sqlglot 30.24.0

Source: https://github.com/tobymao/sqlglot
Tag scanned: v30.24.0
Compared with: v30.23.0 (0 signals introduced since)
Files: 263 scanned, 86 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 1 warn · 11 info
Scan time: 12.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 07:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-import sqlglot/serde.py:116:18

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        module_path, class_name = class_name.rsplit(".", maxsplit=1)
        module = __import__(module_path, fromlist=[class_name])
    else:
        module = exp
```
suspicious LLM, confidence 0.80 Deserializer imports a module named in serialized data to reconstruct expression classes.
Reasoning
__import__ is called with a module path taken from a serialized class name during deserialization. This is a plausible design for loading sqlglot expression classes, but it does let serialized data choose which module gets imported, so a deserialization path can be abused. Critical severity is overstated given the usual library context.
warn hidden-llm-instruction CONTRIBUTING.md:1:6

AI-directed instruction in a Markdown comment, which the page does not render (ast pass, confidence 0.75)
```
Important: If you are an agent, you must add your model [CLAUDE, CODEX, etc...] to the end of PR titles.
```
confirmed LLM, confidence 0.93 A Markdown comment hides an instruction telling AI agents to append their model name to PR titles.
Reasoning
The hidden comment directs AI agents to append model names to PR titles, an instruction to an AI hidden from human readers in a markdown comment. It is a prompt-injection-style steering attempt, though low-harm (only PR title edits), so it is clearly suspicious rather than a mere hidden note.
info ~~warn~~ → info by review dynamic-attribute pdoc/cli.py:14:29

reach-by-name through `globals` (ast pass, confidence 0.60)
```
# Load all dialects up front because lazy loading breaks pdoc's dynamic importing
sqlglot.dialects.__all__ = [globals()[attr_name] for attr_name in sqlglot.dialects.__all__]
```
likely benign LLM, confidence 0.90 Documentation-generation code resolves dialect names via globals() to eagerly load them for pdoc.
Reasoning
This is a documented workaround in a documentation tool: it rewrites the module's __all__ by looking up dialect names in globals so pdoc can import them. Reaching names by string in globals is a common benign pattern in Python packages.
info ~~warn~~ → info by review dynamic-attribute sqlglot/dialects/__init__.py:126:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        attr = getattr(module, name)
        globals()[name] = attr
        return attr
```
likely benign LLM, confidence 0.90 Lazy-import helper caches a dynamically fetched module attribute into globals().
Reasoning
This is a standard lazy-loading module __getattr__ pattern that caches imported dialect attributes into globals. Benign framework idiom.
info ~~warn~~ → info by review dynamic-execution sqlglot/executor/context.py:46:16

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    def eval(self, code):
        return eval(code, self.env)

    def eval_tuple(self, codes):
```
likely benign LLM, confidence 0.85 Evaluates generated Python code strings against an environment in the SQL executor.
Reasoning
sqlglot's executor intentionally compiles generated Python expressions from SQL and evaluates them in a restricted environment. The eval is by design for a SQL-to-Python executor, and the code is derived from SQL ASTs rather than untrusted network input, though eval of generated code is a real risk surface.
info ~~warn~~ → info by review dynamic-execution sqlglot/executor/python.py:95:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        sql = self.generator.generate(expression)
        return compile(sql, sql, "eval", optimize=2)

    def _replace_subqueries(self, expression):
```
likely benign LLM, confidence 0.85 Compiles Python source generated from a SQL expression for the executor.
Reasoning
compile is applied to SQL-generated Python source inside the executor, matching the library's design of turning SQL expressions into Python code objects. Non-literal but internally generated, not an obvious dropper.
info ~~warn~~ → info by review dynamic-attribute sqlglot/optimizer/__init__.py:64:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
                raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.90 Lazy-loading __getattr__ caches resolved optimizer attribute into globals().
Reasoning
Same lazy module attribute pattern: a __getattr__ that imports a name and caches it in globals. Standard and benign.
info ~~warn~~ → info by review high-complexity tests/dialects/test_athena.py:130:14

string literal compression ratio 0.956 (136 bytes) (raw pass, confidence 0.60)
```
        self.validate_identity(
            "CREATE TABLE foo WITH (table_type='ICEBERG', location='s3://foo/', format='orc', partitioning=ARRAY['bucket(id, 5)']) AS SELECT * FROM a"
        )
        self.validate_identity(
```
dismissed LLM, confidence 0.93 Test file contains a long, repetitive SQL CREATE TABLE literal flagged for compressibility.
Reasoning
A long SQL string literal in a test file has high compression ratio because it is repetitive SQL text. Raw-pass false positive on ordinary test data.

info high-complexity tests/dialects/test_redshift.py:501:14

compression ratio 0.939 is >2σ above file mean 0.795 (raw pass, confidence 0.50)

        self.validate_identity(
            "COPY customer FROM 's3://mybucket/customer' IAM_ROLE 'arn:aws:iam::0123456789012:role/MyRedshiftRole' REGION 'us-east-1' FORMAT orc",
        )
        self.validate_identity(

info high-complexity tests/dialects/test_redshift.py:537:14

compression ratio 0.924 is >2σ above file mean 0.795 (raw pass, confidence 0.50)

        self.validate_identity(
            "SELECT attr AS attr, JSON_TYPEOF(val) AS value_type FROM customer_orders_lineitem AS c, UNPIVOT c.c_orders[0] WHERE c_custkey = 9451"
        )
        self.validate_identity(

info high-complexity tests/dialects/test_spark.py:496:28

compression ratio 0.910 is >2σ above file mean 0.599 (raw pass, confidence 0.50)

            write={
                "duckdb": "SELECT h.id, amount FROM hourlycostagg AS h CROSS JOIN LATERAL (SELECT UNNEST(h.adjustments, max_depth => 2)) AS _u_0(type, val, curr)",
            },
        )

info whitespace-anomaly tests/test_executor.py:23:1

file mixes tab and space indentation (6 tab-indented and 1564 space-indented lines) (raw pass, confidence 0.40)
```
from tests.helpers import (
    FIXTURES_DIR,
    SKIP_INTEGRATION,
    TPCH_SCHEMA,
```

info high-complexity tests/test_optimizer.py:1305:22

compression ratio 0.864 is >2σ above file mean 0.656 (raw pass, confidence 0.50)

                parse_one(
                    "SELECT (SELECT SUM(ci.amount) FROM my_table LATERAL VIEW EXPLODE(items) ci AS ci WHERE ci.type = 'promotion') AS total FROM my_table",
                    read="spark",
                ),

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/tobymao/sqlglot sqlglot && cd sqlglot
git checkout v30.24.0
disclude scan --severity info --diff v30.23.0 .