PyPI / prompt_toolkit / 3.0.53

prompt_toolkit 3.0.53

Source

https://github.com/prompt-toolkit/python-prompt-toolkit

Artifact scanned

prompt_toolkit-3.0.53-py3-none-any.whl (wheel · 383.1 KB · SHA-256 01c0891d7f92…)

Compared with

prompt_toolkit-3.0.52-py3-none-any.whl (1 signals introduced since)

Files

147 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 06:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute prompt_toolkit/__init__.py:59:16 new in this release

   reach-by-name through `globals` (ast pass, confidence 0.60)

           _load_version()
           return globals()[name]
       raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

   likely benign LLM, confidence 0.93 Module __getattr__ that lazily resolves attributes such as __version__ from globals.

   Reasoning

   Module-level __getattr__ returning globals()[name] after lazy version loading is a standard lazy-attribute pattern; no execution or network use. The finding is a dynamic-attribute heuristic on a benign library file.

2. info warn → info by review frame-introspection prompt_toolkit/application/application.py:966:24

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

                       and "IPython/terminal/interactiveshell.py"
                       in sys._getframe(3).f_code.co_filename
                   )
               except BaseException:

   likely benign LLM, confidence 0.90 Inspects the caller's frame filename to detect running under IPython's terminal shell.

   Reasoning

   sys._getframe(3) is used inside a try/except to detect whether the call originates from IPython's interactive shell, a common compatibility check in prompt_toolkit for IPython integration. It only reads a filename and has no malicious behavior.

3. info warn → info by review frame-introspection prompt_toolkit/application/application.py:1130:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

   
           frame = sys._getframe().f_back
           CustomPdb(stdout=sys.__stdout__).set_trace(frame)

   likely benign LLM, confidence 0.90 Gets the calling frame and starts a custom pdb trace from it, a debugging helper.

   Reasoning

   Retrieves the caller frame to start a debugger at that point, which is the expected behavior of a debugging helper (run_in_terminal/pdb-style set_trace). Frame introspection for debugging is legitimate and not hidden or exfiltrating.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o prompt_toolkit-3.0.53-py3-none-any.whl https://files.pythonhosted.org/packages/54/6f/84908cad2d6aa5144abcf7b42709fe4fdb459bc640ec7ac5786e7693dabc/prompt_toolkit-3.0.53-py3-none-any.whl
printf '%s  %s\n' 01c0891d7f9237d5e339f7d3e42cdae80b7534abb1c7c0e3352efba6231492f2 prompt_toolkit-3.0.53-py3-none-any.whl | shasum -a 256 -c -
unzip -q prompt_toolkit-3.0.53-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg