PyPI / itsdangerous / 2.2.0

itsdangerous 2.2.0

Source

https://github.com/pallets/itsdangerous

Artifact scanned

itsdangerous-2.2.0-py3-none-any.whl (wheel · 15.9 KB · SHA-256 c6242fc49e35…)

Compared with

itsdangerous-2.1.2-py3-none-any.whl (0 signals introduced since)

Files

9 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

1.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 08:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload itsdangerous/url_safe.py:46:24

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

               try:
                   json = zlib.decompress(json)
               except Exception as e:
                   raise BadPayload(

   likely benign LLM, confidence 0.93 Library code that zlib-decompresses a signed URL-safe token payload during deserialization.

   Reasoning

   This is itsdangerous's URL-safe serializer decompressing a token payload when the compressed flag is set. zlib.decompress on a signed, client-supplied token is standard for compact serialization. There is no embedded blob, no exec, and no network or process activity, and the exception is wrapped into BadPayload. This is legitimate library code.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o itsdangerous-2.2.0-py3-none-any.whl https://files.pythonhosted.org/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl
printf '%s  %s\n' c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef itsdangerous-2.2.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q itsdangerous-2.2.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg