soupsieve 3.0.3

Source: https://github.com/facelessuser/soupsieve
Tag scanned: 3.0.3
Compared with: 3.0.2 (0 signals introduced since)
Files: 120 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 6.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:26

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:98:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 A soupsieve CSS selector compile call, not dynamic code execution.
Reasoning
The flagged call is soupsieve's CSS selector compiler, which turns a selector string into a matcher object. It is not Python's exec-style compile of attacker-controlled code. The surrounding structure (select, namespaces, flags) matches the library's public select/compile API, so the AST rule fires on a name collision with a legitimate pattern.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:122:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 Another soupsieve selector compile call with the same legitimate signature.
Reasoning
Same compile(select, namespaces, ...) call pattern as the other findings in this file, which is soupsieve's selector compiler. It is a legitimate library API used to build selector matchers from CSS strings.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:146:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 Repeated soupsieve selector compile wrapper for the public select API.
Reasoning
Identical snippet to the other compile calls in soupsieve's __init__.py, passing a CSS selector and namespace mapping. This is the library's normal selector compilation path.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:170:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 Soupsieve selector compilation returning a matcher object.
Reasoning
The call passes a CSS selector and namespaces into soupsieve's compiler. Nothing in the snippet indicates code strings being executed or decoded at runtime.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:195:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 Soupsieve selector compile call in a public API wrapper.
Reasoning
Same compile-of-selector pattern used throughout soupsieve's public API functions. The non-literal argument is the caller's CSS selector string, which is expected for this library.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:220:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    yield from compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.92 Soupsieve generator-based selector iteration via compile, legitimate.
Reasoning
This is a generator variant (yield from compile(...)) of the same soupsieve selector-compilation API, used for iterating matches. It processes CSS selectors, not executable payloads.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/facelessuser/soupsieve soupsieve && cd soupsieve
git checkout 3.0.3
disclude scan --severity info --diff 3.0.2 .