disclude.iopyarrow 26.0.0
- Source
- https://github.com/apache/arrow
- Artifact scanned
pyarrow-26.0.0.tar.gz- Compared with
pyarrow-25.0.1.tar.gz(0 signals introduced since)- Files
- 197 scanned, 135 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 18 info
- Scan time
- 7.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 03:21
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign Build script sources the conda activation profile from a variable install path.
Reasoning
Sourcing conda's profile script from a MINICONDA install path is a standard, legitimate build-script pattern; the variable is a local install location, not attacker-controlled input.
-
likely benign Build script activates a venv it just created via a variable path.
Reasoning
Activating a virtualenv created one line earlier in the same script at $WORKDIR/venv is ordinary build tooling with no remote or encoded input.
-
returnlikely benign Module looks up a function class by name in globals() to expose compute bindings.Reasoning
Looking up generated wrapper function classes in module globals by name is a common Python dispatch idiom in pyarrow; the lookup key is internal and it warns on KeyError.
-
= -
= -
= -
= -
= = -
= = -
= = -
= = -
# SELECT str WHERE i64 = 4 =likely benign Test embeds a serialized Substrait projection plan as a bytes literal.Reasoning
The bytes literal is a serialized Substrait plan with a readable URL and extension names, which is a protobuf encoding of a test query, not a hidden payload.
-
b) =likely benign Test embeds a serialized Substrait filter plan as a bytes literal.Reasoning
Same pattern as the other Substrait test: protobuf-encoded filter and extension URIs used as test fixtures, consistent with the surrounding query tests.
-
= =likely benign Test calls pyarrow's decompress API on test data to verify codec round trips.Reasoning
pa.decompress is the pyarrow codec API exercised on test buffers in a compression test; there is no embedded hidden payload or execution of decompressed content.
-
# SELECT project_release, project_version =likely benign Test embeds a serialized Substrait project message as a bytes literal.Reasoning
The bytes are a Substrait protobuf plan containing readable field names and a SQL-derived projection, matching the test's documented SELECT query.
-
assert is not None assert is Nonelikely benign Test uses sys._getframe to clear traceback cycles before a weakref check.Reasoning
Test helper uses sys._getframe(0) to break traceback reference cycles for a weakref test, a standard and harmless debugging-style use.
-
# reference cycle. = =likely benign pyarrow utility inspects its own frame and gc referrers to break reference cycles.Reasoning
Library utility inspects its own frame and gc referrers to break reference cycles when a frame is kept alive; this is a documented memory-management technique, not malicious introspection.
-
= continuelikely benign Developer script resolves module attributes by name to update stub docstrings.Reasoning
Using vars(parent).get(part) to resolve attribute names when generating stub docstrings is ordinary introspection in a developer script.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&