PyPI / hatchling / 1.32.4

hatchling 1.32.4

Source

https://github.com/pypa/hatch

Tag scanned

hatchling-v1.32.4

Directory

backend (only this part of the repository was scanned)

Compared with

hatchling-v1.32.3 (0 signals introduced since)

Files

72 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

2.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 00:34

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line backend/README.md:10:1

   line length 796 characters (raw pass, confidence 0.50)

   | Meta | [![Hatch project](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/pypa/hatch/master/docs/assets/badge/v0.json)](https://github.com/pypa/hatch) [![linting - Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets/badge/v2.json)](https://gi

2. info warn → info by review dynamic-execution backend/src/hatchling/version/source/code.py:58:19

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

           # Execute the expression to determine the version
           version = eval(expression, vars(module))  # noqa: S307
   
           return {"version": version}

   likely benign LLM, confidence 0.93 Hatchling's version-from-code source uses eval on a configured expression to read a version string from a module.

   Reasoning

   This is hatchling's code version source: it evaluates a user-configured expression against a module the build loaded from the project's own version file, to extract a version string. The eval is intentional, part of a documented feature, and annotated with noqa S307. It is a legitimate build-tool pattern, not obfuscation or a dropper, and the evaluated expression comes from the project's own build configuration.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pypa/hatch hatch && cd hatch
git checkout hatchling-v1.32.4
disclude scan --severity info --diff hatchling-v1.32.3 backend