PyPI / python-dateutil / 3.0.0

python-dateutil 3.0.0

Source

https://github.com/dateutil/dateutil

Tag scanned

3.0.0

Compared with

2.9.0.post0 (3 signals introduced since)

Files

70 scanned, 16 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

5.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 06:28

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection src/dateutil/zoneinfo/__init__.py:39:13 new in this release

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

       level = 1
       frame = sys._getframe(1)  # The body of this module
       while frame.f_back is not None:
           frame = frame.f_back

   likely benign LLM, confidence 0.90 Walks the call stack to the outermost frame to locate the zoneinfo module's directory.

   Reasoning

   sys._getframe(1) is used to walk to the outermost stack frame so the module can locate its own directory, which is a common and legitimate way to find the package path when the module is imported. It does not read or send data and has no execution or network component.

2. info warn → info by review decoder-import-with-exec tests/test_tzfile.py:2653:16 new in this release

   file imports decoder module(s) base64, gzip, pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)

       with open(source_path, "rb") as f:
           code = compile(f.read(), source_path, "exec")
       six.exec_(code, module.__dict__)

   likely benign LLM, confidence 0.75 Test helper that compiles and executes a Python source file read from a local path.

   Reasoning

   The snippet reads a Python source file from disk, compiles it, and runs it with six.exec_ into a module namespace. That is an ordinary test-helper loader for a source file. The decoder-module signal comes from imports elsewhere in the file, and the snippet itself shows no base64, gzip, or pickle decoding chain. The path is a test fixture, not a payload.

3. info warn → info by review dynamic-execution tests/test_tzfile.py:2653:16 new in this release

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       with open(source_path, "rb") as f:
           code = compile(f.read(), source_path, "exec")
       six.exec_(code, module.__dict__)

   likely benign LLM, confidence 0.80 Dynamic compile of a local source file inside a test helper.

   Reasoning

   This is the same compile() call as the previous finding, flagged for its non-literal argument. The source comes from a local test path rather than network input or an encoded blob, so the dynamic compile fits a test loader. The snippet does not show the source being decoded or fetched from anywhere.

4. info identifier-low-length src/dateutil/easter.py:1:1

   26 of 54 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)

5. info unicode-homoglyph tests/test_isoparser.py:271:17

   identifier `Т12` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)

       ('2013366', ValueError),                    # Invalid ordinal day
       ('2014-03-12Т12:30:14', ValueError),        # Cyrillic T
       ('2014-04-21T24:00:01', ValueError),        # Invalid use of 24 for midnight
       ('2014_W01-1', ValueError),                 # Invalid separator

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/dateutil/dateutil dateutil && cd dateutil
git checkout 3.0.0
disclude scan --severity info --diff 2.9.0.post0 .