wrapt 2.5.1

Source: https://github.com/GrahamDumpleton/wrapt
Tag scanned: 2.5.1
Compared with: 2.5.0 (0 signals introduced since)
Files: 166 scanned, 47 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 26 info
Scan time: 20.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 26 of 26 warn and critical signals; 26 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 00:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection blog/09-performance-overhead-of-using-decorators.md:103:1

[embedded python] `sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
sys.setprofile(tracer)

function()
```
likely benign LLM, confidence 0.85 Blog example using sys.setprofile to trace function calls while measuring decorator performance.
Reasoning
Markdown tutorial snippet showing sys.setprofile for timing decorator overhead. It is documentation prose in a blog post, not executed code.
info ~~warn~~ → info by review frame-introspection blog/10-performance-overhead-when-applying-decorators-to-methods.md:90:1

[embedded python] `sys.setprofile` — call-stack frame introspection (ast pass, confidence 0.70)
```
sys.setprofile(tracer)

instance.method()
```
likely benign LLM, confidence 0.85 Blog example calling sys.setprofile with a tracer around a method call.
Reasoning
Same profiling demonstration in a blog post about method decorator overhead. Illustrative code in documentation.
info ~~critical~~ → info by review dynamic-import blog/13-ordering-issues-when-monkey-patching-in-python.md:105:9

[embedded python] `__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    def _load_and_execute(target_module):
        __import__(name)
        patch_module = sys.modules[name]
        getattr(patch_module, 'apply_patch')(target_module)
```
likely benign LLM, confidence 0.80 Blog example helper that dynamically imports a patch module and applies it to a target module.
Reasoning
Illustrative monkey-patching helper in a blog post that imports a patch module by name and calls apply_patch. The name is a parameter in an example, and the code is documentation, not a dropper.
info ~~critical~~ → info by review dynamic-execution docs/conf.py:55:9

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    if isinstance(node, ast.FunctionDef) and node.name == "_format_version":
        exec(compile(ast.Module(body=[node], type_ignores=[]), "<v>", "exec"), _ns)
    elif isinstance(node, ast.Assign) and any(
        getattr(t, "id", None) in ("__version_info__", "__version__")
```
likely benign LLM, confidence 0.85 Docs config extracts version definitions from source via ast and exec into a namespace.
Reasoning
Sphinx conf.py parses its own version source with ast and execs only the extracted _format_version function and version assignments into a namespace. This is a common, bounded pattern for reading a version without importing the package.
info ~~critical~~ → info by review dynamic-execution docs/conf.py:55:14

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    if isinstance(node, ast.FunctionDef) and node.name == "_format_version":
        exec(compile(ast.Module(body=[node], type_ignores=[]), "<v>", "exec"), _ns)
    elif isinstance(node, ast.Assign) and any(
        getattr(t, "id", None) in ("__version_info__", "__version__")
```
likely benign LLM, confidence 0.85 Compiles an AST node extracted from the project's own version source.
Reasoning
The compile call is part of the same bounded ast-extraction pattern, compiling only a parsed AST node built from the project's own source.
info ~~critical~~ → info by review dynamic-execution docs/conf.py:60:9

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    ):
        exec(compile(ast.Module(body=[node], type_ignores=[]), "<v>", "exec"), _ns)

version_info = _ns["__version_info__"]
```
likely benign LLM, confidence 0.85 Second exec of extracted version assignments in the docs config.
Reasoning
Second exec of the same ast-extracted version code in the docs config. Consistent with reading version metadata from the local source file.
info ~~critical~~ → info by review dynamic-execution docs/conf.py:60:14

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    ):
        exec(compile(ast.Module(body=[node], type_ignores=[]), "<v>", "exec"), _ns)

version_info = _ns["__version_info__"]
```
likely benign LLM, confidence 0.85 Compiles extracted version AST nodes from the local source.
Reasoning
Compile step matching the previous exec in the same version-extraction logic. No external input is involved.
info ~~warn~~ → info by review dynamic-attribute src/wrapt/patches.py:103:32

reach-by-name through `vars` (ast pass, confidence 0.60)
```
                    if attribute in vars(cls):
                        return vars(cls)[attribute]
                else:
                    return getattr(parent, attribute)
```
likely benign LLM, confidence 0.85 Reflective attribute lookup via vars() while resolving a patched attribute.
Reasoning
wrapt is a decorator and wrapping library, and this reads attributes through vars(cls) along an MRO to resolve descriptors when patching. This is standard reflection in a library that needs to inspect class attributes.
info ~~warn~~ → info by review dynamic-attribute src/wrapt/patches.py:348:13

reach-by-name through `vars.get` (ast pass, confidence 0.60)
```
    parent = resolve_path(module, path)[2]
    prior = vars(parent).get(attribute, MISSING)
    wrapper = AttributeWrapper(prior, attribute, factory, args, kwargs)
    apply_patch(parent, attribute, wrapper)
```
likely benign LLM, confidence 0.85 Fetches the existing attribute from a parent's vars to wrap it.
Reasoning
Retrieves the prior attribute value via vars(parent).get so a wrapper can be applied and later restored. Expected behavior for a wrapping library.
info ~~warn~~ → info by review dynamic-attribute src/wrapt/patches.py:840:17

reach-by-name through `vars` (ast pass, confidence 0.60)
```
            (
                vars(cls)[attribute]
                for cls in inspect.getmro(owner)[1:]
                if attribute in vars(cls)
```
likely benign LLM, confidence 0.85 Iterates the MRO via vars(cls) to locate an attribute's original definition.
Reasoning
Walks the MRO of an owner class to find the original attribute definition. This is ordinary introspection for wrapping class members.
info ~~critical~~ → info by review dynamic-import src/wrapt/proxies.py:366:18

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    def _import():
        module = __import__(name, fromlist=[""])

        if attribute is not None:
```
likely benign LLM, confidence 0.85 Lazy module import helper inside the wrapt proxy implementation.
Reasoning
Lazy import helper in a library module, importing a module by name with fromlist to support lazy attribute loading. The name is internal to the library, not attacker-controlled input.
info ~~critical~~ → info by review dynamic-execution tests/core/test_adapter.py:18:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.90 Test execs a constant source string to build a decorators test module.
Reasoning
Test fixture execs a DECORATORS_CODE string constant defined in the same test file into a fresh module namespace. The code is a literal test fixture, not external input.
info ~~critical~~ → info by review dynamic-execution tests/core/test_adapter_annotations.py:26:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.90 Test execs a local constant source string to build a decorators module.
Reasoning
Same test-fixture pattern of exec on a local constant string to create a decorators module for annotation tests.
info ~~critical~~ → info by review dynamic-execution tests/core/test_adapter_kwonly.py:18:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.90 Test execs a local constant decorators source string for keyword-only adapter cases.
Reasoning
Keyword-only adapter test uses the same local DECORATORS_CODE exec fixture. Benign test scaffolding.
info ~~critical~~ → info by review dynamic-execution tests/core/test_class.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.90 Test execs a local constant decorators source string for class tests.
Reasoning
Class test uses the same local DECORATORS_CODE exec to generate test decorators. Standard test setup with no external input.
info ~~critical~~ → info by review dynamic-import tests/core/test_find_wrapper.py:90:27

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        wrapt.apply_patch(__import__(__name__), "function_closure", their_closure)

        current = wrapt.resolve_path(__name__, "function_closure")[2]
```
dismissed LLM, confidence 0.92 Test code that imports its own module via __import__(__name__) to exercise wrapt's patching API.
Reasoning
The call is `__import__(__name__)`, which imports the test module itself to pass it to wrapt.apply_patch in a unit test. The argument is the module's own name, not attacker-controlled input, and the same pattern repeats at line 219. This is ordinary test scaffolding.
info ~~critical~~ → info by review dynamic-import tests/core/test_find_wrapper.py:219:27

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        wrapt.apply_patch(__import__(__name__), "function_replaced", original)

        current = wrapt.resolve_path(__name__, "function_replaced")[2]
```
dismissed LLM, confidence 0.92 Test code that imports its own module to test wrapt path resolution.
Reasoning
Same self-import pattern, `__import__(__name__)` passed to wrapt.apply_patch in a test that checks resolve_path. No external input or decoding is involved.
info ~~critical~~ → info by review dynamic-execution tests/core/test_function.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test fixture that execs a module-level decorator-definition string into a ModuleType namespace.
Reasoning
This is a test helper that builds a synthetic module and execs a DECORATORS_CODE string constant into its namespace, a known wrapt test idiom for defining decorators in a fresh scope. The constant itself is not shown, but it is a local test fixture in a test suite, not a payload fetched or decoded from outside.
info ~~critical~~ → info by review dynamic-execution tests/core/test_inner_classmethod.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant into a synthetic module for classmethod tests.
Reasoning
Same test-fixture pattern: a ModuleType is created and DECORATORS_CODE, a constant defined in the test, is exec'd into it to build decorators for classmethod tests. No external source or obfuscation is visible.
info ~~critical~~ → info by review dynamic-execution tests/core/test_inner_staticmethod.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant into a synthetic module for staticmethod tests.
Reasoning
Same test-fixture idiom of exec'ing a local DECORATORS_CODE constant into a ModuleType to test staticmethod decorators. Consistent with the wrapt test suite and not a dropper.
info ~~critical~~ → info by review dynamic-execution tests/core/test_instancemethod.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant to test instance methods.
Reasoning
Test fixture exec'ing the local DECORATORS_CODE constant into a fresh ModuleType namespace to define decorators for instance method tests. No network, decoding, or external input is involved.
info ~~critical~~ → info by review dynamic-execution tests/core/test_nested_function.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant to test nested functions.
Reasoning
Test fixture using exec on a local DECORATORS_CODE string in a ModuleType, to build decorators for nested-function tests. This is a standard way to isolate decorator definitions in a test.
info ~~critical~~ → info by review dynamic-execution tests/core/test_object_proxy.py:23:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
objects = types.ModuleType("objects")
exec(OBJECTS_CODE, objects.__dict__, objects.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs an object-definition constant into a synthetic module for proxy tests.
Reasoning
Test fixture that execs the local OBJECTS_CODE constant into a ModuleType to create test objects for object proxy tests. The pattern is self-contained and matches normal test scaffolding.
info ~~critical~~ → info by review dynamic-execution tests/core/test_outer_classmethod.py:18:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant to test outer classmethods.
Reasoning
Test fixture execing the local DECORATORS_CODE constant into a ModuleType for outer classmethod tests. Nothing in the snippet suggests external retrieval or obfuscated payload handling.
info ~~critical~~ → info by review dynamic-execution tests/core/test_outer_staticmethod.py:16:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
decorators = types.ModuleType("decorators")
exec(DECORATORS_CODE, decorators.__dict__, decorators.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs a decorator-definition constant to test outer staticmethods.
Reasoning
Test fixture execing the local DECORATORS_CODE constant into a ModuleType for outer staticmethod tests. This is consistent with test isolation of decorator definitions.
info ~~critical~~ → info by review dynamic-execution tests/core/test_type_module_attribute.py:31:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
objects = types.ModuleType("objects")
exec(OBJECTS_CODE, objects.__dict__, objects.__dict__)
```
likely benign LLM, confidence 0.85 Test helper that execs an object-definition constant to test type module attributes.
Reasoning
Test fixture execing the local OBJECTS_CODE constant into a ModuleType to test type module attributes. Self-contained test scaffolding with no visible external source.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/GrahamDumpleton/wrapt wrapt && cd wrapt
git checkout 2.5.1
disclude scan --severity info --diff 2.5.0 .