#522 `languages.get_language()` unsafe fallback import lets PyPI package shadow language module (e.g. `id`)

[Bart van der Braak]

I'm DevOps Engineer at Blender and we noticed an issue popping up while building our the Indonesian language version of our documentation after updating one of our dependencies:

pipenv run sphinx-build -b html -j 12 -D language=id ./manual /home/blender/git/blender-manual-v450/build/html/id
Courtesy Notice:
Pipenv found itself running within a virtual environment,  so it will 
automatically use that environment, instead of  creating its own for any 
project. You can set
PIPENV_IGNORE_VIRTUALENVS=1 to force pipenv to ignore that environment and 
create  its own instead.
You can set PIPENV_VERBOSITY=-1 to suppress this warning.
Running Sphinx v7.4.7
loading translations [id]... done
making output directory... done
loading intersphinx inventory 'blender_api' from https://docs.blender.org/api/4.5/objects.inv...
building [mo]: targets for 0 po files that are out of date
writing output... 
building [html]: targets for 2072 source files that are out of date
updating environment: [new config] 2072 added, 0 changed, 0 removed
Sphinx parallel build error:
AttributeError: module 'id' has no attribute 'bibliographic_fields'

Source: https://builder.staging.blender.org/admin/#/builders/16/builds/4

It looks like docutils.languages.get_language() falls back to a bare import <language_code> when no docutils.languages.<code> module exists. If a PyPI package happens to share the name of a language code (e.g. id, the PEP 740 attestations package used by twine), that package gets imported instead, breaking language support with no clear error.

Reproduce

I crafted the following A/B scenario:

A: clean venv, no id package

[bart@ws-bart:/tmp]$ python3 -m venv /tmp/env_clean
[bart@ws-bart:/tmp]$ /tmp/env_clean/bin/pip install -q docutils

[notice] A new release of pip is available: 26.1.2 -> 26.2.1
[notice] To update, run: /tmp/env_clean/bin/python3 -m pip install --upgrade pip
[bart@ws-bart:/tmp]$ /tmp/env_clean/bin/python -c "
from docutils.languages import get_language
mod = get_language('id')
print(mod)
print(hasattr(mod, 'bibliographic_fields'))
"
<module 'docutils.languages.en' from '/tmp/env_clean/lib/python3.14/site-packages/docutils/languages/en.py'>
True

B: venv with id pypi package installed

[bart@ws-bart:/tmp]$ # --- B: venv with `id` pypi package installed ---
[bart@ws-bart:/tmp]$ python3 -m venv /tmp/env_poisoned
[bart@ws-bart:/tmp]$ /tmp/env_poisoned/bin/pip install -q docutils id

[notice] A new release of pip is available: 26.1.2 -> 26.2.1
[notice] To update, run: /tmp/env_poisoned/bin/python3 -m pip install --upgrade pip
[bart@ws-bart:/tmp]$ /tmp/env_poisoned/bin/python -c "
from docutils.languages import get_language
mod = get_language('id')
print(mod)
print(hasattr(mod, 'bibliographic_fields'))
"
<module 'id' from '/tmp/env_poisoned/lib/python3.14/site-packages/id/__init__.py'>
False

Versions used

docutils 0.21.2, Python 3.12

[Bart van der Braak]

Correction in "versions used":

[bart@ws-bart:/tmp]$ /tmp/env_poisoned/bin/python3 --version
Python 3.14.6
[bart@ws-bart:/tmp]$ /tmp/env_poisoned/bin/pip list
Package  Version
-------- -------
docutils 0.23
id       1.6.1
pip      26.1.2
urllib3  2.7.0

[Günter Milde]

The issue should be fixed in [r10398].
Thank you for the report.