PyPI / isort / 10.0.0b1

isort 10.0.0b1

Source

https://github.com/PyCQA/isort

Tag scanned

10.0.0b1

Compared with

9.0.2 (0 signals introduced since)

Files

140 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 13 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-19 01:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line docs/configuration/options.md:381:1

   line length 2342 characters (raw pass, confidence 0.65)

   **Default:** `('_ast', '_dummy_thread', '_thread', 'abc', 'aifc', 'argparse', 'array', 'ast', 'asynchat', 'asyncio', 'asyncore', 'atexit', 'audioop', 'base64', 'bdb', 'binascii', 'binhex', 'bisect', 'builtins', 'bz2', 'cProfile', 'calendar', 'cgi', 'cgitb', 'chunk', 'cmath', 'cmd', 'code', 'codecs', 'codeop', 'collecti

   dismissed LLM, confidence 0.97 A markdown documentation line listing Python standard library module names as a default option value.

   Reasoning

   Long line in a markdown doc listing the stdlib module names as a default value. Raw long-line signal on prose/data in documentation; no malicious content.

2. info warn → info by review long-line docs/configuration/options.md:382:1

   line length 2349 characters (raw pass, confidence 0.65)

   **Config default:** `['_ast', '_dummy_thread', '_thread', 'abc', 'aifc', 'argparse', 'array', 'ast', 'asynchat', 'asyncio', 'asyncore', 'atexit', 'audioop', 'base64', 'bdb', 'binascii', 'binhex', 'bisect', 'builtins', 'bz2', 'cProfile', 'calendar', 'cgi', 'cgitb', 'chunk', 'cmath', 'cmd', 'code', 'codecs', 'codeop', 'c

   dismissed LLM, confidence 0.97 A markdown documentation line repeating the stdlib module list as the config default.

   Reasoning

   Same as the adjacent line: a very long markdown line containing the default stdlib module list in a config doc. Benign formatting artifact.

3. info warn → info by review dynamic-execution isort/api.py:193:13

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

               file_content = input_stream.read()
               compile(file_content, content_source, "exec", flags=0, dont_inherit=True)
           except SyntaxError:
               if extension not in CYTHON_EXTENSIONS:

   likely benign LLM, confidence 0.90 isort uses compile() to syntax-check file contents before sorting, without executing them.

   Reasoning

   isort's api checks whether a source file is syntactically valid by compiling its content without executing it. compile() with exec mode only parses to bytecode and does not run the code, so this is a legitimate syntax check, not dynamic execution of attacker payload.

4. info warn → info by review dynamic-execution isort/api.py:221:13

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               compile(_internal_output.read(), content_source, "exec", flags=0, dont_inherit=True)
           except SyntaxError:  # pragma: no cover
               if extension not in CYTHON_EXTENSIONS:

   likely benign LLM, confidence 0.90 isort compiles its sorted output to verify it is valid Python, without running it.

   Reasoning

   Same pattern as the other finding: compile() on sorted output purely to verify syntax validity, guarded by SyntaxError handling for Cython extensions. Not executing code, so benign.

5. info unicode-mixed-script tests/integration/test_setting_combinations.py:533:32

   identifier `euj𒎕` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                   "\U00076fe7þs\x0c\U000c8b75v\U00106541",
                   "𥒒>\U0001960euj𒎕\x9e",
                   "\x15\x9b",
                   "\x02l",

6. info unicode-mixed-script tests/integration/test_setting_combinations.py:549:51

   identifier `eaecc𤎪` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

               "",
               "Ê\U000e8ad2\U0008fa72ùÏ\x19ç\U000eaecc𤎪.",
               "·o\U000d00e5\U000b36de+\x8f\U000b5953´\x08oÜ",
               "",

7. info unicode-mixed-script tests/integration/test_setting_combinations.py:927:59

   identifier `eaecc𤎪` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                       "",
                       "Ê\U000e8ad2\U0008fa72ùÏ\x19ç\U000eaecc𤎪.",
                       "·o\U000d00e5\U000b36de+\x8f\U000b5953´\x08oÜ",
                       "",

8. info unicode-mixed-script tests/integration/test_setting_combinations.py:962:40

   identifier `euj𒎕` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                           "\U00076fe7þs\x0c\U000c8b75v\U00106541",
                           "𥒒>\U0001960euj𒎕\x9e",
                           "\x15\x9b",
                           "\x02l",

9. info unicode-mixed-script tests/integration/test_setting_combinations.py:1396:32

   identifier `euj𒎕` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                   "\U00076fe7þs\x0c\U000c8b75v\U00106541",
                   "𥒒>\U0001960euj𒎕\x9e",
                   "\x15\x9b",
                   "\x02l",

10. info unicode-mixed-script tests/integration/test_setting_combinations.py:1412:51

    identifier `eaecc𤎪` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                "",
                "Ê\U000e8ad2\U0008fa72ùÏ\x19ç\U000eaecc𤎪.",
                "·o\U000d00e5\U000b36de+\x8f\U000b5953´\x08oÜ",
                "",

11. info unicode-mixed-script tests/integration/test_setting_combinations.py:1790:59

    identifier `eaecc𤎪` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        "",
                        "Ê\U000e8ad2\U0008fa72ùÏ\x19ç\U000eaecc𤎪.",
                        "·o\U000d00e5\U000b36de+\x8f\U000b5953´\x08oÜ",
                        "",

12. info unicode-mixed-script tests/integration/test_setting_combinations.py:1825:40

    identifier `euj𒎕` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                            "\U00076fe7þs\x0c\U000c8b75v\U00106541",
                            "𥒒>\U0001960euj𒎕\x9e",
                            "\x15\x9b",
                            "\x02l",

13. info unicode-mixed-script tests/unit/test_io.py:33:28

    identifier `THISCANTBEAREALFILEὩὩὩὩὩὩὩὩὩὩὩὩ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

            with pytest.raises(FileNotFoundError):
                io.File._open("THISCANTBEAREALFILEὩὩὩὩὩὩὩὩὩὩὩὩ.ὩὩὩὩὩ")
    
            def raise_arbitrary_exception(*args: object, **kwargs: object) -> None:

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/PyCQA/isort isort && cd isort
git checkout 10.0.0b1
disclude scan --severity info --diff 9.0.2 .