jsonpath-ng 1.12.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Artifact scanned: jsonpath_ng-1.12.0-py3-none-any.whl (wheel · 78.7 KB · SHA-256 6fc33404ab2a…)
Compared with: jsonpath_ng-1.11.0-py3-none-any.whl (2 signals introduced since)
Files: 24 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 8.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 11:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 7047 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,15,16,17,18,19,20,21,22,23,24,25,26,27,28,42,55,57,64,67,79,81,88,91,93,106,],[2,33,2,2,2,2,2,2,2,48,33,-15,-16,-17,-18,58,2,33,2,2,84,86,2,2,2,98,86,112,]),'FLOAT':([0,10,15,16,17,18,19,20,21,23,24,25,26,27,28,55,57,79,81,88,91,],[3,3,3,3,3,3,3,3,49,-15,-16,-17,-18,3,60,3,3,3,3,3,
```
likely benign LLM, confidence 0.95 Generated PLY LR parse-table data with a very long line.
Reasoning
This is a machine-generated LR parse table, a single long dictionary literal of integers and token names. Long lines are expected for generated tables, and the content is inert data.

info long-line jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 905 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[1,39,40,41,43,44,45,46,47,59,61,80,82,90,92,80,]),'fields_or_any':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,]),'fields':([0,8,10,15,16,17,18,19,20,21,22,27,28,38,42,55,57,79,81,88,],[9,32,9,9,9,9,9

info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.90 Dynamic import of a PLY lextab module name inside the lexer's table-loading routine.
Reasoning
This is PLY's standard lexer-table loading code, which runs exec('import %s' % tabfile) on a module name it constructed itself. It is a known pattern in the upstream library, with no network, decoding or process spawning involved.
info ~~critical~~ → info by review frame-introspection jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.88 Call-stack frame introspection used by PLY to collect the caller's namespace for lexer rule definitions.
Reasoning
get_caller_module_dict is PLY's standard helper for reading the caller's globals and locals via sys._getframe. The 'anti-analysis' label comes only from the file also containing sys.exit/exec/eval, which is normal for a parser generator.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 Dynamic import of a package name derived from a source path to locate the output directory.
Reasoning
This is the same PLY pattern: exec('import %s' % pkgname) on a package name derived from the source file path so the module's __file__ can be located for output directory selection. It does not run attacker-controlled input.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.85 eval of a grammar literal token string to validate that it is a single character.
Reasoning
PLY's grammar validation uses eval(s) on a literal token string from the grammar definition, such as a quoted single character, to check its length. That is an expected use within a parser generator, and the input comes from the developer's own grammar.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.90 Dynamic import of a PLY parsetab module name during table loading.
Reasoning
This is PLY's parse-table loading, exec('import %s' % module) on a module name it builds internally. It matches the upstream library and has no malicious indicators.
info ~~critical~~ → info by review frame-introspection jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.88 Call-stack frame introspection used by PLY to capture the caller's globals and locals.
Reasoning
This is the same PLY get_caller_module_dict helper using sys._getframe to read the caller's namespace. It is standard upstream code, and the anti-analysis label is driven only by co-occurrence of exec/eval/exit in the file.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 Dynamic import of a package name derived from a source path to resolve the output directory.
Reasoning
This is PLY's standard source-path lookup, exec('import %s' % pkgname) on a package name derived from the module path to find the output directory. It is consistent with the upstream library.
info ~~warn~~ → info by review long-line jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.95 Generated PLY LR parse-table data with a long line.
Reasoning
This is a machine-generated LR parse table of integer lists keyed by token names. The long line is a formatting artifact of generation, and the data is inert.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jsonpath_ng-1.12.0-py3-none-any.whl https://files.pythonhosted.org/packages/88/ff/7b4345bd4a737e29a820f6c5a4a5139c43af5cda68d497fdc00c8489b195/jsonpath_ng-1.12.0-py3-none-any.whl
printf '%s  %s\n' 6fc33404ab2a9b77895e9acde23f80998c61567c8e9c182301e73a78f158e585 jsonpath_ng-1.12.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q jsonpath_ng-1.12.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg