PyPI / hatchling / 1.32.4

hatchling 1.32.4

Source

https://github.com/pypa/hatch

Tag scanned

hatchling-v1.32.4

Directory

backend (only this part of the repository was scanned)

Compared with

hatchling-v1.32.3 (0 signals introduced since)

Files

72 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

1.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:23

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line backend/README.md:10:1

   line length 796 characters (raw pass, confidence 0.50)

   | Meta | [![Hatch project](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/pypa/hatch/master/docs/assets/badge/v0.json)](https://github.com/pypa/hatch) [![linting - Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets/badge/v2.json)](https://gi

2. info warn → info by review dynamic-execution backend/src/hatchling/version/source/code.py:58:19

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

           # Execute the expression to determine the version
           version = eval(expression, vars(module))  # noqa: S307
   
           return {"version": version}

   likely benign LLM, confidence 0.95 Build-backend helper that evals a configured version expression against an imported module to extract the package version.

   Reasoning

   This is hatchling's version-from-code source, which intentionally evaluates a user-configured expression against a module namespace to read the project version. The eval is a documented feature of the build backend, not hidden obfuscation, and the noqa comment shows it was a known, deliberate choice. It runs only in the project's own build configuration.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pypa/hatch hatch && cd hatch
git checkout hatchling-v1.32.4
disclude scan --severity info --diff hatchling-v1.32.3 backend