PyPI / narwhals / 2.28.0

narwhals 2.28.0

Source

https://github.com/narwhals-dev/narwhals

Artifact scanned

narwhals-2.28.0-py3-none-any.whl (wheel · 479.1 KB · SHA-256 1f69d6385ec3…)

Compared with

narwhals-2.27.1-py3-none-any.whl (0 signals introduced since)

Files

164 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-29 14:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection narwhals/_exceptions.py:20:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       # https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow
       frame = inspect.currentframe()
       n = 0
       try:

   likely benign LLM, confidence 0.95 Uses inspect.currentframe() to walk the call stack while constructing an exception message in the narwhals library.

   Reasoning

   inspect.currentframe() used to walk the stack for building error messages, with a comment linking to a known performance discussion. Standard library introspection for diagnostics; no network, exec, or obfuscation involved.

2. info warn → info by review frame-introspection narwhals/dependencies.py:149:18

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

   
           caller = sys._getframe(1).f_code.co_name
           msg = (
               f"You passed a `{qualified_type_name(frame)}` to `{caller}`.\n\n"

   likely benign LLM, confidence 0.95 Reads the immediate caller's function name via sys._getframe to include in a user-facing type error message.

   Reasoning

   sys._getframe(1).f_code.co_name reads the caller's function name so an error message can name the calling function. This is a common, legitimate diagnostic pattern with no code execution or data exfiltration.

3. info warn → info by review frame-introspection narwhals/dependencies.py:162:18

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

   
           caller = sys._getframe(1).f_code.co_name
           msg = (
               f"You passed a `{qualified_type_name(ser)}` to `{caller}`.\n\n"

   likely benign LLM, confidence 0.95 Uses sys._getframe(1) to fetch the caller's name for an error message about an unsupported series type.

   Reasoning

   Same pattern as the sibling finding: caller name retrieved through sys._getframe(1) purely to format an error message about an unsupported type. Benign diagnostic use.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o narwhals-2.28.0-py3-none-any.whl https://files.pythonhosted.org/packages/cf/82/8ef9c7e0f50493307a49c09cfa7f00c5a778b6d1921f7b2dabe1d3a5809e/narwhals-2.28.0-py3-none-any.whl
printf '%s  %s\n' 1f69d6385ec30e2fa6e1fdeb37c562ecabd0f713f6f3e3b58a668c5c9df9567f narwhals-2.28.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q narwhals-2.28.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg