PyPI / jsonpatch / 1.36

jsonpatch 1.36

Source

https://github.com/stefankoegl/python-json-patch

Tag scanned

v1.36

Compared with

v1.35 (0 signals introduced since)

Files

17 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-20 05:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import ext_tests.py:109:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   for module in modules:
       m = __import__(module, fromlist=[module])
       coverage_modules.append(m)
       suite.addTest(doctest.DocTestSuite(m))

   likely benign LLM, confidence 0.93 A test harness dynamically imports a list of named modules to build doctest suites.

   Reasoning

   The snippet is a test-suite loader that iterates over a list of module names and imports each one with __import__ so doctests can be collected via doctest.DocTestSuite. The module names come from a local list of test modules, not from attacker-controlled input, and nothing in the snippet decodes, downloads, or executes payloads. This is a common pattern in test runners and the critical severity reflects the AST rule firing on any non-literal __import__, not real malicious behavior.

2. info whitespace-anomaly jsonpatch_cli.py:14:1

   file mixes tab and space indentation (1 tab-indented and 82 space-indented lines) (raw pass, confidence 0.40)

   jsondiff_parser = argparse.ArgumentParser(
       prog='jsondiff', description='Diff two JSON files')
   jsondiff_parser.add_argument('FILE1', type=argparse.FileType('r'))
   jsondiff_parser.add_argument('FILE2', type=argparse.FileType('r'))

3. info critical → info by review dynamic-import tests.py:2051:13

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       for module in modules:
           m = __import__(module, fromlist=[module])
           suite.addTest(doctest.DocTestSuite(m))

   likely benign LLM, confidence 0.93 A test file dynamically imports named modules to assemble doctest suites.

   Reasoning

   Same pattern as the sibling finding: a test file loops over a list of module names, calls __import__ on each, and adds DocTestSuite for each module. The import targets are local test modules named in a fixed list, and there is no encoded input, network activity, or execution of untrusted data. The flag comes from the generic dynamic-import rule matching a legitimate test-loading idiom.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/stefankoegl/python-json-patch python-json-patch && cd python-json-patch
git checkout v1.36
disclude scan --severity info --diff v1.35 .