disclude.iopandas 3.0.6
- Source
- https://github.com/pandas-dev/pandas
- Artifact scanned
pandas-3.0.6.tar.gz- Compared with
pandas-3.0.5.tar.gz(0 signals introduced since)- Files
- 1493 scanned, 104 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 50 info
- Scan time
- 28.2 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 34 of 34 warn and critical signals; 34 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 01:01
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
-
-
# pragma: no coverlikely benign Dynamic __import__ of optional pandas dependencies inside a try/except in the package init.Reasoning
This is the standard optional-dependency import loop in pandas' package init, importing a dependency name from a constant list and re-raising a clear ImportError. Dynamic import of a known list of module names is legitimate.
-
# https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow = = # type: ignore[union-attr]likely benign Frame introspection to find the caller frame for warning assertions in testing helpers.Reasoning
Walking up the call stack via inspect.currentframe to locate the caller for warning stacklevel is a common pandas testing utility; no network, decoding or execution involved.
-
""" frame = sys._getframe(2) for v in frame.f_locals.values(): if v is obj:likely benign sys._getframe used to scan caller local variables in a core helper.Reasoning
sys._getframe(2) used to search caller locals for an object, a known pandas pattern for resolving names in scope; benign introspection.
-
= =likely benign eval on a parsed pandas expression node inside the query/eval computation engine.Reasoning
This is pandas' query-expression engine evaluating parsed expression trees, which is the library's documented eval feature on internally parsed, validated expressions. Expected in a data library, though eval is inherently risky.
-
=likely benign sys._getframe used to capture variable scope for pandas eval/query.Reasoning
Scope resolution in pandas eval captures caller frames to access local and global variables for query expressions. Standard for this module.
-
# makes sure that we can capture variable scope =likely benign inspect.stack call capturing variable scope for pandas query evaluation.Reasoning
inspect.stack used to capture calling scope for pandas query evaluation, with a comment explaining its purpose. Benign.
-
]: =likely benign Reads local keyword arguments by name via vars() to forward to a styler method.Reasoning
vars() lookup of keyword argument names from the local scope to forward to the Styler method; this is a fixed list of names and a plain getattr call. Not malicious.
-
: =likely benign Byte-literal SAS file magic signature constant in the SAS reader.Reasoning
The bytes literal is the SAS file magic number constant used to identify SAS7BDAT files. A binary signature in a parser constant is expected, not a hidden payload.
-
assert ==likely benign eval of a test-constructed expression string to verify pandas eval output.Reasoning
Test code evaluating a locally constructed query string to compare against pandas eval results. Test-only use with controlled inputs.
-
= = assert ==likely benign eval of a test expression string in a pandas eval test.Reasoning
Test helper evaluating a hardcoded test expression to compare with the engine result. Test-only.
-
= = assert ==likely benign eval of a test expression string in a pandas eval test.Reasoning
Same pattern as the sibling test: eval of a test-defined expression for comparison. Test-only.
-
= = =likely benign eval of a parametrized function name to construct a random state in a sample test.Reasoning
Test evaluating a parametrized function name string (e.g. numpy RandomState constructor) to build a random state. Test-only with fixed parameters.
-
= =likely benign eval of a parametrized function name in a sample test.Reasoning
Same parametrized eval pattern in a sample test; fixed test inputs.
-
, -
, -
= =likely benign eval of an Index repr string to verify round-trip formatting.Reasoning
Round-trip check that eval(repr(idx)) reconstructs an Index in a repr test. Test-only on a locally created object.
-
info
warn→ info by reviewdynamic-executionpandas/tests/indexes/categorical/test_category.py:207:31# formattinglikely benign eval of a CategoricalIndex repr to verify round-trip formatting.Reasoning
Round-trip repr check for a CategoricalIndex in a test; local object, test-only.
-
likely benign eval of a MultiIndex repr to verify round-trip formatting.
Reasoning
Round-trip repr check for a MultiIndex in a test; local object, test-only.
-
=likely benign Test helper evaluating the repr of an Index to verify round-tripping.Reasoning
The eval is applied to repr(index) inside a test to check that an Index round-trips through its repr. The input is the object's own repr, not untrusted data, and the file is a pandas test module.
-
=likely benign Test evaluating a RangeIndex repr string to check round-tripping.Reasoning
eval is applied to a repr string produced within a pandas RangeIndex test to confirm the repr reconstructs an equal index. This is a standard round-trip assertion in test code.
-
=likely benign Test evaluating a RangeIndex repr string to check round-tripping.Reasoning
Same pattern as the other range test: eval of a locally generated repr string, followed by an index equality assertion. No external input reaches eval.
-
=likely benign Test using eval on a fixture index repr to verify round-tripping.Reasoning
eval(repr(index)) on a fixture index in a pandas test, asserting the repr is valid and reconstructs the index. Input is self-generated.
-
=likely benign Test evaluating an index repr to confirm round-trip equality.Reasoning
eval(repr(idx)) on a simple_index fixture in a pandas base-index test. This is a repr round-trip check on locally constructed data.
-
= -
= = -
# see gh-15086. -
info
warn→ info by reviewframe-introspectionpandas/tests/io/parser/common/test_common_basic.py:687:5=likely benign Test installing a no-op profiler hook around a parser call to assert no Python function calls occur.Reasoning
sys.setprofile with a no-op lambda is set around a parser read call, then cleared. This is a common pandas test technique to assert that the C parser makes no Python-level function calls during parsing. It does not inspect or exfiltrate frames.
-
info
warn→ info by reviewframe-introspectionpandas/tests/io/parser/common/test_common_basic.py:689:5= =likely benign Clears the no-op profiler hook used in a parser test.Reasoning
The matching sys.setprofile(None) clears the no-op hook set on the previous line. Part of the same benign test-harness pattern.
-
== : return == : return -
== : return == : return -
# PR #25040 wide unicode wasn't copied correctly on PY3 on windows -
, , , , -
, , , , -
} = = = -
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:690:26assert == assert == # This should be 2013-11-01 05:00 in UTClikely benign Test evaluating a Timestamp repr to verify round-tripping.Reasoning
eval(repr(result)) on a Timestamp in a constructor test, checking that the repr is a valid expression that reconstructs the value. Self-generated input.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:698:26assert == assert == # GH11708likely benign Test evaluating a Timestamp repr to verify round-tripping.Reasoning
Same repr round-trip assertion on a Timestamp in a pandas constructor test.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:707:26assert == assert == # This should be 2015-11-18 10:00 in UTClikely benign Test evaluating a Timestamp repr to verify round-tripping.Reasoning
Same repr round-trip assertion on a Timestamp in a pandas constructor test.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:715:26assert == assert ==likely benign Test evaluating a Timestamp repr to verify round-tripping.Reasoning
Same repr round-trip assertion on a Timestamp in a pandas constructor test.
-
assert not in assert == =likely benign Test evaluating a Timestamp repr to verify round-tripping.Reasoning
eval of repr(date_only) in a Timestamp formatting test, checking round-trip equality. Self-generated, no external input.
-
assert not in assert ==likely benign Test evaluating a timezone-aware Timestamp repr to verify round-tripping.Reasoning
eval of repr(date_tz) in a timezone-aware Timestamp repr test. Standard round-trip check on locally generated data.
-
= assert ==likely benign Test evaluating a UTC-offset Timestamp repr to verify round-tripping.Reasoning
eval of a repr string of a Timestamp with UTC offset in a formatting test. Round-trip assertion only.
-
assert ==likely benign Test looping over timezones and evaluating each repr to verify round-tripping.Reasoning
Loop over zones evaluating repr(z) and asserting equality with z in a pre-1900 repr test. Self-generated input in test code.
-
, -
, -
dismissed A long random-looking string literal used as hashing test input in pandas.
Reasoning
The snippet is a long random-looking string literal inside a pandas hashing test, used as input data to check hash stability. Test fixtures commonly contain random strings like this. Raw-pass base64 heuristics have a high false-positive rate, and nothing here decodes or executes the blob.
-
dismissed Another random string literal used as hashing test data in pandas.
Reasoning
Same file and pattern as the adjacent finding: a long random string literal serving as test data for hash functions. It is not decoded or executed, so it is a legitimate test fixture.
-
# https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow : | None = = 0likely benign pandas uses inspect.currentframe() to walk the call stack when adjusting exception messages.Reasoning
Using inspect.currentframe() to find the caller's frame is a standard pandas technique for rewriting exception messages with the calling function's context. It is a legitimate use of call-stack introspection with no network, process, or dynamic execution involved.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&