disclude.ioPyPI / matplotlib / 3.11.2
matplotlib 3.11.2
- Source
- https://github.com/matplotlib/matplotlib
- Artifact scanned
matplotlib-3.11.2.tar.gz- Compared with
matplotlib-3.11.1.tar.gz(0 signals introduced since)- Files
- 1718 scanned, 2829 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 37 info
- Scan time
- 26.1 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 32 of 32 warn and critical signals; 32 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 08:03
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign Devcontainer setup runs the micromamba install script from the internet through the user's shell.
Reasoning
Piping a remote install script via process substitution into a shell chosen by $SHELL is a common bootstrap pattern for micromamba in a devcontainer; the URL is a known vendor installer, though remote script execution warrants a note.
-
|likely benign Cygwin CI step generates /etc/passwd with mkpasswd for the build user.Reasoning
The redirect writes to /etc/passwd, which is the Cygwin passwd file generated from mkpasswd; the path-command-shadow signal misfires because passwd is a file path, not a PATH hijack. Benign CI setup.
-
dismissed Long autogenerated inheritance-diagram directive in API docs.
Reasoning
A long line in an RST inheritance-diagram directive listing class names is ordinary documentation content.
-
likely benign Docs config tries importing optional modules to report missing ones.
Reasoning
Sphinx conf checking whether optional modules are importable in a loop over names; the import target comes from a fixed mapping, a standard pattern for missing-dependency reporting.
-
info
warn→ info by reviewunicode-homoglyphdoc/release/prev_whats_new/dflt_style_changes.rst:707:25dismissed Unicode example labels in release notes documentation.Reasoning
Greek alpha inside a string literal in a documentation example showing unicode labels; it is displayed content, not an identifier spoofing anything.
-
info
warn→ info by reviewunicode-homoglyphdoc/release/prev_whats_new/dflt_style_changes.rst:717:37dismissed Russian sample title in a release-notes example.Reasoning
Cyrillic text inside a string literal in a docs example about title rendering; it is a sample title, not a code identifier.
-
-
info
warn→ info by reviewdynamic-format-stringextern/agg24-svn/src/ctrl/agg_slider_ctrl.cpp:165:17char buf; ; m_text.; }likely benign Vendored AGG slider control uses sprintf with a stored format string.Reasoning
Vendored AGG library formats a slider label with the sprintf format from a member; the format is developer-controlled, so this is a code-quality issue rather than malicious intent.
-
info
warn→ info by reviewdynamic-executiongalleries/examples/ticks/date_formatters_locators.py:32:36likely benign Date locator example evaluates user-chosen locator expression.Reasoning
Example gallery evaluates locator and formatter strings typed by the user in an interactive demo; the eval is over a fixed set of example inputs from the example itself, but it is still eval of input text, mildly risky only if reused with untrusted input.
-
info
warn→ info by reviewdynamic-executiongalleries/examples/ticks/date_formatters_locators.py:35:38likely benign Date formatter example evaluates a formatter expression string.Reasoning
Same demo pattern evaluating a formatter expression string chosen by the example author; no network, no obfuscation.
-
""" ydata = eval(expression, {'np': np}, {'t': t}) l.set_ydata(ydata) ax.relim()likely benign Textbox widget example evaluates a typed expression to plot a curve.Reasoning
Textbox widget example evaluates a typed math expression with restricted namespaces; it is the documented purpose of the example and not malicious, though eval of user text is a known hazard.
-
= -
info
warn→ info by reviewdynamic-executiongalleries/users_explain/figure/interactive_guide.rst:443:12dismissed Documentation illustration of an input-evaluate loop.Reasoning
eval inside an RST code illustration of an input loop in prose documentation; it is explanatory text, not executed code.
-
=likely benign Matplotlib API helper uses frame introspection to locate caller for warnings.Reasoning
Matplotlib's API helper walks the call stack with sys._getframe to find the caller for deprecation warnings; a standard legitimate use.
-
likely benign Axes code uses inspect.stack to build a keyword-argument error.
Reasoning
inspect.stack used to name the calling function in a keyword error message; ordinary library behavior.
-
varlikely benign Minified vendored resize-observer polyfill in the web backend.Reasoning
A minified bundled JavaScript resize observer polyfill (jsxtools) on one long line; minification explains the length, and it is a known vendored library rather than hidden payload.
-
=likely benign Layout engine copies constructor arguments using locals().Reasoning
Reads local variables by name via locals() to collect constructor parameters; a clumsy but benign reflection pattern over a fixed set of keyword names.
-
=likely benign Copies named function parameters into a params dict via locals().Reasoning
locals() lookup by parameter name to copy keyword arguments into self._params is a standard matplotlib idiom for reading function arguments; no external input or payload is involved.
-
=likely benign Iterates keyword-only defaults and reads matching locals into _params.Reasoning
Same locals() pattern iterating over keyword-only defaults of a known method; benign parameter reflection.
-
=likely benign Reads locals by name to store layout parameters.Reasoning
Duplicate of the same benign locals() parameter-copy idiom in a sibling method.
-
is , , 2 and 1 , : -
- - - -
- - """ from .transforms import Bbox -
. =likely benign Copies backend function signatures onto pyplot globals for a fixed set of names.Reasoning
Loop over a fixed literal list of backend function names assigning __signature__ onto module globals; standard for mirroring backend signatures into pyplot.
-
# check if it's valid Python as-is return Falselikely benign Compiles plot source text only to test whether it is valid Python.Reasoning
compile of documentation source text to check syntax validity is a normal sphinx extension check, not a payload execution.
-
=likely benign Executes the configured pre-code for documentation plots.Reasoning
exec of a plot_pre_code config value set by the documentation author is the intended behavior of the plot directive, running author-supplied doc code in a build context.
-
likely benign Executes plot directive source code to generate figures.
Reasoning
exec of documentation plot source inside the Sphinx build is the core purpose of the plot directive; the code comes from the project's own docs.
-
likely benign Calls a named plotting function from the directive option within the doc namespace.
Reasoning
exec of function_name plus empty parentheses is a constructed call, but function_name comes from the directive's own option in documentation source; it only invokes a named function in the plot namespace, consistent with plot directive behavior.
-
info
warn→ info by reviewdecoder-decompress-payloadlib/matplotlib/tests/test_simplification.py:449:27= = =likely benign Decodes base64 test vertex data into a numpy array.Reasoning
base64 decoding of a test fixture into an int32 vertex array is ordinary test data handling; it produces a numpy array passed to Path, not executed code.
-
= =likely benign Evaluates the repr of a Bbox in a test round-trip check.Reasoning
eval of repr of a Bbox with a restricted namespace is a round-trip serialization test; inputs are internally generated.
-
= assert ==likely benign Evaluates str of a Bbox to check formatted output.Reasoning
eval of str(b) with a restricted namespace in a test asserting formatting; internally generated, benign.
-
= = assert ==likely benign Evaluates a formatted Bbox string in a test.Reasoning
eval of a format string of the Bbox in a test with a fixed format spec; benign test code.
-
assert ==likely benign Evaluates formatted numeric attributes for comparison in a test.Reasoning
eval of formatted numeric attribute values in a test assertion; benign.
-
iflikely benign Local double variable xo for an x offset coordinate.Reasoning
xo and yo are ordinary coordinate variable names; the confusable collision is an artifact of the skeleton heuristic on short names, not homoglyph obfuscation, and the code is standard offset transform logic.
-
double xo = ; double yo = ; offset_trans.; trans *= agg::;likely benign Local double variable yo for a y offset coordinate.Reasoning
yo is the matching y-offset coordinate variable in standard transform code; the flagged collision is a false positive from the skeleton heuristic.
-
// Try loading from the main program namespace first. auto main_program = ; auto success = ; // We don't need to keep a reference open as the main program always exists.likely benign Obtains a handle to the main program so Tcl/Tk symbols already loaded into the interpreter can be resolved.Reasoning
dlopen(nullptr, RTLD_LAZY) returns a handle to the main program's global symbol namespace, not an arbitrary library path. The code then looks up Tcl/Tk symbols in it, and the comment explains the intent. This is a standard way to find Tcl/Tk symbols already linked into the Python process. No attacker-controlled path or payload is involved.
-
std::string path = py_path_b; auto tkinter_lib = ; iflikely benign Loads the tkinter shared library from the path Python reports for its tkinter module, so the matching Tcl/Tk libraries can be used.Reasoning
The path comes from py_path_b, which the surrounding code takes from Python's tkinter module location, and it is used to load the tkinter shared library that Python itself uses. The non-literal path is needed because the library's location varies by install. The failure path throws a runtime error rather than continuing silently. This matches matplotlib's Tk backend loading logic.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&