.gz
printf '%s  %s\n' 8e67c43bdfc88d5fee6db0d3e40175b362fc95fb85f0412d233b9b203c53a575 greenlet-3.5.6.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf greenlet-3.5.6.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg