pandas 3.1.0

Source: https://github.com/pandas-dev/pandas
Artifact scanned: pandas-3.1.0.tar.gz (sdist · 5.7 MB · SHA-256 ecb9b2d8a817…)
Compared with: pandas-3.0.6.tar.gz (52 signals introduced since)
Files: 1856 scanned, 155 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 81 info
Scan time: 50.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 56 of 56 warn and critical signals; 56 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection pandas/core/common.py:698:17 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        frame = sys._getframe(2)
    except ValueError:
        return False
```
dismissed LLM, confidence 0.90 Frame lookup via sys._getframe to inspect the caller's scope.
Reasoning
sys._getframe(2) is used to inspect the calling namespace in a helper and falls back on ValueError. This is ordinary introspection in a data library with no network, exec, or persistence behavior.
info ~~warn~~ → info by review frame-introspection pandas/tests/config/test_config.py:555:18 new in this release

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        warnings.simplefilter("always")
        lineno = inspect.currentframe().f_lineno + 1
        with cf.option_context("a", 2):
            pass
```
dismissed LLM, confidence 0.90 Test reads the current line number via frame introspection to verify warning placement.
Reasoning
The test reads the current line number through inspect.currentframe to assert warning locations. This is a legitimate test technique.
info ~~warn~~ → info by review frame-introspection pandas/tests/config/test_config.py:570:18 new in this release

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        warnings.simplefilter("always")
        lineno = inspect.currentframe().f_lineno + 1
        cf.set_option("a", 2)
```
dismissed LLM, confidence 0.90 Test reads the current line number via frame introspection to verify warning placement.
Reasoning
Same line-number introspection in a config warning test. Benign test scaffolding.
info ~~warn~~ → info by review frame-introspection pandas/tests/config/test_config.py:584:18 new in this release

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        warnings.simplefilter("always")
        lineno = inspect.currentframe().f_lineno + 2
        with pytest.raises(ValueError, match="inside context"):
            with cf.option_context("a", 2):
```
dismissed LLM, confidence 0.90 Test reads the current line number via frame introspection to verify warning placement.
Reasoning
Same line-number introspection in a config warning test. Benign test scaffolding.
info ~~warn~~ → info by review frame-introspection pandas/tests/config/test_config.py:602:18 new in this release

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        warnings.simplefilter("always")
        lineno = inspect.currentframe().f_lineno + 1
        with cf.option_context("a", 2, "b", 3):
            pass
```
dismissed LLM, confidence 0.90 Test reads the current line number via frame introspection to verify warning placement.
Reasoning
Same line-number introspection in a config warning test. Benign test scaffolding.
info ~~warn~~ → info by review frame-introspection pandas/tests/config/test_config.py:618:17 new in this release

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        warnings.simplefilter("always")
        outer = inspect.currentframe().f_lineno + 1
        with cf.option_context("a", 2):
            with cf.option_context("a", 3):
```
dismissed LLM, confidence 0.93 Reads the current line number inside a pandas test so a warning can be checked against it.
Reasoning
inspect.currentframe().f_lineno is used in a pandas config test to record the line number for a warning assertion. It is a test-local idiom with no data exfiltration or evasion.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/base_class/test_formats.py:15:15 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        idx = pd.Index(["a", "b"])
        res = eval(repr(idx), dict(vars(pd)))
        tm.assert_index_equal(res, idx)
```
dismissed LLM, confidence 0.95 Round-trips a pandas Index through repr and eval to verify the repr.
Reasoning
eval(repr(idx)) with pandas names as globals is a standard round-trip check that repr is valid Python. The input is an index built in the test itself.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/multi/test_formats.py:18:9 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    with pytest.raises(TypeError, match=msg):
        eval(repr(mi), dict(vars(pd)))
```
dismissed LLM, confidence 0.95 Evaluates a MultiIndex repr inside a pandas formatting test.
Reasoning
eval(repr(mi)) inside a pytest.raises block round-trips a MultiIndex repr. Test-only input with no external source.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/numeric/test_numeric.py:35:31 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        index = pd.Index(index_data, dtype=dtype)
        tm.assert_index_equal(eval(repr(index), dict(vars(pd))), index, exact=True)

    def check_coerce(self, a, b, is_float_index=True):
```
dismissed LLM, confidence 0.95 Round-trips a numeric pandas Index through repr and eval.
Reasoning
eval(repr(index), dict(vars(pd))) is a repr round-trip of a locally built numeric index, a common pandas test idiom.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/ranges/test_range.py:61:18 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        result = eval(result, dict(vars(pd)))
        tm.assert_index_equal(result, i, exact=True)
```
dismissed LLM, confidence 0.95 Evaluates a RangeIndex repr string to check it reconstructs the index.
Reasoning
eval of a RangeIndex repr string produced in the test, followed by an index equality assertion. Benign round-trip check.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/ranges/test_range.py:69:18 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        result = eval(result, dict(vars(pd)))
        tm.assert_index_equal(result, i, exact=True)
```
dismissed LLM, confidence 0.95 Second RangeIndex repr round-trip eval in the same pandas test file.
Reasoning
Same RangeIndex repr round-trip as the nearby finding, with an assertion on the result. Benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/ranges/test_range.py:411:31 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        index = simple_index
        tm.assert_index_equal(eval(repr(index), dict(vars(pd))), index)

    def test_slice_keep_name(self):
```
dismissed LLM, confidence 0.95 Round-trips a fixture index through repr and eval in a pandas range test.
Reasoning
eval(repr(index)) on a fixture index, checking repr round-trip in a pandas test. Benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/test_old_base.py:226:31 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        idx = simple_index
        tm.assert_index_equal(eval(repr(idx), dict(vars(pd))), idx)

    def test_repr_max_seq_item_setting(self, simple_index):
```
dismissed LLM, confidence 0.95 Round-trips a fixture index through repr and eval in a pandas base-index test.
Reasoning
eval(repr(idx)) on a fixture index in a generic index test, a standard repr round-trip check.
info unicode-mixed-script pandas/tests/io/json/test_readlines.py:307:58 new in this release

identifier `АБВГДабвгд가` mixes scripts: Cyrillic + Hangul (in string/comment) (raw pass, confidence 0.40)
```
    result = pd.read_json(temp_file, engine=engine)
    expected = pd.DataFrame({"£©µÀÆÖÞßéöÿ": ["АБВГДабвгд가"]})
    tm.assert_frame_equal(result, expected)
```

info unicode-mixed-script pandas/tests/io/test_clipboard.py:52:46 new in this release

identifier `Ωœ` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    elif data_type == "utf8":
        return pd.DataFrame({"a": ["µasd", "Ωœ∑`"], "b": ["øπ∆˚¬", "œ∑`®"]})
    elif data_type == "utf16":
        return pd.DataFrame(

info unicode-mixed-script pandas/tests/io/test_clipboard.py:52:65 new in this release

identifier `øπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    elif data_type == "utf8":
        return pd.DataFrame({"a": ["µasd", "Ωœ∑`"], "b": ["øπ∆˚¬", "œ∑`®"]})
    elif data_type == "utf16":
        return pd.DataFrame(

info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_constructors.py:1029:26 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert repr(result) == expected
        assert result == eval(repr(result), dict(vars(pd)))

        # This should be 2013-11-01 05:00 in UTC
```
dismissed LLM, confidence 0.95 Round-trips a pandas Timestamp through repr and eval.
Reasoning
eval(repr(result), dict(vars(pd))) round-trips a Timestamp repr built in the test, checking that repr is valid. Benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_constructors.py:1037:26 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert repr(result) == expected
        assert result == eval(repr(result), dict(vars(pd)))

        # GH11708
```
dismissed LLM, confidence 0.95 Second Timestamp repr round-trip eval in a pandas constructor test.
Reasoning
Another Timestamp repr round-trip eval, in a GH11708 regression test. Benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_constructors.py:1046:26 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert repr(result) == expected
        assert result == eval(repr(result), dict(vars(pd)))

        # This should be 2015-11-18 10:00 in UTC
```
likely benign LLM, confidence 0.93 Test evaluates repr of a pandas Timestamp to check round-tripping.
Reasoning
Round-trip test evaluating repr of a Timestamp against pandas namespace; standard pandas test idiom on trusted, locally generated input.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_constructors.py:1054:26 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert repr(result) == expected
        assert result == eval(repr(result), dict(vars(pd)))

    def test_constructor_invalid(self):
```
likely benign LLM, confidence 0.93 Test evaluates repr of a Timestamp to verify round-trip equality.
Reasoning
Same repr round-trip eval in pandas test suite on self-generated repr output; not attacker-controlled.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_formats.py:206:29 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert freq_repr not in repr(date_only)
        assert date_only == eval(repr(date_only), dict(vars(pd)))

        date_tz = pd.Timestamp(date, tz=tz)
```
likely benign LLM, confidence 0.93 Test uses eval on repr of a date-only Timestamp to check round-trip.
Reasoning
Repr round-trip assertion over a locally created Timestamp in a test file; benign test idiom.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_formats.py:212:27 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert freq_repr not in repr(date_tz)
        assert date_tz == eval(repr(date_tz), dict(vars(pd)))

    def test_repr_utcoffset(self):
```
likely benign LLM, confidence 0.93 Test evaluates repr of a tz-aware Timestamp to check round-trip.
Reasoning
Repr round-trip eval of a locally constructed timezone-aware Timestamp; benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_formats.py:222:40 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        expr = repr(date_with_utc_offset)
        assert date_with_utc_offset == eval(expr, dict(vars(pd)))

    def test_timestamp_repr_pre1900(self):
```
likely benign LLM, confidence 0.93 Test evals repr of a Timestamp with a UTC offset.
Reasoning
Evaluates the repr of a locally constructed Timestamp with UTC offset in a test; benign.
info ~~warn~~ → info by review dynamic-execution pandas/tests/scalar/timestamp/test_formats.py:259:20 new in this release

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        for z in zs:
            assert eval(repr(z), dict(vars(pd))) == z

    def test_repr_matches_pydatetime_no_tz(self):
```
likely benign LLM, confidence 0.93 Test evals repr of Timestamps across zones to check round-trip.
Reasoning
Loop evaluating repr of locally generated timezone objects in a pandas test; benign round-trip check.

info unicode-homoglyph pandas/tests/series/methods/test_to_csv.py:125:55 new in this release

identifier `Κόσμε` contains homoglyph candidates: Κ (039A)→K (in string/comment) (raw pass, confidence 0.35)

            (
                pd.Series(["123", "Γειά σου", "Κόσμε"], name="Ελληνικά"),  # noqa: RUF001
                "cp737",
            ),

info unicode-mixed-script pandas/tests/series/methods/test_to_csv.py:125:55 new in this release

identifier `Κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            (
                pd.Series(["123", "Γειά σου", "Κόσμε"], name="Ελληνικά"),  # noqa: RUF001
                "cp737",
            ),

info ~~warn~~ → info by review dynamic-execution pandas/tests/util/test_find_stack_level.py:50:5 new in this release

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    module.__file__ = module_path
    exec(compile(_SRC, module_path, "exec"), module.__dict__)  # noqa: S102

    with warnings.catch_warnings(record=True) as record:
```
likely benign LLM, confidence 0.90 Test execs a constant source string as a module to check find_stack_level.
Reasoning
Compiles and executes a fixed module source string (_SRC) in a test to exercise warning stack levels; the code is a constant defined in the test, with a noqa acknowledging it.
info ~~warn~~ → info by review dynamic-execution pandas/tests/util/test_find_stack_level.py:50:10 new in this release

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    module.__file__ = module_path
    exec(compile(_SRC, module_path, "exec"), module.__dict__)  # noqa: S102

    with warnings.catch_warnings(record=True) as record:
```
likely benign LLM, confidence 0.90 Test compiles a constant source string for stack-level testing.
Reasoning
compile of the fixed _SRC constant with a test-controlled path; part of the same benign exec idiom.
info dynamic-execution subprojects/fast_float-8.2.10/ci/script.sh:15:3 new in this release

command name is a variable (`$TOOLCHAIN`) that this file sets only to plain text (ast pass, confidence 0.40)
```
if [ "$TOOLCHAIN" != "" ] ; then
  qemu-"$TOOLCHAIN" tests/basictest
else
  ctest --output-on-failure -R basictest
```

info long-line subprojects/fast_float-8.2.10/docs/index.html:38:1 new in this release

line length 657 characters (raw pass, confidence 0.50)

          <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .5C5.65.5.5 5.65.5 12c0 5.08 3.29 9.39 7.86 10.91.58.1.79-.25.79-.56v-2c-3.2.7-3.88-1.37-3.88-1.37-.52-1.33-1.27-1.69-1.27-1.69-1.04-.71.08-.7.08-.7 1.15.08 1.76 1.18 1.76 1.18 1.03 1.76 2.7 1.25 3.36.96.1-.74.

info ~~warn~~ → info by review dynamic-execution subprojects/fast_float-8.2.10/fuzz/build.sh:3:1 new in this release

command name is a variable (`$CXX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
$CXX $CFLAGS $CXXFLAGS \
     -I $SRC/fast_float/include \
     -c $SRC/fast_float/fuzz/from_chars.cc -o from_chars.o
```
likely benign LLM, confidence 0.80 Fuzz build script invokes the compiler from an environment variable.
Reasoning
Standard OSS-Fuzz build script where $CXX and $CFLAGS are provided by the fuzzing harness environment; variable compiler is expected here, not malicious.
info ~~warn~~ → info by review dynamic-execution subprojects/fast_float-8.2.10/fuzz/build.sh:7:1 new in this release

command name is a variable (`$CXX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
$CXX $CFLAGS $CXXFLAGS $LIB_FUZZING_ENGINE from_chars.o \
     -o $OUT/from_chars
```
likely benign LLM, confidence 0.80 Fuzz build script links using environment-provided compiler and engine.
Reasoning
Same OSS-Fuzz pattern: link step uses environment-provided $CXX and $LIB_FUZZING_ENGINE; expected in fuzzing infrastructure.
info identifier-low-length subprojects/fast_float-8.2.10/script/analysis.py:1:1 new in this release

46 of 83 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)

info long-line subprojects/fast_float-8.2.10/tests/basictest.cpp:1302:1 new in this release

line length 1084 characters (raw pass, confidence 0.50)

      0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044501

info long-line subprojects/fast_float-8.2.10/tests/basictest.cpp:1320:1 new in this release

line length 1084 characters (raw pass, confidence 0.50)

      0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022250

info long-line subprojects/fast_float-8.2.10/tests/basictest.cpp:1499:1 new in this release

line length 1084 characters (raw pass, confidence 0.50)

      0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044501

info long-line subprojects/fast_float-8.2.10/tests/basictest.cpp:1517:1 new in this release

line length 1084 characters (raw pass, confidence 0.50)

      0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022250

info ~~warn~~ → info by review dynamic-execution subprojects/xsimd-14.2.0/.github/workflows/android.yml:28:18 new in this release

[embedded bash] command name is a variable (`$ANDROID_HOME`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
          NDK="$($ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --list_installed | sed -E 's/( +[|] +)/|/g;s/ +$//' | grep '^  ndk' | cut -d '|' -f 4 | sort | head -n1)"
          cmake -B _build \
                -DCMAKE_TOOLCHAIN_FILE=$ANDROID_HOME/$NDK/build/cmake/android.toolchain.cmake \
```
likely benign LLM, confidence 0.85 CI step that locates Android sdkmanager via ANDROID_HOME to find the NDK for a CMake build.
Reasoning
The command path comes from the ANDROID_HOME environment variable in a CI workflow that installs the Android NDK and configures CMake. Using an env-var path as the command is a common, legitimate CI pattern, and the snippet shows no download-and-run or encoded payload.
info ~~warn~~ → info by review dynamic-execution subprojects/xsimd-14.2.0/docs/source/conf.py:10:5 new in this release

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
if on_rtd:
    subprocess.check_call('cd ..; doxygen', shell=True)

import sphinx_rtd_theme
```
likely benign LLM, confidence 0.92 Sphinx docs config that runs a hardcoded doxygen build command via shell when on Read the Docs.
Reasoning
This is a standard Sphinx conf.py that runs a fixed, literal doxygen command under the Read the Docs branch. There is no interpolated input and no network activity.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/common/xsimd_common_math.hpp:2033:88 new in this release

two identifiers collapse to visual skeleton `to` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
        template <class A, class T>
        XSIMD_INLINE batch<T, A> nextafter(batch<T, A> const& from, batch<T, A> const& to, requires_arch<common>) noexcept
        {
            using kernel = detail::nextafter_kernel<T, A>;
```
likely benign LLM, confidence 0.80 Parameter named 'to' in an xsimd nextafter overload, flagged for a confusable-identifier collision.
Reasoning
The token pass flagged a confusable skeleton collision, but the snippet is an ordinary nextafter signature with parameters named from and to. Visual-skeleton collisions between ordinary short identifiers are a known false-positive pattern for this signal.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/common/xsimd_common_memory.hpp:790:24 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            real_batch hi = real_batch::load_aligned(buffer),
                       lo = real_batch::load_aligned(buffer + real_batch::size);
            return detail::load_complex(hi, lo, A {});
        }
```
likely benign LLM, confidence 0.85 Local hi/lo variables in a complex-number load helper, flagged for a confusable-identifier collision.
Reasoning
The snippet uses hi and lo as ordinary local names for the high and low halves of a complex load. The collision is a false positive from the skeleton matching on short identifiers, not a homoglyph attack.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_avx.hpp:895:119 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            template <class A>
            XSIMD_INLINE batch<std::complex<float>, A> load_complex(batch<float, A> const& hi, batch<float, A> const& lo, requires_arch<avx>) noexcept
            {
                using batch_type = batch<float, A>;
```
likely benign LLM, confidence 0.85 AVX load_complex helper with hi/lo parameters, flagged for a confusable-identifier collision.
Reasoning
The snippet uses hi and lo as ordinary parameter names in a standard AVX load_complex implementation. The confusable-skeleton hit is a false positive on short names.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_avx512f.hpp:248:54 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            // zero-extend 256 -> 512 (low) and place-into-high variants
            XSIMD_INLINE __m512i zero_extend(__m256i lo) noexcept { return _mm512_zextsi256_si512(lo); }
            XSIMD_INLINE __m512 zero_extend(__m256 lo) noexcept { return _mm512_zextps256_ps512(lo); }
```
likely benign LLM, confidence 0.85 AVX-512 zero_extend overloads with a lo parameter, flagged for a confusable-identifier collision.
Reasoning
The snippet is ordinary AVX-512 zero_extend overloads with a lo parameter that wrap intrinsics. The token collision is a false positive on common short identifiers.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_sse2.hpp:1216:119 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            template <class A>
            XSIMD_INLINE batch<std::complex<float>, A> load_complex(batch<float, A> const& hi, batch<float, A> const& lo, requires_arch<sse2>) noexcept
            {
```
likely benign LLM, confidence 0.85 SSE2 load_complex helper with hi/lo parameters, flagged for a confusable-identifier collision.
Reasoning
The snippet is a standard SSE2 load_complex implementation using hi and lo parameter names. The confusable-skeleton hit is a false positive.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_vsx.hpp:442:119 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            template <class A>
            XSIMD_INLINE batch<std::complex<float>, A> load_complex(batch<float, A> const& hi, batch<float, A> const& lo, requires_arch<vsx>) noexcept
            {
                __vector unsigned char perme = { 0, 1, 2, 3, 8, 9, 10, 11, 16, 17, 18, 19, 24, 25, 26, 27 };
```
likely benign LLM, confidence 0.85 VSX load_complex helper with hi/lo parameters, flagged for a confusable-identifier collision.
Reasoning
The snippet is a standard VSX load_complex implementation with hi and lo parameters and a permute vector. The confusable-skeleton hit is a false positive on short identifiers.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_vxe.hpp:103:119 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            template <class A>
            XSIMD_INLINE batch<std::complex<float>, A> load_complex(batch<float, A> const& hi, batch<float, A> const& lo, requires_arch<vxe>) noexcept
            {
                // Interleave real and imaginary parts
```
likely benign LLM, confidence 0.85 VXE load_complex helper with hi/lo parameters, flagged for a confusable-identifier collision.
Reasoning
The snippet is a standard VXE load_complex implementation with hi and lo parameters. The confusable-skeleton hit is a false positive on short identifiers.
info ~~warn~~ → info by review identifier-confusable-collision subprojects/xsimd-14.2.0/include/xsimd/arch/xsimd_wasm.hpp:910:119 new in this release

two identifiers collapse to visual skeleton `|o` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
            template <class A>
            XSIMD_INLINE batch<std::complex<float>, A> load_complex(batch<float, A> const& hi, batch<float, A> const& lo, requires_arch<wasm>) noexcept
            {
                return { wasm_i32x4_shuffle(hi, lo, 0, 2, 4, 6), wasm_i32x4_shuffle(hi, lo, 1, 3, 5, 7) };
```
likely benign LLM, confidence 0.85 WASM load_complex helper with hi/lo parameters, flagged for a confusable-identifier collision.
Reasoning
The snippet is a standard WASM load_complex implementation with hi and lo parameters and shuffle intrinsics. The confusable-skeleton hit is a false positive on short identifiers.

info long-line subprojects/xsimd-14.2.0/include/xsimd/types/xsimd_traits.hpp:177:1 new in this release

line length 600 characters (raw pass, confidence 0.50)

            static constexpr bool value = (std::is_same<T1, T2>::value && !std::is_same<T1, bool>::value) || (std::is_same<T1, bool>::value && !std::is_same<T2, bool>::value) || std::is_same<T1, float>::value || std::is_same<T1, double>::value || std::is_same<T1, int8_t>::value || std::is_same<T1, uint8_t>::value || st

info dynamic-execution subprojects/xsimd-14.2.0/test/check_arch.sh:11:9 new in this release

command name is a variable (`$CXX`) that this file sets only to plain text (ast pass, confidence 0.40)

        echo "# $arch" ; \
        $CXX -w -march=$arch sanity_check.cpp -fsyntax-only ;  \
        $CXX -w -I../include -march=$arch xsimd_check.cpp -fsyntax-only ; \
    done

info dynamic-execution subprojects/xsimd-14.2.0/test/check_arch.sh:12:9 new in this release

command name is a variable (`$CXX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
        $CXX -w -march=$arch sanity_check.cpp -fsyntax-only ;  \
        $CXX -w -I../include -march=$arch xsimd_check.cpp -fsyntax-only ; \
    done
```
info ~~critical~~ → info by review format-string-write subprojects/xsimd-14.2.0/test/test_batch_constant.cpp:159:85 new in this release

printf format directive `% n` writes to memory (in string literal) (token pass, confidence 0.90)
```
        constexpr auto n0 = xsimd::make_batch_constant<value_type, constant<0>, arch_type>();
        static_assert(std::is_same<decltype(n12_mod_n3), decltype(n0)>::value, "n12 % n3 == n0");
        constexpr auto n12_mod_c3 = n12 % c3;
```
dismissed LLM, confidence 0.92 Unit test static_assert whose message string contains a literal '% n' with no printf call, flagged as a format-string write.
Reasoning
The '% n' is inside a static_assert message string literal ('n12 % n3 == n0') and is plain text, not a printf format. The line is also a C++ modulo expression on batch constants, so there is no %n write. The critical severity is a false positive.
info ~~warn~~ → info by review dynamic-import subprojects/xsimd-14.2.0/test/test_wasm/test_wasm.sh:21:5 new in this release

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
    EMSCRIPTEN_DIR=$1
    source $EMSCRIPTEN_DIR/emsdk_env.sh
fi
```
likely benign LLM, confidence 0.90 A bash test script sources the Emscripten SDK environment file from a user-supplied directory path.
Reasoning
This is a test script for the xsimd library's WebAssembly tests. It sources emsdk_env.sh from a directory supplied as a command-line argument ($1), which is the standard way to activate the Emscripten SDK. The dynamic path is a user-provided build parameter, not attacker-controlled remote content, and there is no download, decode, or network activity in the snippet.

info long-line README.md:13:1

line length 503 characters (raw pass, confidence 0.50)

| Package | [![PyPI Latest Release](https://img.shields.io/pypi/v/pandas.svg)](https://pypi.org/project/pandas/) [![PyPI Downloads](https://img.shields.io/pypi/dm/pandas.svg?label=PyPI%20downloads)](https://pypi.org/project/pandas/) [![Conda Latest Release](https://anaconda.org/conda-forge/pandas/badges/version.svg)](h

info long-line README.md:14:1

line length 750 characters (raw pass, confidence 0.50)

| Meta | [![Powered by NumFOCUS](https://img.shields.io/badge/powered%20by-NumFOCUS-orange.svg?style=flat&colorA=E1523D&colorB=007D8A)](https://numfocus.org) [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.3509134.svg)](https://doi.org/10.5281/zenodo.3509134) [![License - BSD 3-Clause](https://img.shields.io/pypi/l

info ~~critical~~ → info by review dynamic-import pandas/__init__.py:11:9

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        __import__(_dependency)
    except ImportError as _e:  # pragma: no cover
        raise ImportError(
```
dismissed LLM, confidence 0.90 Dynamic __import__ of a required dependency name during pandas package initialization.
Reasoning
The __import__ call sits inside a try block in pandas' dependency check loop over required packages such as numpy and dateutil, and it re-raises a clear ImportError. This is a standard optional or required dependency import pattern, not obfuscation.
info ~~warn~~ → info by review frame-introspection pandas/_testing/_warnings.py:269:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow
    frame = inspect.currentframe()
    for _ in range(4):
        frame = frame.f_back  # type: ignore[union-attr]
```
dismissed LLM, confidence 0.90 Call-stack walk via inspect.currentframe to attribute warnings to the correct caller.
Reasoning
The code walks four frames up to find the caller for warning stacklevel. The comment cites a known StackOverflow discussion about inspect.stack being slow, which indicates a deliberate, legitimate use.
info ~~warn~~ → info by review frame-introspection pandas/core/common.py:723:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = sys._getframe(2)
    for v in frame.f_locals.values():
        if v is obj:
```
dismissed LLM, confidence 0.90 Iterates caller frame locals to test identity of an object.
Reasoning
The code reads f_locals of a caller frame to check whether an object is bound in that scope. This is a local introspection helper consistent with pandas' eval machinery.
info ~~warn~~ → info by review dynamic-execution pandas/core/computation/ops.py:432:23

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                res = eval(self, local_dict=env, engine=engine, parser=parser)

        name = env.add_tmp(res)
```
likely benign LLM, confidence 0.80 Invokes the expression-engine eval method on an internal operator node.
Reasoning
The call is eval(self, ...) inside an operator class, where eval is an expression-evaluation method on pandas' own Term/Op objects, not an arbitrary string passed to builtin eval. Pandas' query engine is designed this way.
info ~~warn~~ → info by review frame-introspection pandas/core/computation/scope.py:168:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        frame = sys._getframe(self.level)

        try:
```
dismissed LLM, confidence 0.90 Frame retrieval at a given level to resolve variable scope for eval.
Reasoning
The code fetches the frame at self.level to capture variable scope for query evaluation. This is the documented purpose of the pandas eval scope mechanism.
info ~~warn~~ → info by review frame-introspection pandas/core/computation/scope.py:305:17

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # makes sure that we can capture variable scope
        stack = inspect.stack()

        try:
```
dismissed LLM, confidence 0.90 Captures the call stack to resolve variable scope for expression evaluation.
Reasoning
inspect.stack captures the caller stack so that local and global variables can be resolved for query expressions. This is a standard scope-capture technique.
info ~~warn~~ → info by review dynamic-attribute pandas/core/generic.py:3760:18

reach-by-name through `vars` (ast pass, confidence 0.60)
```
        ]:
            kw = vars()[kw_name]
            if isinstance(kw, dict):
                getattr(styler, kw_name)(**kw)
```
likely benign LLM, confidence 0.85 Looks up local variables by name to forward keyword arguments to a Styler method.
Reasoning
vars() is read by keyword name to pull styler keyword arguments from the enclosing function's locals. The access is confined to a fixed set of known names, so it is a readable parameter-forwarding idiom, not hidden behavior.
info ~~warn~~ → info by review payload-bytes-literal pandas/io/sas/sas_constants.py:6:5

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
magic: Final = (
    b"\x00\x00\x00\x00\x00\x00\x00\x00"
    b"\x00\x00\x00\x00\xc2\xea\x81\x60"
    b"\xb3\x14\x11\xcf\xbd\x92\x08\x00"
```
dismissed LLM, confidence 0.90 Byte-literal magic signature constant for parsing SAS file headers.
Reasoning
This is the magic-number header for SAS binary file format, a fixed byte sequence that the reader compares against. Long \x escape bytes are the normal way to express such constants.
info ~~warn~~ → info by review dynamic-execution pandas/tests/computation/test_eval.py:789:36

