PyPI / prompt_toolkit / 3.0.53

prompt_toolkit 3.0.53

Source

https://github.com/prompt-toolkit/python-prompt-toolkit

Tag scanned

3.0.53

Compared with

3.0.52 (1 signals introduced since)

Files

330 scanned, 45 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 04:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute src/prompt_toolkit/__init__.py:59:16 new in this release

   reach-by-name through `globals` (ast pass, confidence 0.60)

           _load_version()
           return globals()[name]
       raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

   likely benign LLM, confidence 0.93 Lazy module attribute lookup via globals() in prompt_toolkit's package init.

   Reasoning

   Module-level __getattr__ that returns globals()[name] is a standard lazy-loading/version-attribute pattern. It only reads module globals, with no dynamic code execution or external resolution.

2. info warn → info by review dynamic-execution examples/full-screen/calculator.py:53:59

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               output = f"\n\nIn:  {input_field.text}\nOut: {eval(input_field.text)}"  # Don't do 'eval' in real code!
           except BaseException as e:
               output = f"\n\n{e}"

   likely benign LLM, confidence 0.95 Example calculator script that evals user-typed expressions for display.

   Reasoning

   eval on user input in an example calculator app; the inline comment explicitly warns against eval in real code. It is a demonstration of a calculator, not hidden malicious execution, and it is not an obfuscated dropper.

3. info warn → info by review frame-introspection src/prompt_toolkit/application/application.py:966:24

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

                       and "IPython/terminal/interactiveshell.py"
                       in sys._getframe(3).f_code.co_filename
                   )
               except BaseException:

   likely benign LLM, confidence 0.92 Frame inspection to detect if the app is running under IPython's interactive shell.

   Reasoning

   sys._getframe(3) is used inside a try block to detect whether the code runs inside IPython, a common and legitimate environment-detection technique for a terminal UI library. It is guarded by BaseException handling and does not exfiltrate or execute anything.

4. info warn → info by review frame-introspection src/prompt_toolkit/application/application.py:1130:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

   
           frame = sys._getframe().f_back
           CustomPdb(stdout=sys.__stdout__).set_trace(frame)

   likely benign LLM, confidence 0.93 Debugger helper that starts a custom pdb trace at the caller's frame.

   Reasoning

   sys._getframe().f_back is used to pass the caller's frame to a debugger's set_trace, which is the expected implementation of a debugging helper (open pdb at the caller). This is legitimate debugging functionality in a library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/prompt-toolkit/python-prompt-toolkit python-prompt-toolkit && cd python-prompt-toolkit
git checkout 3.0.53
disclude scan --severity info --diff 3.0.52 .