joblib 1.6.0

Source: https://github.com/joblib/joblib
Tag scanned: 1.6.0
Compared with: 1.5.3 (1 signals introduced since)
Files: 115 scanned, 58 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 8.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution joblib/test/test_func_inspect.py:366:5 new in this release

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    ns = {}
    exec(
        compile(
            "def f(x):\n    return x\n",
```
likely benign LLM, confidence 0.85 Test code executes a hardcoded function definition to exercise inspection.
Reasoning
The exec call runs compile() of a fixed string literal defining a trivial function, inside a test that checks function inspection. The source is hardcoded in the test, so there is no external input.
info ~~warn~~ → info by review dynamic-execution benchmarks/bench_pickle.py:35:13

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
        try:
            os.system('sudo sh -c "sync; echo 3 > /proc/sys/vm/drop_caches"')
        except IOError as e:
            if e.errno == 13:
```
likely benign LLM, confidence 0.85 A benchmark script shells out to drop the page cache before timing.
Reasoning
The os.system call runs a fixed literal command that clears the Linux page cache, a common step in I/O benchmarks. It is hardcoded with no external input, and the sudo use is explained by the benchmark purpose. Nothing here suggests a dropper.
info whitespace-anomaly doc/conf.py:18:1

file mixes tab and space indentation (11 tab-indented and 65 space-indented lines) (raw pass, confidence 0.40)
```
extensions = [
    "sphinx.ext.autodoc",
    "sphinx.ext.imgmath",
    "numpydoc",
```
info ~~critical~~ → info by review dynamic-import joblib/_memmapping_reducer.py:654:29

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            # easy vendoring.
            delete_folder = __import__(
                pool_module_name, fromlist=["delete_folder"]
            ).delete_folder
```
likely benign LLM, confidence 0.85 Dynamic import of a joblib pool module to fetch delete_folder.
Reasoning
The __import__ target is a module name derived from the package's own vendoring logic, with a fromlist of a known function. This is a standard dynamic-import pattern for loading a joblib submodule under different vendored names. It is not a payload fetch.
info ~~warn~~ → info by review decoder-decompress-payload joblib/compressor.py:277:34

file imports decoder module(s) zlib, bz2, lzma and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            self._mode = _MODE_READ
            self._decompressor = zlib.decompressobj(self.wbits)
            self._buffer = b""
            self._buffer_offset = 0
```
likely benign LLM, confidence 0.90 Streaming zlib decompressor object for compressed joblib files.
Reasoning
zlib.decompressobj is used to implement a streaming decompressor for joblib's compressed pickle file format. It operates on user-supplied file data, not an embedded payload, so the decoder-import signal is a false positive for a compression library.
info ~~warn~~ → info by review decoder-decompress-payload joblib/numpy_pickle_compat.py:58:12

file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    # buffer to allocate.
    data = zlib.decompress(file_handle.read(), 15, length)
    assert len(data) == length, (
        "Incorrect data length while decompressing %s."
```
likely benign LLM, confidence 0.90 Legacy-format decompression of joblib pickle data with length check.
Reasoning
zlib.decompress with a known length is used to read legacy joblib pickle files. The length assertion shows it is a format-compatibility routine. This is normal file-format handling.
info ~~warn~~ → info by review decoder-import-with-exec joblib/test/test_memory.py:166:9

file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        my_locals = {}
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
```
likely benign LLM, confidence 0.85 Test harness executes a simulated IPython cell to check memory caching.
Reasoning
The exec/compile wrapper runs ipython_cell_source, a string defined in the test to simulate an IPython cell. This is a test harness for cell-based caching and the source is not attacker-controlled. The pickle import is incidental to the test.
info ~~warn~~ → info by review dynamic-execution joblib/test/test_memory.py:166:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        my_locals = {}
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
```
likely benign LLM, confidence 0.85 Same test-harness exec of a simulated IPython cell.
Reasoning
This is the dynamic-execution companion to the same exec call. It runs the test's own simulated IPython cell source. The context is a test suite, not a dropper.
info ~~warn~~ → info by review dynamic-execution joblib/test/test_memory.py:167:13

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
                filename=ipython_cell_id,
```
likely benign LLM, confidence 0.85 compile of a test fixture string to emulate an IPython cell.
Reasoning
compile() here is the inner call that builds code from the test's simulated IPython cell string, with a filename argument for traceback fidelity. The input is a fixed test fixture, so this is a legitimate testing pattern.
info ~~warn~~ → info by review decoder-decompress-payload joblib/test/test_numpy_pickle.py:739:15

file imports decoder module(s) bz2, gzip, pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    with open(source_filename, "rb") as fo:
        buf = zlib.decompress(fo.read())

    with open(target_filename, "wb") as fo:
```
likely benign LLM, confidence 0.90 Test utility decompresses a local pickle fixture file to a target path.
Reasoning
zlib.decompress reads a local test fixture file and writes it to a target file, which is the expected behavior of a test that converts compressed pickle formats. It reads and writes only local files, and the decoder signal reflects a normal compression library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/joblib/joblib joblib && cd joblib
git checkout 1.6.0
disclude scan --severity info --diff 1.5.3 .