hatchling 1.32.4

Source: https://github.com/pypa/hatch
Artifact scanned: hatchling-1.32.4-py3-none-any.whl (wheel · 76.9 KB · SHA-256 08ecf7548fb4…)
Compared with: hatchling-1.32.3-py3-none-any.whl (0 signals introduced since)
Files: 69 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 03:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution hatchling/version/source/code.py:58:19

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the expression to determine the version
        version = eval(expression, vars(module))  # noqa: S307

        return {"version": version}
```
likely benign LLM, confidence 0.93 Hatchling's version-source plugin evaluates a project-configured expression to read the package version during build.
Reasoning
This is hatchling's code version source, which evaluates a user-configured version expression against a module the project itself imports. The eval is intentional, documented as such, and annotated with noqa. It runs in the build of the project that declares it, not in a dropper or install-time payload of unrelated code. Benign build-tool behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o hatchling-1.32.4-py3-none-any.whl https://files.pythonhosted.org/packages/5f/80/91f51f439c05d4ec4623c22928ce16a938d6d793bf709477830823497859/hatchling-1.32.4-py3-none-any.whl
printf '%s  %s\n' 08ecf7548fb48205e7f213d70c71e67b8271b7242093dc3f1da578b42c734a2c hatchling-1.32.4-py3-none-any.whl | shasum -a 256 -c -
unzip -q hatchling-1.32.4-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg