networkx 3.7

Source: https://github.com/networkx/networkx
Artifact scanned: networkx-3.7-py3-none-any.whl (wheel · 2.0 MB · SHA-256 e3fd2c13a781…)
Compared with: networkx-3.6.1-py3-none-any.whl (0 signals introduced since)
Files: 586 scanned, 18 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 10.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 06:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution networkx/algorithms/operators/tests/test_all.py:28:32

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        graph, node = n
        assert ghj.nodes[n] == eval(graph).nodes[int(node)]

    assert ghj.graph["attr"] == "attr"
```
likely benign LLM, confidence 0.85 Test assertion that uses eval to look up a named test graph by string.
Reasoning
The eval is in a test assertion and evaluates a graph name taken from the test's own fixture dictionary, not external input. This is a test-harness idiom, not a payload.
info ~~warn~~ → info by review dynamic-execution networkx/algorithms/operators/tests/test_binary.py:23:31

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        graph, node = n
        assert gh.nodes[n] == eval(graph).nodes[int(node)]

    assert gh.graph["attr"] == "attr"
```
likely benign LLM, confidence 0.85 Test assertion that uses eval to resolve a named test graph.
Reasoning
Same pattern as test_all.py: eval resolves a fixture graph name inside a test assertion. No untrusted input reaches it.
info ~~warn~~ → info by review frame-introspection networkx/lazy_imports.py:170:22

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            parent = inspect.stack()[1]
            frame_data = {
                "spec": fullname,
```
likely benign LLM, confidence 0.85 Reads the calling frame to record the importing module for lazy loading.
Reasoning
inspect.stack()[1] reads the caller's module name so the lazy-import helper can record which module requested the import. This is ordinary introspection for lazy loading and does not execute or hide anything.
info whitespace-anomaly networkx/readwrite/tests/test_gml.py:15:1

file mixes tab and space indentation (4 tab-indented and 664 space-indented lines) (raw pass, confidence 0.40)
```
class TestGraph:
    @classmethod
    def setup_class(cls):
        cls.simple_data = """Creator "me"
```
info ~~warn~~ → info by review dynamic-execution networkx/tests/test_lazy_imports.py:83:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    exec(s, {}, locls)
    expected = {
        "attach": lazy.attach,
```
likely benign LLM, confidence 0.80 Test that execs generated lazy-import stub source into a local dict and checks the result.
Reasoning
This test executes generated stub source in an isolated namespace and checks the resulting attach/lazy names. The input is test-authored code, so the exec is part of verifying lazy-import stub generation.
info ~~warn~~ → info by review decoder-import-with-exec networkx/utils/decorators.py:915:20

file imports decoder module(s) bz2, gzip and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        filename = f"{self.__class__} compilation {self._count()}"
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
```
likely benign LLM, confidence 0.80 Generates a specialized wrapper function from a signature via compile and exec in the argmap decorator.
Reasoning
The argmap decorator builds a wrapper function from the decorated function's signature by compiling and exec-ing generated source. The bz2/gzip imports are generic to the module and the source is derived from the decorator's own code, not from a downloaded or encoded payload. The decoder-plus-exec heuristic matches the shape but not the content.
info ~~warn~~ → info by review dynamic-execution networkx/utils/decorators.py:915:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        filename = f"{self.__class__} compilation {self._count()}"
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
```
likely benign LLM, confidence 0.80 compile of generated wrapper source inside the argmap decorator.
Reasoning
The compile call turns code generated from the decorated function's signature into a code object for the same wrapper. It is part of the code-generation mechanism and carries no sign of a hidden payload.
info ~~warn~~ → info by review dynamic-execution networkx/utils/decorators.py:916:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
        func._code = code
```
likely benign LLM, confidence 0.80 exec of the compiled wrapper to materialize the decorated function in the argmap decorator.
Reasoning
The exec runs the compiled wrapper into controlled namespaces so the decorator can fetch the generated function. This is a known metaprogramming technique for preserving signatures and does not reach the network or decode an opaque blob.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o networkx-3.7-py3-none-any.whl https://files.pythonhosted.org/packages/7e/cd/fe58041e9011f307c490e3e17dd48cc516448f7c698a3f2d9d9d65d7e6a8/networkx-3.7-py3-none-any.whl
printf '%s  %s\n' e3fd2c13a7814cee3746340d8d7f8598a67f16a58bf47fb7f8793fab6efca1b0 networkx-3.7-py3-none-any.whl | shasum -a 256 -c -
unzip -q networkx-3.7-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg