soupsieve 3.0.4

Source: https://github.com/facelessuser/soupsieve
Tag scanned: 3.0.4
Compared with: 3.0.3 (0 signals introduced since)
Files: 121 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 9.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 09:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:98:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 A call to soupsieve's internal CSS selector compile function on a selector string.
Reasoning
The call is soupsieve's own compile(select, namespaces) helper, which turns a CSS selector string into a selector object. It is a library API, not Python's builtin compile() feeding exec or eval, and the snippet shows no decoding or execution step. The signal fires on the name alone, so this is a false positive.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:122:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 A call to soupsieve's internal CSS selector compile function, returning a compiled selector.
Reasoning
Same pattern as the other soupsieve findings: a return of the library's compile(select, namespaces) for CSS selector parsing. The snippet shows no dynamic code execution and the name match is coincidental.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:146:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 A call to soupsieve's internal CSS selector compile function with a namespace mapping.
Reasoning
The flagged call is soupsieve's selector compiler receiving the select string and namespaces mapping. This is the normal selector-building path of a well-known HTML parsing library and shows no obfuscation or malicious behaviour.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:170:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 A call to soupsieve's internal CSS selector compile function.
Reasoning
This is another return of soupsieve's selector compile helper. The argument is a CSS selector and namespace dictionary, not untrusted code run through exec. The AST rule matched on the function name, so the finding is a false positive.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:195:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.93 A call to soupsieve's internal CSS selector compile function.
Reasoning
The snippet is the library's selector compiler being called with a selector string and namespaces. This is the expected behaviour of soupsieve's public API and carries no sign of dropper behaviour or hidden execution.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:220:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    yield from compile(
        select,
        namespaces,
```
likely benign LLM, confidence 0.92 A generator delegating to soupsieve's internal CSS selector compile function.
Reasoning
This is a yield from over soupsieve's compile(select, namespaces) call, which is the library's generator-based selector iteration. It is ordinary CSS selector handling with no code execution, so it is a false positive on the name match.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/facelessuser/soupsieve soupsieve && cd soupsieve
git checkout 3.0.4
disclude scan --severity info --diff 3.0.3 .