soupsieve 3.0.3

Source: https://github.com/facelessuser/soupsieve
Tag scanned: 3.0.3
Compared with: 3.0.2 (0 signals introduced since)
Files: 121 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 6.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 01:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:98:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Calls soupsieve's internal selector compiler on a user-supplied CSS selector string.
Reasoning
The `compile` call is soupsieve's CSS selector compiler, which turns a selector string into a matcher object. The AST pass flags the non-literal argument, but this is a parser-compile pattern in a library whose job is selector compilation, not runtime code execution of untrusted input. The same pattern repeats across all six call sites.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:122:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Calls soupsieve's selector compiler with a selector string and namespaces.
Reasoning
Same `compile(select, namespaces, ...)` selector-compilation helper as the other findings in this file. It passes a CSS selector and namespace map to the library's compiler, which is the library's documented purpose.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:146:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Wrapper that compiles a CSS selector into a soupsieve pattern object.
Reasoning
This is the selector-compile wrapper in soupsieve's public API, which takes a CSS selector and returns a compiled pattern. The non-literal argument is expected for a selector library and does not indicate obfuscation.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:170:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Another soupsieve API entry point that compiles a CSS selector string.
Reasoning
Repeated selector-compilation call with a non-literal selector and namespaces. This is normal for soupsieve's API surface and matches the library's design, with no encoding, decoding, or exec-style staging around it.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:195:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Compiles a CSS selector string passed in by the caller.
Reasoning
Selector compilation with a caller-provided CSS selector, the expected behavior of a selector library. There is no sign of dynamic code built from encoded data or of a dropper pipeline.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:220:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    yield from compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 Generator helper that compiles a CSS selector and yields matching elements.
Reasoning
`yield from compile(...)` inside a generator-style select helper is the library's iterator-based selection API. It compiles a CSS selector and yields matches, which is the intended behavior of soupsieve.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/facelessuser/soupsieve soupsieve && cd soupsieve
git checkout 3.0.3
disclude scan --severity info --diff 3.0.2 .