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert res.values.dtype == dtype
        tm.assert_frame_equal(res, eval(s), check_exact=False)
```
likely benign LLM, confidence 0.85 Test helper evaluating a test expression string to build an expected result.
Reasoning
This is a test that evaluates a test-supplied expression string to compare against pandas eval output. Test code routinely uses eval for this, and the input is a fixed test string, not untrusted data.
info ~~warn~~ → info by review dynamic-execution pandas/tests/computation/test_eval.py:1092:15

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        res = self.eval(ex)
        exp = eval(ex)
        assert res == exp
```
likely benign LLM, confidence 0.85 Test computes an expected result by evaluating a fixed expression string.
Reasoning
The test computes an expected value with eval on a fixed expression string and compares it to the engine result. This is standard test practice with no external input.
info ~~warn~~ → info by review dynamic-execution pandas/tests/computation/test_eval.py:1108:15

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        res = self.eval(ex)
        exp = eval(ex)
        assert res == exp
```
likely benign LLM, confidence 0.85 Test computes an expected result by evaluating a fixed expression string.
Reasoning
Same pattern as the sibling test: eval of a hard-coded test expression to compare with the engine output. Nothing in the snippet is attacker-controlled.
info ~~warn~~ → info by review dynamic-execution pandas/tests/frame/methods/test_sample.py:194:47

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        obj = tm.get_obj(obj, frame_or_series)
        result = obj.sample(n=3, random_state=eval(func_str)(arg))
        expected = obj.sample(n=3, random_state=com.random_state(eval(func_str)(arg)))
        tm.assert_equal(result, expected)
```
dismissed LLM, confidence 0.92 Evaluates a parametrized numpy random-state constructor name inside a pandas sampling test.
Reasoning
func_str comes from a pytest parametrize list of numpy random-state constructors such as np.random.RandomState. The eval runs only trusted, test-defined strings, and it is used to compare sample() against com.random_state.
info ~~warn~~ → info by review dynamic-execution pandas/tests/frame/methods/test_sample.py:195:66

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        result = obj.sample(n=3, random_state=eval(func_str)(arg))
        expected = obj.sample(n=3, random_state=com.random_state(eval(func_str)(arg)))
        tm.assert_equal(result, expected)
```
dismissed LLM, confidence 0.92 Second eval of the parametrized random-state constructor in the same pandas sampling test.
Reasoning
Same parametrized func_str eval as the preceding line, used to build the expected result of a seeded sample. Test-only and benign.

info unicode-homoglyph pandas/tests/frame/methods/test_to_csv.py:1077:52

identifier `Κόσμε` contains homoglyph candidates: Κ (039A)→K (in string/comment) (raw pass, confidence 0.35)

                pd.DataFrame(
                    5 * [[123, "Γειά σου", "Κόσμε"]],  # noqa: RUF001
                    columns=["X", "Y", "Z"],
                ),

info unicode-mixed-script pandas/tests/frame/methods/test_to_csv.py:1077:52

identifier `Κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

                pd.DataFrame(
                    5 * [[123, "Γειά σου", "Κόσμε"]],  # noqa: RUF001
                    columns=["X", "Y", "Z"],
                ),

info ~~warn~~ → info by review dynamic-execution pandas/tests/indexes/categorical/test_category.py:203:31

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        str(ci)
        tm.assert_index_equal(eval(repr(ci)), ci, exact=True)

        # formatting
```
dismissed LLM, confidence 0.95 Round-trips a CategoricalIndex through repr and eval in a formatting test.
Reasoning
eval(repr(ci)) round-trips a CategoricalIndex built locally in the test, checking that its repr reconstructs an equal index.

info unicode-mixed-script pandas/tests/io/json/test_readlines.py:304:46

identifier `АБВГДабвгд가` mixes scripts: Cyrillic + Hangul (in string/comment) (raw pass, confidence 0.40)

    with open(temp_file, "w", encoding="utf-8") as f:
        f.write('{"£©µÀÆÖÞßéöÿ":["АБВГДабвгд가"]}')

    result = pd.read_json(temp_file, engine=engine)

info unicode-mixed-script pandas/tests/io/parser/common/test_common_basic.py:750:61

identifier `sй` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)


@pytest.mark.parametrize("filename", ["sé-es-vé.csv", "ru-sй.csv", "中文文件名.csv"])
def test_filename_with_special_chars(all_parsers, filename, tmp_path):
    # see gh-15086.

info ~~warn~~ → info by review frame-introspection pandas/tests/io/parser/common/test_common_basic.py:801:5

`sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
    sys.setprofile(lambda *a, **k: None)
    result = getattr(parser, read_func)(StringIO(data))
    sys.setprofile(None)
```
likely benign LLM, confidence 0.85 Installs a no-op profiler hook around a CSV parse in a pandas parser test.
Reasoning
sys.setprofile with a no-op lambda is a test of how the C parser behaves under a profiler, bracketed by setprofile(None). It has no network, file, or payload behaviour, though the profiler hook is unusual.
info ~~warn~~ → info by review frame-introspection pandas/tests/io/parser/common/test_common_basic.py:803:5

`sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
    result = getattr(parser, read_func)(StringIO(data))
    sys.setprofile(None)

    expected = pd.DataFrame({"a b": ["0 1"]})
```
likely benign LLM, confidence 0.85 Clears the no-op profiler hook after a pandas parser test read.
Reasoning
Resets the profiler hook installed in the preceding lines. It is the cleanup half of the same benign no-op profiling test.

info unicode-mixed-script pandas/tests/io/test_clipboard.py:418:57

identifier `Ωœ` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)


    @pytest.mark.parametrize("data", ["\U0001f44d...", "Ωœ∑`...", "abcd..."])
    def test_raw_roundtrip(self, data):
        # PR #25040 wide unicode wasn't copied correctly on PY3 on windows

info unicode-mixed-script pandas/tests/io/test_stata.py:1920:15

identifier `ᴘᴀᴎᴅᴀS` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

            ["ƤĀńĐąŜ", "Ö", "a", "ƤĀńĐąŜ", "a"],
            ["ᴘᴀᴎᴅᴀS", "Ü", "n", "ᴘᴀᴎᴅᴀS", "n"],
            ["      ", "      ", "d", "      ", "d"],
            [" ", "", "a", " ", "a"],

info unicode-mixed-script pandas/tests/io/test_stata.py:1920:46

identifier `ᴘᴀᴎᴅᴀS` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

            ["ƤĀńĐąŜ", "Ö", "a", "ƤĀńĐąŜ", "a"],
            ["ᴘᴀᴎᴅᴀS", "Ü", "n", "ᴘᴀᴎᴅᴀS", "n"],
            ["      ", "      ", "d", "      ", "d"],
            [" ", "", "a", " ", "a"],

info unicode-mixed-script pandas/tests/io/test_stata.py:2046:23

identifier `ᴅaᵀa` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

        }
        data_label = "ᴅaᵀa-label"
        value_labels = {"β": {1: "label", 2: "æøå", 3: "ŋot valid latin-1"}}
        data["β"] = data["β"].astype(np.int32)

info ~~warn~~ → info by review encoding-base64 pandas/tests/util/test_hashing.py:400:17

base64-like blob (505 bytes, compression ratio 0.80) (raw pass, confidence 0.60)
```
        "Ingrid-9Z9fKIZmkO7i7Cn51Li34pJm44fgX6DYGBNj3VPlOH50m7HnBlPxfIwFMrcNJNMP6PSgLmwWnInciMWrCSAlLEvt7JkJl4IxiMrVbXSa8ZQoVaq5xoQPjltuJEfwdNlO6jo8qRRHvD8sBEBMQASrRa6TsdaPTPCBo3nwIBpE7YzzmyH0vMBhjQZLx1aCT7faSEx7PgFxQhHdKFWROcysamgy9iVj8DO2Fmwg1NNl93rIAqC3mdqfrCxrzfvIY8aJdzin2cHVzy3QUJxZgHvtUtOLxoqnUHsYbNTeq0xcLXpTZEZC
```
likely benign LLM, confidence 0.90 Long random-looking string literal used as hashing test input.
Reasoning
Long string literal in a hashing test vector; base64-like text here is test data for hash outputs, not an encoded payload executed anywhere.
info ~~warn~~ → info by review encoding-base64 pandas/tests/util/test_hashing.py:401:14

base64-like blob (508 bytes, compression ratio 0.80) (raw pass, confidence 0.60)
```
        "Tim-b9MddTxOWW2AT1Py6vtVbZwGAmYCjbp89p8mxsiFoVX4FyDOF3wFiAkyQTUgwg9sVqVYOZo09Dh1AzhFHbgij52ylF0SEwgzjzHH8TGY8Lypart4p4onnDoDvVMBa0kdthVGKl6K0BDVGzyOXPXKpmnMF1H6rJzqHJ0HywfwS4XYpVwlAkoeNsiicHkJUFdUAhG229INzvIAiJuAHeJDUoyO4DCBqtoZ5TDend6TK7Y914yHlfH3g1WZu5LksKv68VQHJriWFYusW5e6ZZ6dKaMjTwEGuRgdT66iU5nqWTHRH8WSzpX
```
likely benign LLM, confidence 0.90 Long random-looking string literal used as hashing test input.
Reasoning
Another random-looking string test vector in a hashing test; raw-pass encoding heuristic false positive.
info ~~warn~~ → info by review frame-introspection pandas/util/_exceptions.py:59:31

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow
    frame: FrameType | None = inspect.currentframe()
    try:
        n = 0
```
likely benign LLM, confidence 0.92 Uses inspect.currentframe to walk the stack for warning stack levels.
Reasoning
Standard use of inspect.currentframe to find the caller's stack level for warnings in pandas utilities; a common legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pandas-3.1.0.tar.gz https://files.pythonhosted.org/packages/55/b1/a10c0d1a7e3ce44eb42635771004aa503e3b9ddde0bd39c524dda65f7eff/pandas-3.1.0.tar.gz
printf '%s  %s\n' ecb9b2d8a817b1e1ba1fdb90c0abe9eab31b4fdf2562b7a56b86ac66ace17e49 pandas-3.1.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf pandas-3.1.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg