PyPI / itsdangerous / 2.2.0

itsdangerous 2.2.0

Source

https://github.com/pallets/itsdangerous

Tag scanned

2.2.0

Compared with

2.1.2 (0 signals introduced since)

Files

34 scanned, 12 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:46

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload src/itsdangerous/url_safe.py:46:24

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

               try:
                   json = zlib.decompress(json)
               except Exception as e:
                   raise BadPayload(

   likely benign LLM, confidence 0.95 zlib.decompress of a token payload inside itsdangerous' URL-safe serializer, with errors converted to BadPayload.

   Reasoning

   This is the itsdangerous library's URL-safe serializer, which decompresses signed payloads that were compressed by the same library when the compression flag is set. The zlib.decompress call is on data from the token being verified, wrapped in try/except that raises BadPayload on failure. This is standard, documented compression handling, not an embedded hidden payload or dropper.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pallets/itsdangerous itsdangerous && cd itsdangerous
git checkout 2.2.0
disclude scan --severity info --diff 2.1.2 .