PyPI / kombu / 5.7.0rc1

kombu 5.7.0rc1

Source

https://github.com/celery/kombu

Artifact scanned

kombu-5.7.0rc1-py3-none-any.whl (wheel · 256.9 KB · SHA-256 311ee95bd72f…)

Compared with

kombu-5.7.0b1-py3-none-any.whl (0 signals introduced since)

Files

82 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 12:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute kombu/__init__.py:34:1

   reach-by-name through `globals` (ast pass, confidence 0.60)

   STATICA_HACK = True
   globals()['kcah_acitats'[::-1].upper()] = False
   if STATICA_HACK:  # pragma: no cover
       # This is never executed, but tricks static analyzers (PyDev, PyCharm,

   likely benign LLM, confidence 0.93 A never-executed globals() assignment that hides a dynamically named attribute from static analyzers.

   Reasoning

   The globals() write with a reversed string is the well-known STATICA_HACK pattern from kombu/celery: the code sets a name the static analyzers cannot see, inside an `if STATICA_HACK` block marked never executed. It is a legitimate hack to hide dynamic attributes from PyCharm/PyDev and does not decode or execute payloads.

2. info critical → info by review dynamic-import kombu/__init__.py:78:22

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           if name in object_origins:
               module = __import__(object_origins[name], None, None, [name])
               for extra_name in all_by_module[module.__name__]:
                   setattr(self, extra_name, getattr(module, extra_name))

   likely benign LLM, confidence 0.85 Lazy attribute loader that imports kombu submodules via __import__ using names from an internal mapping.

   Reasoning

   This is the lazy-loading __getattr__ of kombu's package, which imports submodules named in object_origins, a static mapping from the package itself. The non-literal argument comes from a trusted internal table, not external input, so the critical severity is overstated for this context. A doubt remains only because the snippet does not show where object_origins is populated.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o kombu-5.7.0rc1-py3-none-any.whl https://files.pythonhosted.org/packages/2b/8d/dbaa9d918c0c8bf2b6e13042cd9e39dcfe98c4c864af302fdcc105bb905a/kombu-5.7.0rc1-py3-none-any.whl
printf '%s  %s\n' 311ee95bd72fadfb80d2036837db0a3f28cfd34a45563e0ae7380bb33a06bbdd kombu-5.7.0rc1-py3-none-any.whl | shasum -a 256 -c -
unzip -q kombu-5.7.0rc1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg