disclude.io

PyPI / ast-serialize / 0.13.1

ast-serialize 0.13.1

Source
https://github.com/mypyc/ast_serialize
Tag scanned
v0.13.1
Compared with
v0.13.0 (0 signals introduced since)
Files
728 scanned, 848 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 38 info
Scan time
4.8 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-17 21:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info whitespace-anomaly crates/ruff_annotate_snippets/tests/color/multiline_removal_suggestion.rs:2:1

    file mixes tab and space indentation (39 tab-indented and 40 space-indented lines) (raw pass, confidence 0.40)

    use annotate_snippets::{
    AnnotationKind, Level, Origin, Patch, Renderer, Snippet, renderer::DecorStyle,
};
  2. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:58

    identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation
  3. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:75

    identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation
  4. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:62

    identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation
  5. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:79

    identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation
  6. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3368:64

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

    ��|�\u{0002}!5�cc\u{0015}\u{0002}�Ӻi��WWj�ȥ�'�}�\u{0012}�J�ȉ��W�\u{001e}O�@����\u{001c}w�V���LO����\u{0014}[ \u{0003}_�'���SQ�~ذ��ų&��-\t��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩\u{001d}�:�\u{001c}\u{0007}�";
  7. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3396:31

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

      |
1 | �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  | ^
  8. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3414:33

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

      │
1 │ �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  │ ━
  9. info whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:12:1

    file mixes tab and space indentation (1 tab-indented and 3952 space-indented lines) (raw pass, confidence 0.40)

    fn ends_on_col0() {
    let source = r#"
fn foo() {
}
  10. info warn → info by review whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:4533:3

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

        let s = c"foo\
  ⟨U+00A0⟩          bar
             ";
    //~^^^ WARNING whitespace symbol '\u{a0}' is not skipped
    likely benign LLM, confidence 0.93 Test fixture containing a non-breaking space to exercise rustc-compatible whitespace warnings.
    Reasoning

    The U+00A0 appears inside a test fixture string literal mirroring rustc's own test for whitespace handling in c-string literals; the comment explicitly documents the non-breaking space being tested. This is intentional test data, not an attack.

  11. info proc-macro-presence crates/ruff_macros/src/lib.rs:23:1

    proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)

    
#[proc_macro_derive(OptionsMetadata, attributes(option, option_group))]
pub fn derive_options_metadata(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);
  12. info identifier-low-length crates/ruff_python_parser/resources/inline/err/different_match_pattern_bindings.py:1:1

    mean non-conventional identifier length 1.98 over 41 names (token pass, confidence 0.50)

  13. info identifier-low-length crates/ruff_python_parser/resources/inline/err/duplicate_type_parameter_names.py:1:1

    25 of 39 non-conventional identifiers are single-character (64%) (token pass, confidence 0.50)

  14. info identifier-low-length crates/ruff_python_parser/resources/inline/err/invalid_annotation_function.py:1:1

    32 of 76 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)

  15. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:1:6

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
  16. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:2:4

    identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
  17. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:3:8

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    rb"a𝐁c123"
b"""123a𝐁c"""
  18. info identifier-low-length crates/ruff_python_parser/resources/inline/ok/ambiguous_lpar_with_items_binary_expr.py:1:1

    mean non-conventional identifier length 1.97 over 30 names (token pass, confidence 0.50)

  19. info identifier-low-length crates/ruff_python_parser/resources/inline/ok/non_duplicate_type_parameter_names.py:1:1

    17 of 30 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)

  20. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/bool_op.py:1:1

    mean non-conventional identifier length 1.73 over 52 names (token pass, confidence 0.50)

  21. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/compare.py:1:1

    mean non-conventional identifier length 1.73 over 75 names (token pass, confidence 0.50)

  22. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/lambda.py:1:1

    48 of 78 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)

  23. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/t_string.py:1:1

    mean non-conventional identifier length 1.34 over 58 names (token pass, confidence 0.50)

  24. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/tuple.py:1:1

    mean non-conventional identifier length 1.33 over 24 names (token pass, confidence 0.50)

  25. info identifier-low-length crates/ruff_python_parser/resources/valid/other/decorator.py:1:1

    16 of 40 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

  26. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/delete.py:1:1

    mean non-conventional identifier length 1.86 over 21 names (token pass, confidence 0.50)

  27. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/function.py:1:1

    114 of 262 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)

  28. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/type.py:1:1

    100 of 249 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

  29. info whitespace-anomaly crates/ruff_python_parser/resources/valid/statement/type.py:27:1

    file mixes tab and space indentation (6 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)

    type \
	X = int
type X \
	= int
  30. info unicode-mixed-script crates/ruff_python_parser/src/lexer.rs:2120:43

    identifier `aβ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        fn test_non_ascii_name_flag() {
        let mut lexer = Lexer::new("a€\naβ = β\nascii", Mode::Module, TextSize::default());
        let mut flags = Vec::new();
        loop {
  31. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1611:29

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // test_err invalid_byte_literal
                    // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
  32. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1612:27

    identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {
  33. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1613:31

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {
                        value: Box::new([]),
  34. info warn → info by review encoding-hex crates/ruff_python_parser/src/string.rs:959:78

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

    \x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
    likely benign LLM, confidence 0.95 Parser test enumerating all byte values as \xNN escapes.
    Reasoning

    The snippet is a test table of all byte values written as escape sequences, used to verify Python string escape parsing across the full byte range. Raw-pass hex escape runs in a parser test are expected and carry no malicious intent.

  35. info warn → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:959:247

    129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)

    NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
    likely benign LLM, confidence 0.95 Exhaustive byte-escape test data in the Python parser's string tests.
    Reasoning

    Same byte-range test table in the Python string parser test file; the long escape run is a deliberate exhaustive input for escape handling, not obfuscated payload.

  36. info warn → info by review encoding-hex crates/ruff_python_parser/src/string.rs:967:78

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

    \x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
    likely benign LLM, confidence 0.95 Second exhaustive byte-escape test table in the Python parser tests.
    Reasoning

    This is a near-duplicate of the other byte-range test table in the parser's string tests, covering the escape-handling test for non-raw strings. It is legitimate test data.

  37. info warn → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:967:247

    129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)

    NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
    likely benign LLM, confidence 0.95 Continuation of exhaustive byte-escape test data in the Python parser tests.
    Reasoning

    Continuation of the same exhaustive byte-escape test fixture in the Python parser's string tests; no execution or payload behavior is present.

  38. info unicode-mixed-script crates/ruff_python_parser/src/string.rs:1169:29

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        fn test_invalid_byte_literal_error() {
        let source = r"b'123a𝐁c'";
        let error = parse_suite(source).unwrap_err();
        insta::assert_debug_snapshot!(error);

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/mypyc/ast_serialize ast_serialize && cd ast_serialize
git checkout v0.13.1
disclude scan --severity info --diff v0.13.0 .