PyPI / jsonpatch / 1.36

jsonpatch 1.36

Source

https://github.com/stefankoegl/python-json-patch

Tag scanned

v1.36

Compared with

v1.35 (0 signals introduced since)

Files

17 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 07:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import ext_tests.py:109:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   for module in modules:
       m = __import__(module, fromlist=[module])
       coverage_modules.append(m)
       suite.addTest(doctest.DocTestSuite(m))

   likely benign LLM, confidence 0.90 Test helper that dynamically imports a list of project modules to build doctest suites.

   Reasoning

   The loop imports a list of module names from a test-suite setup and wraps each in doctest.DocTestSuite, a standard pattern for collecting doctests. The module list is test configuration, not attacker-controlled input, and nothing is executed beyond importing project modules. The critical severity overstates a benign test harness.

2. info whitespace-anomaly jsonpatch_cli.py:14:1

   file mixes tab and space indentation (1 tab-indented and 82 space-indented lines) (raw pass, confidence 0.40)

   jsondiff_parser = argparse.ArgumentParser(
       prog='jsondiff', description='Diff two JSON files')
   jsondiff_parser.add_argument('FILE1', type=argparse.FileType('r'))
   jsondiff_parser.add_argument('FILE2', type=argparse.FileType('r'))

3. info critical → info by review dynamic-import tests.py:2051:13

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       for module in modules:
           m = __import__(module, fromlist=[module])
           suite.addTest(doctest.DocTestSuite(m))

   likely benign LLM, confidence 0.90 Test code importing named modules dynamically to gather doctests.

   Reasoning

   Same pattern as the companion finding: __import__ over a module list feeding doctest.DocTestSuite in a test file. This is ordinary test-harness code for collecting doctests from named modules, with no decoding, network access, or shell execution in the snippet.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/stefankoegl/python-json-patch python-json-patch && cd python-json-patch
git checkout v1.36
disclude scan --severity info --diff v1.35 .