PyPI / isort / 10.0.0b1

isort 10.0.0b1

Source

https://github.com/PyCQA/isort

Artifact scanned

isort-10.0.0b1-py3-none-any.whl (wheel · 92.3 KB · SHA-256 824a86aa84ab…)

Compared with

isort-9.0.2-py3-none-any.whl (0 signals introduced since)

Files

41 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 10:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution isort/api.py:193:13

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

               file_content = input_stream.read()
               compile(file_content, content_source, "exec", flags=0, dont_inherit=True)
           except SyntaxError:
               if extension not in CYTHON_EXTENSIONS:

   likely benign LLM, confidence 0.95 isort uses compile() as a syntax check on a Python source file's contents, inside a try/except SyntaxError block.

   Reasoning

   The compile call is used only to syntax-check file content with dont_inherit=True and it is not executed; the surrounding except SyntaxError branch shows it is a validity check in isort's own source handling. This is a legitimate pattern for a Python import sorter.

2. info warn → info by review dynamic-execution isort/api.py:221:13

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               compile(_internal_output.read(), content_source, "exec", flags=0, dont_inherit=True)
           except SyntaxError:  # pragma: no cover
               if extension not in CYTHON_EXTENSIONS:

   likely benign LLM, confidence 0.95 isort compiles its own formatted output to verify it is valid Python, catching SyntaxError.

   Reasoning

   Same pattern as the sibling finding: compile() on internal output purely to detect SyntaxError, with the result discarded and no exec. The pragma no cover comment further confirms ordinary library code, not a payload.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o isort-10.0.0b1-py3-none-any.whl https://files.pythonhosted.org/packages/f8/e8/6d08a061322e13ca08daf71ccb33974efe32a424b243ac6febde5b3700a3/isort-10.0.0b1-py3-none-any.whl
printf '%s  %s\n' 824a86aa84ab52c11a5b99eb322f577f8d9a3837cda6ca9e5d54567d7d8ba149 isort-10.0.0b1-py3-none-any.whl | shasum -a 256 -c -
unzip -q isort-10.0.0b1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg