jsonpath-ng 1.13.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Artifact scanned: jsonpath_ng-1.13.0-py3-none-any.whl (wheel · 82.0 KB · SHA-256 f58e7f88cdd2…)
Compared with: jsonpath_ng-1.12.0-py3-none-any.whl (3 signals introduced since)
Files: 25 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 8.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 14:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection jsonpath_ng/_deprecations.py:25:37 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    stacklevel = 1
    frame: types.FrameType | None = sys._getframe(0)
    while frame is not None:
        module = frame.f_globals.get("__name__", "")
```
dismissed LLM, confidence 0.93 Walks stack frames via sys._getframe to locate the caller's module for a deprecation warning.
Reasoning
The code walks the call stack to find the calling module's __name__ so it can emit a deprecation warning with the correct stacklevel. This is a common, legitimate use of frame introspection in a library.
info ~~warn~~ → info by review long-line jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 8222 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,15,16,17,18,19,20,21,22,23,24,25,26,27,28,42,55,57,64,67,81,83,90,91,92,93,96,98,113,],[2,33,2,2,2,2,2,2,2,48,33,-16,-17,-18,-19,58,2,33,2,2,86,88,2,2,2,2,2,2,105,88,119,]),'FLOAT':([0,10,15,16,17,18,19,20,21,23,24,25,26,27,28,55,57,81,83,90,91,92,93,96,],[3,3,3,3,3,3,3,3,49,-16,-1
```
dismissed LLM, confidence 0.95 Generated PLY LR parse table with very long data lines.
Reasoning
This is a machine-generated LR parser table in a _ply_tables module. Long lines of numeric and symbol mappings are the expected output of PLY and carry no code-execution or obfuscation risk.

info long-line jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 1077 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,15,16,17,18,19,20,21,27,28,55,57,81,83,90,91,92,93,],[1,39,40,41,43,44,45,46,47,59,61,82,84,95,97,82,82,82,95,]),'fields_or_any':([0,10,15,16,17,18,19,20,21,27,28,55,57,81,83,90,91,92,93,],[5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,]),'fields':([0,8,10,15,16,17,18,19,20,21,22,27,28,38,42

info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.85 PLY lexer exec('import ...') to load a cached lex table module.
Reasoning
This is PLY's standard mechanism for importing a generated lextab module by name. The argument is a module name built by the library, not untrusted input, so it is ordinary parser-generator code.
info ~~critical~~ → info by review frame-introspection jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reading caller frame globals and locals to build lexer namespace.
Reasoning
get_caller_module_dict is PLY's standard helper for reading the caller's globals and locals when building a lexer. The critical severity comes only from the co-occurrence of sys.exit/exec/eval elsewhere in a large vendored file, not from anything anti-analysis in this function.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.85 PLY exec('import pkg') to resolve a package's __file__ for output paths.
Reasoning
This is PLY's standard code for importing a package to locate its source file for output directory computation. The module name derives from the library's own configuration, so this is legitimate.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.80 PLY eval of a grammar literal token string to validate it is a single character.
Reasoning
PLY evaluates a grammar literal token such as a quoted character in the grammar specification to check its length. The input comes from the developer's own grammar source, not from a remote or runtime source, so this is expected parser-generator behavior.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.85 PLY exec('import ...') to load a cached parse table module.
Reasoning
This matches PLY's standard parsetab module import, the same pattern as the lexer. The module name is library-generated and the usage is legitimate.
info ~~critical~~ → info by review frame-introspection jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reading caller frame globals and locals to build the parser namespace.
Reasoning
This is the same PLY get_caller_module_dict helper for capturing caller namespaces when building a parser. The critical severity reflects the nearby sys.exit/exec/eval calls in a vendored file, not malicious logic.
info ~~warn~~ → info by review dynamic-execution jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.85 PLY exec('import pkg') to resolve a package's __file__ for output paths.
Reasoning
This is PLY's standard package import to locate a source file for output directory resolution, using a library-derived module name. It is legitimate.
info ~~warn~~ → info by review long-line jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
dismissed LLM, confidence 0.95 Generated PLY LR parse table with a long data line.
Reasoning
This is a machine-generated LR parser table of the same kind as the other table file. The long line is ordinary generated data, not an encoded payload.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jsonpath_ng-1.13.0-py3-none-any.whl https://files.pythonhosted.org/packages/5c/03/30db4cd2e778aee7feb29b14ff9c831735e5e1939600dff2bacba38107b1/jsonpath_ng-1.13.0-py3-none-any.whl
printf '%s  %s\n' f58e7f88cdd2eb04a402c0d542e7d6db71909e521f4c23c62f4d2ee73266361e jsonpath_ng-1.13.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q jsonpath_ng-1.13.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg