ruamel.yaml 0.19.1

Artifact scanned: ruamel_yaml-0.19.1-py3-none-any.whl (wheel · 115.3 KB · SHA-256 27592957fedf…)
Compared with: ruamel_yaml-0.19.0-py3-none-any.whl (0 signals introduced since)
Files: 34 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 11.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload ruamel/yaml/constructor.py:524:20

file imports decoder module(s) binascii, base64 and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        try:
            return base64.decodebytes(value)
        except binascii.Error as exc:
            raise ConstructorError(
```
likely benign LLM, confidence 0.90 Base64 decoding of YAML !!binary scalar values.
Reasoning
The snippet is base64.decodebytes for !!binary YAML values, which is the standard YAML binary tag decoding. The decompress call elsewhere in the file is part of the same legitimate feature set; no hidden payload execution is shown.
info ~~critical~~ → info by review dynamic-import ruamel/yaml/constructor.py:702:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            __import__(name)
        except ImportError as exc:
            raise ConstructorError(
```
likely benign LLM, confidence 0.80 Dynamic __import__ of a module name taken from YAML tag resolution in the constructor.
Reasoning
This is find_python_name-style code that imports a module named from a YAML tag so ruamel can resolve python/name tags, a documented feature of unsafe loaders. The dynamic import is a real capability, but it is the intended design of the library and is wrapped in ImportError handling; it is not an obfuscated dropper.
info ~~critical~~ → info by review dynamic-import ruamel/yaml/constructor.py:728:21

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    __import__(module_name)
                    # object_name = '.'.join(object_name)
                    break
```
likely benign LLM, confidence 0.80 Dynamic __import__ used to resolve a module for a Python object tag.
Reasoning
Same pattern as the other constructor import: resolving python object names from YAML tags in the unsafe constructor's find_python_module logic. Legitimate library behavior, with the risk inherent to the unsafe loader API rather than hidden malice.
info ~~critical~~ → info by review dynamic-import ruamel/yaml/constructor.py:737:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            __import__(module_name)
        except ImportError as exc:
            raise ConstructorError(
```
likely benign LLM, confidence 0.80 Dynamic __import__ resolving a module name in the YAML constructor's python tag handling.
Reasoning
Repeated module-resolution import in the constructor for python/ tags. Consistent with ruamel's documented unsafe-constructor features; the code is not obfuscated and does not hide intent.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:223:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def parser(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            if self.Parser is not CParser:
```
likely benign LLM, confidence 0.90 Uses frame introspection to derive a property name for caching the parser.
Reasoning
sys._getframe().f_code.co_name is used to build a cache attribute name for lazily created parser objects. This is a common idiom with no malicious effect.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:244:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def composer(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            setattr(self, attr, self.Composer(loader=self))
```
likely benign LLM, confidence 0.90 Frame introspection to build a cache attribute name for the composer.
Reasoning
Same frame-name caching idiom for the composer property; benign.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:251:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def constructor(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            if self.Constructor is None:
```
likely benign LLM, confidence 0.90 Frame introspection to build a cache attribute name for the constructor.
Reasoning
Same frame-name caching idiom for the constructor property; benign.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:275:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def emitter(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            if self.Emitter is not CEmitter:
```
likely benign LLM, confidence 0.90 Frame introspection to build a cache attribute name for the emitter.
Reasoning
Same frame-name caching idiom for the emitter property; benign.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:310:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def serializer(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            setattr(
```
likely benign LLM, confidence 0.90 Frame introspection to build a cache attribute name for the serializer.
Reasoning
Same frame-name caching idiom for the serializer property; benign.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:328:22

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def representer(self) -> Any:
        attr = '_' + sys._getframe().f_code.co_name
        if not hasattr(self, attr):
            repres = self.Representer(
```
likely benign LLM, confidence 0.90 Frame introspection to build a cache attribute name for the representer.
Reasoning
Same frame-name caching idiom for the representer property; benign.
info ~~warn~~ → info by review frame-introspection ruamel/yaml/main.py:1034:37

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        info = inspect.getframeinfo(inspect.stack()[2][0])
        context = '' if info.code_context is None else "".join(info.code_context)
        s += f' file "{info.filename}", line {info.lineno}\n\n{context}'
```
likely benign LLM, confidence 0.90 Uses the call stack to add file and line context to error messages.
Reasoning
inspect.stack is used to annotate error messages with the caller's file and line for diagnostics. This is ordinary error-reporting code.
info ~~critical~~ → info by review frame-introspection ruamel/yaml/scanner.py:1993:41

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            info = inspect.getframeinfo(inspect.stack()[3][0])
            self.function = info.function
            self.fline = info.lineno
```
likely benign LLM, confidence 0.85 Call-stack lookup to record function name and line for scanner debugging.
Reasoning
inspect.stack is used to record the function and line of a comment or mark for debugging output. The critical severity comes from the co-located sys.exit/exec/eval mention, which is ordinary in a YAML library and not evidence of anti-analysis behavior.
info ~~critical~~ → info by review frame-introspection ruamel/yaml/scanner.py:2004:41

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            info = inspect.getframeinfo(inspect.stack()[1][0])
            self.ufun = info.function  # type: ignore
            self.uline = info.lineno  # type: ignore
```
likely benign LLM, confidence 0.85 Call-stack lookup to record caller info in the scanner's comment handling.
Reasoning
Same debugging-oriented stack lookup recording caller function and line. The file's other exit/eval mentions are normal library code; no anti-analysis behavior is shown.
info ~~critical~~ → info by review frame-introspection ruamel/yaml/scanner.py:2108:45

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
                first = self.unused.pop(0) if use else self.unused[0]
                info = inspect.getframeinfo(inspect.stack()[1][0])
                xprintf('using', first, self.comments[first].value, info.function, info.lineno)
            yield first, self.comments[first]
```
likely benign LLM, confidence 0.85 Call-stack lookup feeding a debug print of comment consumption.
Reasoning
Stack lookup used only for an xprintf debug trace of comment usage. Benign diagnostic code; the critical severity reflects file-level co-occurrence, not this snippet.
info ~~critical~~ → info by review frame-introspection ruamel/yaml/scanner.py:2119:41

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            info = inspect.getframeinfo(inspect.stack()[1][0])
            xprintf('assign_pre', token_line, self.unused, info.function, info.lineno)
        gobbled = False
```
likely benign LLM, confidence 0.93 Debug logging in the YAML scanner that reads the caller's frame info to print the function name and line number.
Reasoning
The snippet is a debug trace helper: it inspects the caller's frame to print function name and line number via xprintf for diagnostics. This is a common debugging idiom in the ruamel.yaml scanner. The 'anti-analysis shape' note comes only from sys.exit/exec/eval appearing elsewhere in the large file, which is normal for a parser library and does not link to this code.
info ~~critical~~ → info by review frame-introspection ruamel/yaml/scanner.py:2196:41

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            info = inspect.getframeinfo(inspect.stack()[1][0])
            xprintf('assign_post', token_line, self.unused, info.function, info.lineno)
        gobbled = False
```
likely benign LLM, confidence 0.93 Second debug trace in the YAML scanner that logs caller frame info through xprintf after token processing.
Reasoning
Same pattern as the sibling finding: inspect.stack()[1] is used only to log the calling function and line in a debug xprintf call inside the scanner. No execution, network, or evasion behavior is present in the snippet, and the flagged co-occurrence of exec/eval in the file is typical of a parser library.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o ruamel_yaml-0.19.1-py3-none-any.whl https://files.pythonhosted.org/packages/b8/0c/51f6841f1d84f404f92463fc2b1ba0da357ca1e3db6b7fbda26956c3b82a/ruamel_yaml-0.19.1-py3-none-any.whl
printf '%s  %s\n' 27592957fedf6e0b62f281e96effd28043345e0e66001f97683aa9a40c667c93 ruamel_yaml-0.19.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q ruamel_yaml-0.19.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg