python-jsonpath-python

LOW

maintainer medaminezghal 4 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from the project's own Git repository, which is a normal AUR practice; the recent orphaning and re-adoption does not imply malicious intent or supply-chain risk in this case.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is a normal AUR practice; the recent orphaning and re-adoption does not imply malicious intent or supply-chain risk in this case.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Rubin Simons <me@rubin55.org>
    
      2
    
      3_pkgname=jsonpath-python
    
      4pkgname="python-${_pkgname}"
    
      5pkgver=1.1.6
    
      6pkgrel=2
    
      7pkgdesc="A more powerful JSONPath implementation in modern python"
    
      8arch=("any")
    
      9url="https://github.com/sean2077/${_pkgname}"
    
      10license=('MIT')
    
      11depends=("python")
    
      12makedepends=(
    
      13    "python-build"
    
      14    "python-installer"
    
      15    "python-hatchling"
    
      16)
    
      17checkdepends=(
    
      18    "uv"
    
      19    "python-pytest"
    
      20)
    
      21source=("git+${url}.git#tag=${pkgver}")
    
      22sha256sums=('9e0ae4577526317249c34f7ed9ac27a710c4bdf927798e249bcba3e2ce6e9d04')
    
      23
    
      24build() {
    
      25    cd "${_pkgname}"
    
      26    python -m build --wheel --no-isolation
    
      27}
    
      28
    
      29check() {
    
      30    cd "${_pkgname}"
    
      31    uv sync --extra dev
    
      32    uv run python -m pytest
    
      33}
    
      34
    
      35package() {
    
      36    cd "${_pkgname}"
    
      37    python -m installer --destdir="${pkgdir}" dist/*.whl
    
      38    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
 _pkgname=jsonpath-python
 pkgname="python-${_pkgname}"
 pkgver=1.1.6
-pkgrel=1
+pkgrel=2
 pkgdesc="A more powerful JSONPath implementation in modern python"
 arch=("any")
 url="https://github.com/sean2077/${_pkgname}"
@@ -12,9 +12,11 @@
 makedepends=(
     "python-build"
     "python-installer"
+    "python-hatchling"
+)
+checkdepends=(
+    "uv"
     "python-pytest"
-    "python-hatchling"
-    "uv"
 )
 source=("git+${url}.git#tag=${pkgver}")
 sha256sums=('9e0ae4577526317249c34f7ed9ac27a710c4bdf927798e249bcba3e2ce6e9d04')

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 07:10:25	Medium	1
2026-10-11 00:26:05	Low	2
2026-10-11 00:16:25	Medium	1
2026-07-11 19:38:01	Clean	0
2026-06-18 16:11:54	Clean	0