PyPI / websockets / 17.3

websockets 17.3

Source

https://github.com/python-websockets/websockets

Artifact scanned

websockets-17.3-py3-none-any.whl (wheel · 207.4 KB · SHA-256 dc2b495a92b3…)

Compared with

websockets-17.2-py3-none-any.whl (0 signals introduced since)

Files

56 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

5.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 02:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution websockets/cli.py:214:9

   `os.system` called with a literal shell command (ast pass, confidence 0.70)

       if sys.platform == "win32":
           os.system("")
   
       try:

   likely benign LLM, confidence 0.95 A Windows-only os.system("") call that enables ANSI colour output in the console.

   Reasoning

   The call is os.system("") guarded by a win32 check. An empty command is the well-known trick for enabling ANSI escape-sequence processing in the Windows console. It runs no payload and takes no external input.

2. info warn → info by review decoder-decompress-payload websockets/extensions/permessage_deflate.py:72:28

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           if not self.remote_no_context_takeover:
               self.decoder = zlib.decompressobj(wbits=-self.remote_max_window_bits)
   
           if not self.local_no_context_takeover:

   dismissed LLM, confidence 0.93 Creates a raw-deflate decompressor for WebSocket permessage-deflate message decompression.

   Reasoning

   zlib.decompressobj with negative wbits is how RFC 7692 permessage-deflate decodes compressed WebSocket frames. It is the core of the extension and operates on peer traffic as the protocol requires, not on an embedded payload.

3. info critical → info by review dynamic-import websockets/imports.py:28:14

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           assert level < len(source), "importing from parent isn't supported"
       module = __import__(source[level:], namespace, None, [name], level)
       return getattr(module, name)

   likely benign LLM, confidence 0.85 A relative-import helper that calls __import__ on a module path derived from package names.

   Reasoning

   This is a small helper that resolves a name from a (possibly relative) module path, passing the level argument through to __import__. The module string is derived from the caller's own package names, not from untrusted input. The critical severity overstates a common stdlib-style import shim.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o websockets-17.3-py3-none-any.whl https://files.pythonhosted.org/packages/d7/b0/3f01fcb3406662f6deb1e3e72b34dd0979e993991c0b7435a9e12bc14f02/websockets-17.3-py3-none-any.whl
printf '%s  %s\n' dc2b495a92b3971966bf102e73589f950db3ec1ca6713265355ce7771d97b199 websockets-17.3-py3-none-any.whl | shasum -a 256 -c -
unzip -q websockets-17.3-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg