soupsieve 3.0.4

Source: https://github.com/facelessuser/soupsieve
Artifact scanned: soupsieve-3.0.4-py3-none-any.whl (wheel · 41.5 KB · SHA-256 8412826614f9…)
Compared with: soupsieve-3.0.3-py3-none-any.whl (0 signals introduced since)
Files: 8 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 5.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 04:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:98:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Calls soupsieve's selector compiler on a CSS select string and namespaces.
Reasoning
The flagged call is soupsieve's own compile() helper that turns a CSS selector string into a matcher object. It does not execute Python source, so the dynamic-execution signal is a name collision with the builtin. This is the normal library API.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:122:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Wrapper that forwards a CSS selector to soupsieve's compile function.
Reasoning
Same pattern as the other soupsieve compile() wrappers: the select string is a CSS selector passed to the library's compiler, which builds a selector object. No eval or exec of attacker-controlled Python is involved.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:146:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Public soupsieve API entry point that compiles a CSS selector.
Reasoning
This is one of the public select/compile entry points of soupsieve. The compile call receives a selector and namespaces and returns a compiled selector, which is the library's core design.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:170:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Forwards a CSS selector string to soupsieve's compiler.
Reasoning
The non-literal argument is the caller's CSS selector string, passed to soupsieve's selector compiler. This is expected behaviour for a CSS selection library, and the analyzer flags it only because the name matches the builtin.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:195:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    return compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Compiles a CSS selector through soupsieve's internal compiler.
Reasoning
Identical structure to the other compile wrappers in this module. The call builds a selector object from CSS text and does not run arbitrary code.
info ~~warn~~ → info by review dynamic-execution soupsieve/__init__.py:220:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    yield from compile(
        select,
        namespaces,
```
dismissed LLM, confidence 0.95 Generator that yields results from soupsieve's selector compiler.
Reasoning
This is a generator variant (yield from) of the same selector-compilation call used throughout soupsieve for iterating matches. Nothing here decodes or executes untrusted code.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o soupsieve-3.0.4-py3-none-any.whl https://files.pythonhosted.org/packages/07/66/473f7ca0be0b06e38ee8c85ee2db184e3981bd769fac2e7c19c8a8865211/soupsieve-3.0.4-py3-none-any.whl
printf '%s  %s\n' 8412826614f9c632227067d0985aeb9f584bd15efc852955430e097a9fe7afbf soupsieve-3.0.4-py3-none-any.whl | shasum -a 256 -c -
unzip -q soupsieve-3.0.4-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg