pyzmq 27.3.0

Source: https://github.com/zeromq/pyzmq
Artifact scanned: pyzmq-27.3.0.tar.gz (sdist · 286.4 KB · SHA-256 bbedb3d1d99b…)
Compared with: pyzmq-27.2.0.tar.gz (0 signals introduced since)
Files: 257 scanned, 42 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 5.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-04 01:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution docs/source/howto/build.md:237:1

[embedded bash] command name is a variable (`$PREFIX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
# Path to a program.
CYTHON:FILEPATH=$PREFIX/bin/cython

# semicolon-separated list of arguments to pass to ./configure for bundled libsodium
```
likely benign LLM, confidence 0.90 Documentation example setting a CMake cache path to a cython binary under a prefix.
Reasoning
The snippet is a CMake cache variable setting in a build how-to, with $PREFIX shown as a placeholder path to cython. Documentation of build configuration, not an attack.
info ~~warn~~ → info by review dynamic-execution docs/source/howto/build.md:270:1

[embedded bash] command name is a variable (`$PREFIX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
# The directory containing a CMake configuration file for ZeroMQ.
ZeroMQ_DIR:PATH=$PREFIX/lib/cmake/ZeroMQ
```
likely benign LLM, confidence 0.90 Documentation showing a CMake ZeroMQ_DIR path setting.
Reasoning
A CMake cache entry pointing ZeroMQ_DIR at a prefix-relative cmake directory. Ordinary build documentation with a placeholder variable.
info ~~warn~~ → info by review decoder-decompress-payload docs/source/howto/serialization.md:130:9

[embedded python] file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        raise ValueError("invalid signature")
    p = zlib.decompress(z)
    return pickle.loads(p)
```
likely benign LLM, confidence 0.85 Doc example that decompresses and unpickles a signed payload.
Reasoning
This is a documentation example demonstrating a secure-serialization pattern: it verifies a signature before decompressing and unpickling. Pickle over untrusted data is a known risk, but the doc context is a tutorial snippet, not a dropper.
info ~~warn~~ → info by review decoder-decompress-payload examples/serialization/serialsocket.py:64:16

file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        # pickle.loads involves arbitrary code execution
        pobj = zlib.decompress(zobj)
        return pickle.loads(pobj)
```
likely benign LLM, confidence 0.85 Example helper that zlib-decompresses and unpickles messages for a socket wrapper.
Reasoning
The code is an example of a serialization helper; the comment explicitly warns that pickle.loads involves arbitrary code execution. It is a demonstration of zlib plus pickle serialization for ZeroMQ, not hidden malicious execution.
info unicode-mixed-script tests/test_asyncio.py:149:12

identifier `πøøπ` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
    assert not f.done()
    msg = "πøøπ"
    await a.send_string(msg)
    recvd = await f
```

info unicode-mixed-script tests/test_future.py:143:20

identifier `πøøπ` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            assert not f.done()
            msg = 'πøøπ'
            await a.send_string(msg)
            recvd = await f

info unicode-mixed-script tests/test_socket.py:304:14

identifier `çπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        self.sockets.extend([a, b])
        u = "çπ§"
        self.assertRaises(TypeError, a.send, u, copy=False)
        self.assertRaises(TypeError, a.send, u, copy=True)

info ~~warn~~ → info by review payload-bytes-literal tests/test_z85.py:17:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        client_public = (
            b"\xbb\x88\x47\x1d\x65\xe2\x65\x9b"
            b"\x30\xc5\x5a\x53\x21\xce\xbb\x5a"
            b"\xab\x2b\x70\xa3\x98\x64\x5c\x26"
```
likely benign LLM, confidence 0.90 Test fixture containing a 32-byte client public key as byte escapes.
Reasoning
These are Z85 test vectors: fixed 32-byte curve keys written as byte escapes in a test file. Binary-looking literals are expected for cryptographic test data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_z85.py:30:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        client_secret = (
            b"\x7b\xb8\x64\xb4\x89\xaf\xa3\x67"
            b"\x1f\xbe\x69\x10\x1f\x94\xb3\x89"
            b"\x72\xf2\x48\x16\xdf\xb0\x1b\x51"
```
likely benign LLM, confidence 0.90 Test fixture containing a 32-byte client secret key as byte escapes.
Reasoning
Known-answer test vector for Z85/CURVE key handling; binary key literals are expected in such tests.
info ~~warn~~ → info by review payload-bytes-literal tests/test_z85.py:43:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        server_public = (
            b"\x54\xfc\xba\x24\xe9\x32\x49\x96"
            b"\x93\x16\xfb\x61\x7c\x87\x2b\xb0"
            b"\xc1\xd1\xff\x14\x80\x04\x27\xc5"
```
likely benign LLM, confidence 0.90 Test fixture containing a 32-byte server public key as byte escapes.
Reasoning
Test vector for curve key encoding in a test module; the literal is test data, not a payload.
info ~~warn~~ → info by review payload-bytes-literal tests/test_z85.py:56:13

concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
        server_secret = (
            b"\x8e\x0b\xdd\x69\x76\x28\xb9\x1d"
            b"\x8f\x24\x55\x87\xee\x95\xc5\xb0"
            b"\x4d\x48\x96\x3f\x79\x25\x98\x77"
```
likely benign LLM, confidence 0.90 Test fixture containing a 32-byte server secret key as byte escapes.
Reasoning
Test vector for curve key encoding in a test module; the literal is test data, not a payload.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pyzmq-27.3.0.tar.gz https://files.pythonhosted.org/packages/e2/e1/ea46ab0d707219c098065a37d2add5b53d3b124241aa19429bcd0863e5b4/pyzmq-27.3.0.tar.gz
printf '%s  %s\n' bbedb3d1d99babc625f1dd9d7438acefd442b36b75073fd6bc1ef7c0a4b96d56 pyzmq-27.3.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf pyzmq-27.3.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg