PyPI / packaging / 26.3

packaging 26.3

Source

https://github.com/pypa/packaging

Tag scanned

26.3

Compared with

26.2 (1 signals introduced since)

Files

105 scanned, 23 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 25 info

Scan time

21.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 25 of 25 warn and critical signals; 25 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:08

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review payload-bytes-literal tests/test_requirements.py:954:5 new in this release

   concatenated bytes literal contains 112 `\xNN` escapes (54% of content) — binary payload shape (ast pass, confidence 0.85)

   _PACKAGING_26_1_PICKLE_REQUESTS_GE_2_0_PRERELEASES = (
       b"\x80\x02cpackaging.requirements\nRequirement\nq\x00)\x81q\x01}q\x02("
       b"X\x04\x00\x00\x00nameq\x03X\x08\x00\x00\x00requestsq\x04X\x03\x00\x00\x00"
       b"urlq\x05NX\x06\x00\x00\x00extrasq\x06c__builtin__\nset\nq\x07]q\x08\x85q"

   likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging Requirement with prerelease handling.

   Reasoning

   This is another pickle fixture for a packaging Requirement with prereleases, in the same test file and naming pattern as the other fixtures. The byte escapes are expected pickle encoding, and the bytes are only used as test input.

2. info critical → info by review dynamic-execution docs/conf.py:12:5

   `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   with open(os.path.join(_BASE_DIR, "src", "packaging", "__init__.py")) as f:
       exec(f.read(), ABOUT)
   
   # -- General configuration ----------------------------------------------------

   likely benign LLM, confidence 0.90 Sphinx config executes the project's own __about__-style module to read version metadata.

   Reasoning

   The exec reads the project's own src/packaging/__init__.py into a dict to pull out version metadata, a common Sphinx conf.py idiom. The path is built from the repository base directory, not from network or user input.

3. info warn → info by review dynamic-execution src/packaging/licenses/__init__.py:144:9

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           compile(python_expression, "", "eval")
       except SyntaxError:
           message = f"Invalid license expression: {raw_license_expression!r}"

   likely benign LLM, confidence 0.90 Validates a license expression by compiling it, a syntax check rather than execution.

   Reasoning

   compile() is used only to validate a license expression syntactically and catches SyntaxError to report an error. Compiling in 'eval' mode does not execute the expression, so the risk is minimal.

4. info warn → info by review dynamic-execution tests/musllinux/build.sh:16:5

   command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   build_one_in_ubuntu () {
       $1 "multiarch/ubuntu-core:${2}-${UBUNTU_VERSION}" \
           bash "/home/hello-world/musllinux/build.sh" glibc "glibc-${2}"
   }

   likely benign LLM, confidence 0.85 Test build helper that runs a caller-supplied container command.

   Reasoning

   The script is a test helper where $1 is the container runtime command (for example docker or podman) passed in by the caller. This is a parameterized wrapper in test tooling, not a hidden payload.

5. info warn → info by review dynamic-execution tests/musllinux/build.sh:21:5

   command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   build_one_in_alpine () {
       $1 "multiarch/alpine:${2}-${ALPINE_VERSION}" \
           sh "/home/hello-world/musllinux/build.sh" musl "musl-${2}"
   }

   likely benign LLM, confidence 0.85 Test helper that wraps an alpine container build with a caller-supplied runner.

   Reasoning

   Same pattern as the sibling function: $1 is the container runner chosen by the caller in a musllinux test build script. The command is a fixed docker run with known image names.

6. info warn → info by review dynamic-execution tests/musllinux/build.sh:30:9

   command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

       if [[ $# -ne 0 ]]; then
           "build_one_in_${1}" "$DOCKER" "$2"
           return
       fi

   likely benign LLM, confidence 0.85 Dispatches to one of two local build helper functions by name.

   Reasoning

   The dispatch to build_one_in_${1} selects one of the two local helper functions defined in the same file, so the target is bounded. The variable is a mode selector for a test matrix.

7. info warn → info by review payload-bytes-literal tests/test_markers.py:759:5

   concatenated bytes literal contains 53 `\xNN` escapes (51% of content) — binary payload shape (ast pass, confidence 0.85)

   _PACKAGING_26_1_PICKLE_MARKER_PYTHON_VERSION_GE_3_8 = (
       b"\x80\x02cpackaging.markers\nMarker\nq\x00)\x81q\x01N}q\x02X\x08\x00"
       b"\x00\x00_markersq\x03]q\x04cpackaging._parser\nVariable\nq\x05)\x81"
       b"q\x06N}q\x07X\x05\x00\x00\x00valueq\x08X\x0e\x00\x00\x00python_vers"

   likely benign LLM, confidence 0.85 Legacy pickle fixture of a packaging Marker object used in compatibility tests.

   Reasoning

   This is a pickle byte fixture for backward-compatibility tests of packaging markers. The escaped bytes are the expected serialized output of older packaging versions, and the test compares it against unpickled objects. The high escape density is inherent to pickle data, not evasion.

8. info warn → info by review payload-bytes-literal tests/test_markers.py:772:5

   concatenated bytes literal contains 51 `\xNN` escapes (51% of content) — binary payload shape (ast pass, confidence 0.85)

   _PACKAGING_26_0_PICKLE_MARKER_PYTHON_VERSION_GE_3_8 = (
       b"\x80\x02cpackaging.markers\nMarker\nq\x00)\x81q\x01}q\x02X\x08\x00\x00"
       b"\x00_markersq\x03]q\x04cpackaging._parser\nVariable\nq\x05)\x81q\x06N}"
       b"q\x07X\x05\x00\x00\x00valueq\x08X\x0e\x00\x00\x00python_versionq\ts\x86"

   likely benign LLM, confidence 0.85 Versioned pickle fixture of a packaging Marker for regression tests.

   Reasoning

   Another versioned pickle fixture for packaging marker compatibility tests, matching the expected output from an earlier packaging release. It is test data, not executed code.

9. info warn → info by review payload-bytes-literal tests/test_markers.py:783:5

   concatenated bytes literal contains 45 `\xNN` escapes (48% of content) — binary payload shape (ast pass, confidence 0.85)

   _PACKAGING_25_0_PICKLE_MARKER_PYTHON_VERSION_GE_3_8 = (
       b"\x80\x02cpackaging.markers\nMarker\nq\x00)\x81q\x01}q\x02X\x08\x00\x00"
       b"\x00_markersq\x03]q\x04cpackaging._parser\nVariable\nq\x05)\x81q\x06}q\x07"
       b"X\x05\x00\x00\x00valueq\x08X\x0e\x00\x00\x00python_versionq\tsbcpackaging"

   likely benign LLM, confidence 0.85 Pickle fixture for an older packaging Marker serialization in tests.

   Reasoning

   This is a versioned pickle fixture for packaging marker regression tests. The payload only represents serialized packaging objects and is compared against expected results.

10. info warn → info by review payload-bytes-literal tests/test_requirements.py:897:5

    concatenated bytes literal contains 101 `\xNN` escapes (48% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_1_PICKLE_REQUESTS_GE_2_0_WITH_MARKER = (
        b"\x80\x02cpackaging.requirements\nRequirement\nq\x00)\x81q\x01}q\x02("
        b"X\x04\x00\x00\x00nameq\x03X\x08\x00\x00\x00requestsq\x04X\x03\x00"
        b"\x00\x00urlq\x05NX\x06\x00\x00\x00extrasq\x06c__builtin__\nset\nq\x07"

    likely benign LLM, confidence 0.80 Pickle fixture for a serialized packaging Requirement used in compatibility tests.

    Reasoning

    This pickle fixture serializes a packaging Requirement and includes a c__builtin__ set reference, which is standard for pickle protocol 2 output of a set. It is used to test loading of old pickles. Pickle is a deserialization risk in production code, but here it is static test data. The verdict is not higher because pickle payloads deserve scrutiny.

11. info warn → info by review payload-bytes-literal tests/test_requirements.py:916:5

    concatenated bytes literal contains 121 `\xNN` escapes (53% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_0_PICKLE_REQUESTS_GE_2_0 = (
        b"\x80\x02cpackaging.requirements\nRequirement\nq\x00)\x81q\x01}q\x02("
        b"X\x04\x00\x00\x00nameq\x03X\x08\x00\x00\x00requestsq\x04X\x03\x00"
        b"\x00\x00urlq\x05NX\x06\x00\x00\x00extrasq\x06c__builtin__\nset\nq\x07"

    likely benign LLM, confidence 0.80 Versioned pickled Requirement fixture for requirements compatibility tests.

    Reasoning

    Pickle fixture for a packaging Requirement, generated by the library's own serialization, with standard protocol-2 opcodes. It is static test data in a regression test and is not executed as a payload.

12. info warn → info by review payload-bytes-literal tests/test_requirements.py:937:5

    concatenated bytes literal contains 78 `\xNN` escapes (52% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_25_0_PICKLE_REQUESTS_GE_2_0 = (
        b"\x80\x02cpackaging.requirements\nRequirement\nq\x00)\x81q\x01}q\x02("
        b"X\x04\x00\x00\x00nameq\x03X\x08\x00\x00\x00requestsq\x04X\x03\x00"
        b"\x00\x00urlq\x05NX\x06\x00\x00\x00extrasq\x06c__builtin__\nset\nq\x07"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging Requirement object.

    Reasoning

    The snippet is a protocol-2 pickle byte string for a packaging Requirement object, the kind of fixture used to test unpickling compatibility across packaging versions. The payload-bytes-literal signal fires on the hex escapes that pickle output naturally contains. Nothing here executes at import time, and the file is a test module.

13. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3275:5

    concatenated bytes literal contains 55 `\xNN` escapes (53% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_25_0_PICKLE_SS_GE_3_10_LT_4_0 = (
        b"\x80\x02cpackaging.specifiers\nSpecifierSet\nq\x00)\x81q\x01}q\x02"
        b"(X\x06\x00\x00\x00_specsq\x03c__builtin__\nfrozenset\nq\x04]q\x05"
        b"(cpackaging.specifiers\nSpecifier\nq\x06)\x81q\x07}q\x08(X\x05\x00"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging SpecifierSet.

    Reasoning

    The snippet is a pickle of a packaging SpecifierSet, built from its internal _specs frozenset. It is a versioned compatibility fixture in a test module. The binary shape comes from pickle opcodes, not from concealed logic.

14. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3313:5

    concatenated bytes literal contains 33 `\xNN` escapes (57% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_0_PICKLE_GE_3_10 = (
        b"\x80\x02cpackaging.specifiers\nSpecifier\nq\x00)\x81q\x01N}q\x02"
        b"(X\x0c\x00\x00\x00_prereleasesq\x03NX\x05\x00\x00\x00_specq\x04"
        b"X\x02\x00\x00\x00>=q\x05X\x04\x00\x00\x003.10q\x06\x86q\x07X\r"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging Specifier.

    Reasoning

    This is a pickled packaging Specifier fixture with its _prereleases, _spec and related fields. It sits in the packaging test suite and is used to check that older pickles still load. The escapes are ordinary pickle data.

15. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3320:5

    concatenated bytes literal contains 124 `\xNN` escapes (57% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_0_PICKLE_SS_GE_3_10_LT_4_0 = (
        b"\x80\x02cpackaging.specifiers\nSpecifierSet\nq\x00)\x81q\x01N}q\x02"
        b"(X\x0c\x00\x00\x00_prereleasesq\x03NX\x06\x00\x00\x00_specsq\x04"
        b"c__builtin__\nfrozenset\nq\x05]q\x06(cpackaging.specifiers\nSpecifier"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging SpecifierSet.

    Reasoning

    This is a pickled SpecifierSet fixture with internal state fields, the same style as the other versioned pickle fixtures in the test module. The byte content matches pickle serialization, and the bytes are only test input.

16. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3366:5

    concatenated bytes literal contains 42 `\xNN` escapes (57% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_1_PICKLE_GE_3_10 = (
        b"\x80\x02cpackaging.specifiers\nSpecifier\nq\x00)\x81q\x01N}q\x02"
        b"(X\x0c\x00\x00\x00_prereleasesq\x03NX\x07\x00\x00\x00_rangesq\x04"
        b"NX\x05\x00\x00\x00_specq\x05X\x02\x00\x00\x00>=q\x06X\x04\x00\x00"

    likely benign LLM, confidence 0.92 Test fixture holding a serialized pickle of a packaging Specifier with range state.

    Reasoning

    The snippet is a pickled packaging Specifier with _prereleases, _ranges and _spec fields, a compatibility fixture in a test file. The raw bytes are the expected output of pickle serialization.

17. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3374:5

    concatenated bytes literal contains 97 `\xNN` escapes (57% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_1_PICKLE_SS_GE_3_10_LT_4_0 = (
        b"\x80\x02cpackaging.specifiers\nSpecifierSet\nq\x00)\x81q\x01N}q\x02"
        b"(X\x0e\x00\x00\x00_canonicalizedq\x03\x89X\x0e\x00\x00\x00_has_arb"
        b"itraryq\x04\x89X\x11\x00\x00\x00_is_unsatisfiableq\x05NX\x0c\x00"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging SpecifierSet with internal flags.

    Reasoning

    This is a pickled SpecifierSet with canonicalization and unsatisfiability flags, a versioned fixture in the packaging test suite. The escapes are pickle opcodes and length prefixes, not a hidden payload, and nothing executes them.

18. info warn → info by review payload-bytes-literal tests/test_specifiers.py:3423:5

    concatenated bytes literal contains 40 `\xNN` escapes (58% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_2_PICKLE_SS_GE_3_10_LT_4_0 = (
        b"\x80\x02cpackaging.specifiers\nSpecifierSet\nq\x00)\x81q\x01cpackag"
        b"ing.specifiers\nSpecifier\nq\x02)\x81q\x03X\x02\x00\x00\x00>=q\x04"
        b"X\x04\x00\x00\x003.10q\x05\x86q\x06N\x86q\x07bh\x02)\x81q\x08X\x01"

    likely benign LLM, confidence 0.92 Test fixture holding a nested serialized pickle of packaging SpecifierSet and Specifier objects.

    Reasoning

    The snippet is a pickle of a nested SpecifierSet containing Specifier objects, used as a compatibility test input. The pattern is typical of serialized Python objects. There is no dropper pipeline or execution in the snippet.

19. info warn → info by review payload-bytes-literal tests/test_tags.py:2085:5

    concatenated bytes literal contains 47 `\xNN` escapes (64% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_1_PICKLE_TAG_CP39 = (
        b"\x80\x02cpackaging.tags\nTag\nq\x00)\x81q\x01N}q\x02(X\x04\x00\x00"
        b"\x00_abiq\x03X\x04\x00\x00\x00cp39q\x04X\x05\x00\x00\x00_hashq\x05"
        b"\x8a\x08)\xb1\xe8\x9d\x90\xf8tFX\x0c\x00\x00\x00_interpreterq\x06X"

    likely benign LLM, confidence 0.93 Test fixture holding a serialized pickle of a packaging Tag object.

    Reasoning

    This is a pickled packaging Tag fixture with _abi, _hash and _interpreter fields in the test suite. The high escape ratio reflects binary pickle data including hash bytes. It is used only as test input.

20. info warn → info by review payload-bytes-literal tests/test_tags.py:2096:5

    concatenated bytes literal contains 47 `\xNN` escapes (64% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_0_PICKLE_TAG_CP39 = (
        b"\x80\x02cpackaging.tags\nTag\nq\x00)\x81q\x01N}q\x02(X\x04\x00\x00"
        b"\x00_abiq\x03X\x04\x00\x00\x00cp39q\x04X\x05\x00\x00\x00_hashq\x05"
        b"\x8a\x08\xc1\xdb\xa0\xe5]7z\x87X\x0c\x00\x00\x00_interpreterq\x06X"

    likely benign LLM, confidence 0.95 Pickle byte fixture of a packaging Tag object used in a test module.

    Reasoning

    The bytes literal is a pickled packaging.tags.Tag object with ABI, interpreter and hash fields. It is a serialized test fixture for the packaging library's pickle compatibility tests, which explains the high escape density. The file is a test module and the content is consistent with that purpose.

21. info warn → info by review payload-bytes-literal tests/test_tags.py:2107:5

    concatenated bytes literal contains 49 `\xNN` escapes (65% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_25_0_PICKLE_TAG_CP39 = (
        b"\x80\x02cpackaging.tags\nTag\nq\x00)\x81q\x01N}q\x02(X\x04\x00\x00\x00"
        b"_abiq\x03X\x04\x00\x00\x00cp39q\x04X\x05\x00\x00\x00_hashq\x05\x8a\x08"
        b"\xea\xa5X\x92\xa5\xc9\x11\x0cX\x0c\x00\x00\x00_interpreterq\x06X\x04"

    likely benign LLM, confidence 0.95 Second pickle byte fixture of a packaging Tag object in the test suite.

    Reasoning

    Same pattern as the adjacent fixture: a pickled packaging.tags.Tag for cp39 with a hash field. It is a versioned test fixture for pickle round-tripping in the packaging test suite, with no execution or decoding logic in the snippet.

22. info warn → info by review payload-bytes-literal tests/test_version.py:1314:5

    concatenated bytes literal contains 37 `\xNN` escapes (42% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_25_0_PICKLE_V1_2_3 = (
        b"\x80\x02cpackaging.version\nVersion\nq\x00)\x81q\x01}q\x02"
        b"(X\x08\x00\x00\x00_versionq\x03cpackaging.version\n_Version\n"
        b"q\x04(K\x00K\x01K\x02K\x03\x87q\x05NNNNtq\x06\x81q\x07X\x04"

    likely benign LLM, confidence 0.95 Pickle byte fixture of a packaging Version object used in tests.

    Reasoning

    The bytes encode a pickled packaging.version.Version object with a release tuple and attributes. This is a serialized fixture for version pickling tests. The snippet has no code that deserializes it in a dangerous way, and the file is a test module.

23. info warn → info by review payload-bytes-literal tests/test_version.py:1323:5

    concatenated bytes literal contains 42 `\xNN` escapes (45% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_25_0_PICKLE_V2_0A1 = (
        b"\x80\x02cpackaging.version\nVersion\nq\x00)\x81q\x01}q\x02"
        b"(X\x08\x00\x00\x00_versionq\x03cpackaging.version\n_Version\n"
        b"q\x04(K\x00K\x02K\x00\x86q\x05NX\x01\x00\x00\x00aq\x06K\x01"

    likely benign LLM, confidence 0.95 Pickle byte fixture of a pre-release packaging Version object.

    Reasoning

    A pickled Version object for a pre-release version string, consistent with the surrounding pickle compatibility fixtures. It is test data in a packaging library test file and is not used for code execution in the snippet.

24. info warn → info by review payload-bytes-literal tests/test_version.py:1366:5

    concatenated bytes literal contains 55 `\xNN` escapes (51% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_0_PICKLE_V1_2_3 = (
        b"\x80\x02cpackaging.version\nVersion\nq\x00)\x81q\x01N}q\x02"
        b"(X\x04\x00\x00\x00_devq\x03NX\x06\x00\x00\x00_epochq\x04K\x00"
        b"X\n\x00\x00\x00_key_cacheq\x05(K\x00K\x01K\x02K\x03\x87q\x06"

    likely benign LLM, confidence 0.95 Pickle byte fixture of a packaging Version object with dev and epoch fields.

    Reasoning

    Pickle opcodes encoding a Version with dev and epoch fields and a cache attribute. This is a serialization fixture for version compatibility tests in the packaging project, with no sign of malicious loading or execution.

25. info warn → info by review payload-bytes-literal tests/test_version.py:1390:5

    concatenated bytes literal contains 41 `\xNN` escapes (69% of content) — binary payload shape (ast pass, confidence 0.85)

    _PACKAGING_26_2_TUPLE_PICKLE_V1E2_3_4A5_POST6_DEV7_ZZZ = (
        b"\x80\x02cpackaging.version\nVersion\nq\x00)\x81q\x01(K\x01K\x02K\x03"
        b"K\x04\x87q\x02X\x01\x00\x00\x00aq\x03K\x05\x86q\x04X\x04\x00\x00"
        b"\x00postq\x05K\x06\x86q\x06X\x03\x00\x00\x00devq\x07K\x07\x86q\x08"

    likely benign LLM, confidence 0.95 Pickle byte fixture of a complex packaging Version object with multiple segments.

    Reasoning

    A pickled Version tuple with pre, post and dev segments, used to test pickle round-tripping of version parsing. It is a legitimate test fixture in the packaging test suite.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pypa/packaging packaging && cd packaging
git checkout 26.3
disclude scan --severity info --diff 26.2 .