PyPI / prompt_toolkit / 3.0.53

prompt_toolkit 3.0.53

Source

https://github.com/prompt-toolkit/python-prompt-toolkit

Tag scanned

3.0.53

Compared with

3.0.52 (1 signals introduced since)

Files

330 scanned, 45 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute src/prompt_toolkit/__init__.py:59:16 new in this release

   reach-by-name through `globals` (ast pass, confidence 0.60)

           _load_version()
           return globals()[name]
       raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

   dismissed LLM, confidence 0.90 A module __getattr__ hook in prompt_toolkit that resolves lazily-defined attributes via globals().

   Reasoning

   This is the standard PEP 562 module-level __getattr__ lazy-loading pattern: it calls _load_version and then looks up a global by name. The globals() lookup is a normal idiom for lazy attributes in a library's package init.

2. info warn → info by review dynamic-execution examples/full-screen/calculator.py:53:59

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               output = f"\n\nIn:  {input_field.text}\nOut: {eval(input_field.text)}"  # Don't do 'eval' in real code!
           except BaseException as e:
               output = f"\n\n{e}"

   likely benign LLM, confidence 0.90 A calculator example evaluates user-entered text with eval, with a comment warning against this practice.

   Reasoning

   eval is applied to user-typed input in a calculator demo; the inline comment explicitly warns against eval in real code. It is a deliberate, documented example of a dangerous pattern, not obfuscation or hidden malicious intent, and it only evaluates input the local user types.

3. info warn → info by review frame-introspection src/prompt_toolkit/application/application.py:966:24

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

                       and "IPython/terminal/interactiveshell.py"
                       in sys._getframe(3).f_code.co_filename
                   )
               except BaseException:

   likely benign LLM, confidence 0.85 Checks the caller's filename via sys._getframe to detect whether running inside IPython's terminal shell.

   Reasoning

   sys._getframe(3) is used to detect whether the code runs inside IPython's interactive shell by checking the caller's filename, wrapped in a try/except. This is a legitimate environment-detection technique for a terminal library, with no sign of exfiltration or hidden behavior.

4. info warn → info by review frame-introspection src/prompt_toolkit/application/application.py:1130:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

   
           frame = sys._getframe().f_back
           CustomPdb(stdout=sys.__stdout__).set_trace(frame)

   dismissed LLM, confidence 0.90 Retrieves the caller's frame to start a custom pdb debugger trace from that point.

   Reasoning

   sys._getframe().f_back is used to pass the caller's frame to a pdb subclass's set_trace, which is the normal way to implement a debugger entry point (similar to breakpoint()). It is a conventional debugging utility in a terminal library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/prompt-toolkit/python-prompt-toolkit python-prompt-toolkit && cd python-prompt-toolkit
git checkout 3.0.53
disclude scan --severity info --diff 3.0.52 .