pydantic 2.14.1

Source: https://github.com/pydantic/pydantic
Artifact scanned: pydantic-2.14.1-py3-none-any.whl (wheel · 476.7 KB · SHA-256 9195d967ec79…)
Compared with: pydantic-2.14.0-py3-none-any.whl (0 signals introduced since)
Files: 105 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 7.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-22 23:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute pydantic/__init__.py:448:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        result = import_module(f'.{attr_name}', package=package)
        globals()[attr_name] = result
        return result
    else:
```
likely benign LLM, confidence 0.93 Lazy submodule loader that imports a package attribute by name and caches it in module globals.
Reasoning
The snippet is the standard lazy-import pattern: a module-level __getattr__ imports a submodule by name with import_module and caches it in globals(). The target name comes from the module's own attribute lookup, with no decoding, network access, or process spawning, so it is ordinary library code.
info ~~warn~~ → info by review frame-introspection pydantic/_internal/_docs_extraction.py:53:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
def _extract_source_from_frame(cls: type[Any]) -> list[str] | None:
    frame = inspect.currentframe()

    while frame:
```
likely benign LLM, confidence 0.90 Walks the call stack via inspect.currentframe to extract source text for a class's docs.
Reasoning
inspect.currentframe is used to walk the call stack while extracting class source documentation. This is a known way to locate a class's definition for docstring extraction, and the snippet shows nothing beyond reading frames.
info ~~warn~~ → info by review frame-introspection pydantic/_internal/_generics.py:177:33

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        previous_caller_frame = sys._getframe(depth)
    except ValueError as e:
        raise RuntimeError('This function must be used inside another function') from e
```
likely benign LLM, confidence 0.92 Fetches a caller frame at a given depth to resolve generic-model namespaces.
Reasoning
sys._getframe(depth) is used to find the caller's frame so generic parametrization can resolve the parent namespace. It is wrapped in a ValueError guard that raises a clear error, which is typical of library internals.
info ~~warn~~ → info by review frame-introspection pydantic/_internal/_typing_extra.py:173:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = sys._getframe(parent_depth)

    if frame.f_code.co_name.startswith('<generic parameters of'):
```
likely benign LLM, confidence 0.92 Reads a parent frame's code name to detect generic-parameter scopes during type resolution.
Reasoning
sys._getframe(parent_depth) reads the caller's code name to detect generic-parameter scopes in typing helpers. It only inspects frame metadata and does not execute anything.
info ~~warn~~ → info by review frame-introspection pydantic/main.py:1911:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    if __module__ is None:
        f = sys._getframe(1)
        __module__ = f.f_globals['__name__']
```
likely benign LLM, confidence 0.93 Reads the caller's module name from its frame globals to set a default __module__.
Reasoning
sys._getframe(1) reads the caller's f_globals['__name__'] to default __module__ when a class is created without one. This is a standard idiom for setting a class's module and has no side effects.
info ~~warn~~ → info by review frame-introspection pydantic/type_adapter.py:217:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def _fetch_parent_frame(self) -> FrameType | None:
        frame = sys._getframe(self._parent_depth)
        if frame.f_globals.get('__name__') == 'typing':
            # Because `TypeAdapter` is generic, explicitly parametrizing the class results
```
likely benign LLM, confidence 0.92 Fetches the parent frame to resolve namespace for TypeAdapter type evaluation.
Reasoning
sys._getframe(self._parent_depth) is used to locate the parent frame for namespace resolution in TypeAdapter. The code only checks the frame's globals for a typing module name, which is consistent with pydantic's documented parent-namespace handling.
info ~~warn~~ → info by review frame-introspection pydantic/type_adapter.py:355:20

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # and so we skip the globalns = get_module_ns_of(typ) call that would normally happen
        globalns = sys._getframe(max(_parent_namespace_depth - 1, 1)).f_globals
        ns_resolver = _namespace_utils.NsResolver(
```
likely benign LLM, confidence 0.92 Reads the caller's f_globals at a computed depth to build a type namespace resolver.
Reasoning
sys._getframe with a clamped depth reads f_globals to build a namespace resolver for the adapter. This is read-only frame access used for forward-reference resolution.
info ~~warn~~ → info by review frame-introspection pydantic/v1/generics.py:368:33

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        previous_caller_frame = sys._getframe(2)
    except ValueError as e:
        raise RuntimeError('This function must be used inside another function') from e
```
likely benign LLM, confidence 0.92 Fetches the caller's frame in the v1 generics module to resolve the parent namespace.
Reasoning
sys._getframe(2) fetches the caller frame to determine the parent namespace for generic model creation in the v1 compatibility layer. The same ValueError guard is present, and the snippet shows no execution or network use.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pydantic-2.14.1-py3-none-any.whl https://files.pythonhosted.org/packages/35/ea/a56b9fe5066f3537b7882f77e9c5dfb26d8c2eefdaed9b5fc73d57b4dc22/pydantic-2.14.1-py3-none-any.whl
printf '%s  %s\n' 9195d967ec791692a04438115466764fb8b9a27b31f14a760437694f40d6b454 pydantic-2.14.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q pydantic-2.14.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg