disclude.ioPyPI / hypothesis / 6.169.4
hypothesis 6.169.4
- Source
- https://github.com/HypothesisWorks/hypothesis
- Tag scanned
v6.169.4- Directory
hypothesis- Compared with
v6.169.3(0 signals introduced since)- Files
- 536 scanned, 16 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 107 info
- Scan time
- 31.5 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 47 of 47 warn and critical signals; 47 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-15 13:42
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= = =likely benign Docs config execs the project's own version.py to read __version__.Reasoning
exec of a version.py file read from the project's own source tree in docs config; this is a common Sphinx pattern to extract __version__ without importing the package. Non-literal but benign, local, and not fetched from the network.
-
-
# Run all the no-extra-dependency tests for this version (except slow nocover tests) # Run tests for each extra module while the requirements are installed -
-
-
-
-
-
-
-
-
# Run some tests without docstrings or assertions, to catch bugs -
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
-
-
if [; then -
-
-
-
if [ ; then -
-
-
# ...but running twice takes time, don't overdo it -
# ...but running twice takes time, don't overdo it else -
else fi -
) = =dismissed Uses frame introspection to report the calling location for reject().Reasoning
inspect.currentframe used to locate the caller for error reporting in reject(). Standard testing-library behaviour, no malicious use.
-
= =dismissed Frame introspection to record the location of assume() calls.Reasoning
Same caller-location introspection for assume(), used for observability reporting. Legitimate.
-
=likely benign Decodes and decompresses a Hypothesis blob-format value with error handling.Reasoning
zlib.decompress on a decoded blob from a reproduction/seed blob string, with error handling raising InvalidArgument. This is a user-facing serialization format for reproducing failures, not a hidden embedded payload. The base64/zlib pairing is a known false-positive pattern for this rule.
-
likely benign Syntax-checks a repr string with compile() to validate generated code.
Reasoning
compile(repr(...)) is used only as a syntax validity check on generated repr text, inside a suppress(SyntaxError). It does not execute the code. Benign.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Compiles generated expression text purely to check its syntax.Reasoning
compile(r, ..., 'eval') validates generated source text for syntax only, not executing it. Benign ghostwriter validation.
-
# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Syntax-checks a repr string via compile() without executing it.Reasoning
compile(repr(identity), 'exec') is a syntax check on a repr; the comment notes ghostwriting still should not be used on hostile code, implying awareness. Compile does not run the code. Benign.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:dismissed Walks stack frames via sys._getframe for internal sizing logic.Reasoning
sys._getframe used to walk stack frames for size estimation of a helper. Internal introspection with no network or payload behaviour.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = fdismissed Reads caller frame filename and line number for coverage descriptions.Reasoning
sys._getframe used to find the caller's file and line for coverage-related description. Legitimate internal debugging/coverage support.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:265:20=likely benign Evaluates reconstructed lambda source to rebuild a function object.Reasoning
eval of source reconstructed from a lambda's own source text in the caller's globals, to recreate lambda objects for lambda-source tracking. Expected for this library's purpose, though eval of recovered source is a sensitive pattern.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:298:9) =likely benign Executes generated code to reconstruct a lambda with closure variables.Reasoning
exec of a generated construction string into the function's globals to rebuild closures with free variables. Consistent with the library's lambda-reconstruction feature; source is derived from the user's own code, not fetched externally.
-
assert = returnlikely benign Execs a source string into a fresh namespace to build a function.Reasoning
exec of a source string into a fresh module-like namespace to build a function from source; it is a cached helper for recreating functions from their source. Expected in this library, source originates locally.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:114:13# pragma: no cover # only on Python < 3.12 returndismissed Installs a trace function for Hypothesis's explanation analysis.Reasoning
sys.settrace used to install a tracer for coverage/explanation analysis on Python below 3.12, with a pragma comment. Legitimate profiling/tracing.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:137:13# pragma: no cover # only on Python < 3.12 returndismissed Removes the trace function installed by the scrutineer.Reasoning
Paired sys.settrace(None) removing the tracer installed above. Legitimate.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/strategies.py:102:31return : | None = =likely benign Frame walk in Hypothesis strategies to find the user-facing caller location.Reasoning
Hypothesis walks the call stack to locate the user's code that created a strategy, skipping its own files. This is a standard, legitimate use of sys._getframe for error reporting.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/types.py:227:37: | None = None : | None = = flikely benign Frame walk in type-strategy code to find a source location.Reasoning
Same pattern as the other sys._getframe call: a loop over frames to report a source location. Consistent with Hypothesis's own debugging or reporting logic.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/codemods/test_codemod_cli.py:40:12returnlikely benign Test helper wrapping subprocess.run with shell=True for codemod CLI tests.Reasoning
A test helper that runs a command string through subprocess with shell=True. The command comes from test code, not untrusted input, so it is a test convenience rather than a dropper. The shell use is still worth a glance.
-
info
warn→ info by reviewframe-introspectionhypothesis/tests/conjecture/test_junkdrawer.py:201:16assert ==likely benign Test checking stack depth via inspect.stack in a recursive function.Reasoning
inspect.stack is used in a recursion test to check stack depth. It is a test of the stack-depth helper with no malicious behaviour.
-
assert not = assert assert notlikely benign Round-trip test evaluating the repr of a feature-flags object.Reasoning
eval(repr(flags)) is a round-trip test checking that the repr of a feature-flags object reconstructs an equivalent object. The input is the test's own object, not external data.
-
=likely benign Round-trip test evaluating the repr of a feature-flags object.Reasoning
Same repr round-trip pattern as the other feature-flags eval, testing serialization of the test's own object.
-
# the line `offset` lines below the `def` statement of the calling function = . return flikely benign Test helper reading the caller's frame to compute a line number.Reasoning
inspect.currentframe().f_back is used to compute the line number of a calling function for a test assertion. Read-only introspection in a test.
-
]: = assert == assert ==likely benign Round-trip test evaluating pretty-printed regex output.Reasoning
eval of pretty-printed output to verify that pretty-printing a regex round-trips. The input is generated within the test.
-
assert ==likely benign Test evaluating a float repr with a limited namespace.Reasoning
eval of a repr with a restricted namespace, used to check float round-tripping in a test. Benign test code.
-
assert ==likely benign Test evaluating pretty-printed enum source.Reasoning
eval of pretty-printed enum code, checking that the printed form reproduces the input. Test-only.
-
assert == f # hexadecimal with underscores assert ==likely benign Test evaluating a formatted integer literal.Reasoning
eval of a formatted hex-with-underscores string to confirm the round-trip value. Test-only, with fixed inputs.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Test decoding a reproduce_failure blob and evaluating it to rebuild a test.Reasoning
The file imports base64 and zlib and calls eval, which matches the decoder-plus-exec shape. In context this is Hypothesis's @reproduce_failure decoding, which turns a blob from test notes back into a test reproduction. That is legitimate, though eval on decoded data is a real pattern worth noting.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Eval of an extracted reproduce_failure expression in a test.Reasoning
The dynamic-execution eval of the regex-extracted reproduction string, the same site as the decoder finding. Same legitimate reproduction-decoding purpose.
-
-
-
= = -
= = -
= = -
= = -
= = -
= = -
= = -
= = -
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:37:1= == 3.1415likely benign Lambda assigned to a Latin-plus-Greek identifier in a unicode test.Reasoning
A deliberate Unicode identifier in a test named for unicode identifier handling. Mixed-script names are the point of the test, not obfuscation.
-
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:41:44assert ==likely benign Test referencing the Greek-letter unicode identifier.Reasoning
Same intentional mixed-script identifier, used in a test that checks source description of unicode-named lambdas.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/recorded/magic_builtins.txt:112:5eval(source, globals, locals)dismissed Eval appearing in a recorded documentation or fixture text file.Reasoning
The file is a recorded text fixture of ghostwriter output, and the eval appears in quoted prose or example code. It is not executed by the package.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test helper executes generated Python source to verify it is valid.Reasoning
Test file for Hypothesis ghostwriter; exec of generated source code to check it runs without SyntaxError/NameError. Decoder import flag is incidental (base64 imported for test data), no obfuscated payload.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec of expected generated source inside a test.Reasoning
exec on a variable holding expected generated source in a test assertion context; legitimate test verification pattern.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:317:5assert ==likely benign Test executes generated source code to check validity.Reasoning
Same test pattern executing generated code with a namespace containing a sentinel; no malicious indicators.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:339:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test executes generated source code to check validity.Reasoning
Same legitimate test verification of generated code.
-
likely benign Test helper execs generated code and prints it on exception.
Reasoning
Helper in a test that execs generated source and prints it on failure; standard test scaffolding.
-
=likely benign Test execs generator output to check it runs.Reasoning
Test executes output of ghostwriter.magic to ensure it runs; legitimate test of a code generator.
-
=likely benign Test execs generated binary operation source.Reasoning
Same pattern: test verifies generated binary_operation source executes.
-
# Most importantly: the code should execute without NameErrorlikely benign Test execs generated source to check for NameError.Reasoning
Test comment states code should execute without NameError; legitimate verification.
-
= # and also works with explicit identity element =likely benign Test execs generated binary_operation source.Reasoning
Legitimate test of generated code from binary_operation.
-
=likely benign Test execs generated binary_operation source with identity.Reasoning
Legitimate test of generated code with explicit identity.
-
assert inlikely benign Test execs generated source after asserting content.Reasoning
Test asserts substring then execs generated source; legitimate.
-
= # Also cover passing an explicit `annotate`, rather than the default None. =likely benign Test execs generated ufunc source.Reasoning
Test execs generated ufunc source; legitimate test of code generator.
-
=likely benign Test execs generated ufunc source with annotate.Reasoning
Same legitimate ufunc generation test.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12returnlikely benign Test helper running CLI commands through a shell.Reasoning
Test helper wrapping subprocess with shell=True for running CLI commands in tests; cmd is supplied by test code, not untrusted input. Critical severity is overstated for a test helper, though shell=True with variable input is a general hygiene concern.
-
= = = assert ==likely benign Test evals repr of strategy for round-trip check.Reasoning
Evals repr of Hypothesis strategies from the test's own parametrized inputs to check round-tripping; legitimate test pattern with controlled inputs.
-
assert ==likely benign Test evals strategy repr strings for round-trip.Reasoning
Parametrized test evaluating repr strings of strategies it generated itself; benign round-trip check.
-
= = =likely benign A numpy floor/ceil test helper calls eval on a function parameter to build an array.Reasoning
The eval call takes a function parameter named value and wraps it in np.array. This looks like a test helper that evaluates a parametrized literal expression, such as a list or number supplied by pytest parametrization. Eval on test input is a poor practice and a real risk if untrusted data reaches it, but within a test file with no shell, network, or encoded payload, it reads as a legitimate though sloppy test pattern. The doubt is that the parameter source is not shown.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&