sqlglot 30.24.0

Source: https://github.com/tobymao/sqlglot
Tag scanned: v30.24.0
Compared with: v30.23.0 (0 signals introduced since)
Files: 263 scanned, 86 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 0 warn · 11 info
Scan time: 10.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 04:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-import sqlglot/serde.py:116:18

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        module_path, class_name = class_name.rsplit(".", maxsplit=1)
        module = __import__(module_path, fromlist=[class_name])
    else:
        module = exp
```
suspicious LLM, confidence 0.60 Dynamic import of expression class module during deserialization.
Reasoning
__import__ is called with a module path derived from a serialized class name. This is a dynamic import driven by serialized data, which could be abused if the input were untrusted, but the snippet shows a plausible deserialization of sqlglot expression classes with no payload or network activity.
info ~~warn~~ → info by review dynamic-attribute pdoc/cli.py:14:29

reach-by-name through `globals` (ast pass, confidence 0.60)
```
# Load all dialects up front because lazy loading breaks pdoc's dynamic importing
sqlglot.dialects.__all__ = [globals()[attr_name] for attr_name in sqlglot.dialects.__all__]
```
likely benign LLM, confidence 0.85 Eagerly resolves dialect module names via globals() so pdoc can import them.
Reasoning
Rebuilding sqlglot.dialects.__all__ by looking up names in globals() is an ordinary eager-loading workaround for pdoc's dynamic imports, with an explanatory comment. No network, shell, or hidden payload is involved.
info ~~warn~~ → info by review dynamic-attribute sqlglot/dialects/__init__.py:126:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        attr = getattr(module, name)
        globals()[name] = attr
        return attr
```
dismissed LLM, confidence 0.90 Lazy-loading module attribute cache via globals() assignment.
Reasoning
This is a standard lazy-module __getattr__ pattern that caches the resolved attribute into globals() after getattr on a known module. It is a common, legitimate Python idiom.
info ~~warn~~ → info by review dynamic-execution sqlglot/executor/context.py:46:16

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    def eval(self, code):
        return eval(code, self.env)

    def eval_tuple(self, codes):
```
likely benign LLM, confidence 0.85 Evaluates generated Python code for the SQL executor's expression engine.
Reasoning
sqlglot's executor intentionally compiles generated Python expressions from SQL and evaluates them against a controlled env. This is a SQL-to-Python execution engine feature, not hidden malicious behavior, though eval is a real risk surface if inputs were untrusted.
info ~~warn~~ → info by review dynamic-execution sqlglot/executor/python.py:95:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        sql = self.generator.generate(expression)
        return compile(sql, sql, "eval", optimize=2)

    def _replace_subqueries(self, expression):
```
likely benign LLM, confidence 0.85 Compiles generated Python expression source for the SQL executor.
Reasoning
Compiling SQL-generated Python code in the executor is the expected design of this engine. The input is produced by the library's own generator from a parsed expression, not from an obfuscated payload.
info ~~warn~~ → info by review dynamic-attribute sqlglot/optimizer/__init__.py:64:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
                raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
        globals()[name] = value
        return value
```
dismissed LLM, confidence 0.90 Lazy-loading optimizer attribute cache via globals() assignment.
Reasoning
Same lazy-attribute caching idiom as the dialects module: getattr on a known submodule followed by caching in globals(). Standard and benign.
info ~~warn~~ → info by review high-complexity tests/dialects/test_athena.py:130:14

string literal compression ratio 0.956 (136 bytes) (raw pass, confidence 0.60)
```
        self.validate_identity(
            "CREATE TABLE foo WITH (table_type='ICEBERG', location='s3://foo/', format='orc', partitioning=ARRAY['bucket(id, 5)']) AS SELECT * FROM a"
        )
        self.validate_identity(
```
dismissed LLM, confidence 0.90 Long SQL test string flagged for compression ratio in a dialect test.
Reasoning
This is a long SQL string literal in a test file, and its compression ratio is high only because it is repetitive SQL text. Raw-pass findings on test string literals have a high false-positive rate, and this is ordinary test content.

info high-complexity tests/dialects/test_redshift.py:501:14

compression ratio 0.939 is >2σ above file mean 0.795 (raw pass, confidence 0.50)

        self.validate_identity(
            "COPY customer FROM 's3://mybucket/customer' IAM_ROLE 'arn:aws:iam::0123456789012:role/MyRedshiftRole' REGION 'us-east-1' FORMAT orc",
        )
        self.validate_identity(

info high-complexity tests/dialects/test_redshift.py:537:14

compression ratio 0.924 is >2σ above file mean 0.795 (raw pass, confidence 0.50)

        self.validate_identity(
            "SELECT attr AS attr, JSON_TYPEOF(val) AS value_type FROM customer_orders_lineitem AS c, UNPIVOT c.c_orders[0] WHERE c_custkey = 9451"
        )
        self.validate_identity(

info high-complexity tests/dialects/test_spark.py:496:28

compression ratio 0.910 is >2σ above file mean 0.599 (raw pass, confidence 0.50)

            write={
                "duckdb": "SELECT h.id, amount FROM hourlycostagg AS h CROSS JOIN LATERAL (SELECT UNNEST(h.adjustments, max_depth => 2)) AS _u_0(type, val, curr)",
            },
        )

info whitespace-anomaly tests/test_executor.py:23:1

file mixes tab and space indentation (6 tab-indented and 1564 space-indented lines) (raw pass, confidence 0.40)
```
from tests.helpers import (
    FIXTURES_DIR,
    SKIP_INTEGRATION,
    TPCH_SCHEMA,
```

info high-complexity tests/test_optimizer.py:1305:22

compression ratio 0.864 is >2σ above file mean 0.656 (raw pass, confidence 0.50)

                parse_one(
                    "SELECT (SELECT SUM(ci.amount) FROM my_table LATERAL VIEW EXPLODE(items) ci AS ci WHERE ci.type = 'promotion') AS total FROM my_table",
                    read="spark",
                ),

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tobymao/sqlglot sqlglot && cd sqlglot
git checkout v30.24.0
disclude scan --severity info --diff v30.23.0 .