hypothesis 6.170.1

Source: https://github.com/HypothesisWorks/hypothesis
Tag scanned: v6.170.1
Directory: hypothesis (only this part of the repository was scanned)
Compared with: v6.170.0 (0 signals introduced since)
Files: 537 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 107 info
Scan time: 31.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 47 of 47 warn and critical signals; 47 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 17:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution hypothesis/docs/conf.py:185:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_version_file = root.joinpath("src", "hypothesis", "version.py")
exec(_version_file.read_text(encoding="utf-8"), _d)
version = _d["__version__"]
release = _d["__version__"]
```
likely benign LLM, confidence 0.85 Docs config execs the package's own version.py to read __version__.
Reasoning
exec of a version.py file read from the project's own source tree during docs build; the expression is a path join with a literal, a known Sphinx-docs idiom for reading __version__ without importing the package. Not obfuscation, though exec on a file is a poor practice.

info long-line hypothesis/docs/usage.rst:8:1

line length 1436 characters (raw pass, confidence 0.50)

The following notable open-source projects use Hypothesis to test their code: `pytorch <https://github.com/pytorch/pytorch>`_, `jax <https://github.com/jax-ml/jax>`_, `PyPy <https://github.com/pypy/pypy>`_, `numpy <https://github.com/numpy/numpy>`_, `pandas <https://github.com/pandas-dev/pandas>`_, `attrs <https://gith

info dynamic-execution hypothesis/scripts/basic-test.sh:26:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

# Run all the no-extra-dependency tests for this version (except slow nocover tests)
$PYTEST tests/cover tests/pytest

# Run tests for each extra module while the requirements are installed

info dynamic-execution hypothesis/scripts/basic-test.sh:30:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install ".[pytz, dateutil, zoneinfo]"
$PYTEST tests/datetime/
pip uninstall -y pytz python-dateutil
```
info dynamic-execution hypothesis/scripts/basic-test.sh:34:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install ".[dpcontracts]"
$PYTEST tests/dpcontracts/
pip uninstall -y dpcontracts
```
info dynamic-execution hypothesis/scripts/basic-test.sh:40:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'fakeredis==' ../requirements/coverage.txt)"
$PYTEST tests/redis/
pip uninstall -y redis fakeredis
```
info dynamic-execution hypothesis/scripts/basic-test.sh:44:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'typing-extensions==' ../requirements/coverage.txt)"
$PYTEST tests/typing_extensions/
pip uninstall -y typing_extensions
```

info dynamic-execution hypothesis/scripts/basic-test.sh:49:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install "$(grep -m 1 -oE 'lark>=([0-9.]+)' ../hypothesis/pyproject.toml | tr '>' =)"
$PYTEST -Wignore tests/lark/
pip install "$(grep 'lark==' ../requirements/coverage.txt)"
$PYTEST tests/lark/

info dynamic-execution hypothesis/scripts/basic-test.sh:51:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'lark==' ../requirements/coverage.txt)"
$PYTEST tests/lark/
pip uninstall -y lark
```
info dynamic-execution hypothesis/scripts/basic-test.sh:56:3

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
  pip install ".[codemods,cli]"
  $PYTEST tests/codemods/
  pip uninstall -y libcst click
```
info dynamic-execution hypothesis/scripts/basic-test.sh:62:3

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
  pip install "$(grep -E 'black(==| @)' ../requirements/coverage.txt)"
  $PYTEST tests/ghostwriter/
  pip uninstall -y black numpy
fi
```
info dynamic-execution hypothesis/scripts/basic-test.sh:70:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$PYTEST tests/nocover/

# Run some tests without docstrings or assertions, to catch bugs
```

info dynamic-execution hypothesis/scripts/basic-test.sh:74:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

# like issue #822 in one of the test decorators.  See also #1541.
PYTHONOPTIMIZE=2 $PYTEST \
    -W'ignore:assertions not in test modules or plugins will be ignored because assert statements are not executed by the underlying Python interpreter:pytest.PytestConfigWarning' \

info dynamic-execution hypothesis/scripts/basic-test.sh:89:5

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    pip install "$NUMPY"
    $PYTEST tests/array_api
    $PYTEST tests/numpy
```
info dynamic-execution hypothesis/scripts/basic-test.sh:90:5

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    $PYTEST tests/array_api
    $PYTEST tests/numpy

    pip install "$(grep 'pandas==' ../requirements/coverage.txt)"
```
info dynamic-execution hypothesis/scripts/basic-test.sh:93:5

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    pip install "$(grep 'pandas==' ../requirements/coverage.txt)"
    $PYTEST tests/pandas
esac
```

info dynamic-execution hypothesis/scripts/other-tests.sh:14:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

# like issue #822 in one of the test decorators.  See also #1541.
PYTHONOPTIMIZE=2 $PYTEST \
    -W'ignore:assertions not in test modules or plugins will be ignored because assert statements are not executed by the underlying Python interpreter:pytest.PytestConfigWarning' \

info dynamic-execution hypothesis/scripts/other-tests.sh:21:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install ".[pytz, dateutil, zoneinfo]"
$PYTEST tests/datetime/
pip uninstall -y pytz python-dateutil
```
info dynamic-execution hypothesis/scripts/other-tests.sh:25:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install ".[dpcontracts]"
$PYTEST tests/dpcontracts/
pip uninstall -y dpcontracts
```
info dynamic-execution hypothesis/scripts/other-tests.sh:29:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install attrs
$PYTEST tests/attrs/
pip uninstall -y attrs
```
info dynamic-execution hypothesis/scripts/other-tests.sh:33:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install scipy
$PYTEST tests/scipy/
pip uninstall -y scipy
```
info dynamic-execution hypothesis/scripts/other-tests.sh:40:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'typing-extensions==' ../requirements/coverage.txt)"
$PYTEST tests/redis/
pip uninstall -y redis fakeredis
```
info dynamic-execution hypothesis/scripts/other-tests.sh:43:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$PYTEST tests/typing_extensions/
if [ "$HYPOTHESIS_PROFILE" != "crosshair" ]; then
  pip uninstall -y typing-extensions
```
info dynamic-execution hypothesis/scripts/other-tests.sh:49:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'annotated-types==' ../requirements/coverage.txt)"
$PYTEST tests/test_annotated_types.py
pip uninstall -y annotated-types
```

info dynamic-execution hypothesis/scripts/other-tests.sh:54:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install "$(grep -m 1 -oE 'lark>=([0-9.]+)' ../hypothesis/pyproject.toml | tr '>' =)"
$PYTEST -Wignore tests/lark/
pip install "$(grep 'lark==' ../requirements/coverage.txt)"
$PYTEST tests/lark/

info dynamic-execution hypothesis/scripts/other-tests.sh:56:1

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
pip install "$(grep 'lark==' ../requirements/coverage.txt)"
$PYTEST tests/lark/
pip uninstall -y lark
```

info dynamic-execution hypothesis/scripts/other-tests.sh:61:3

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

  pip install ".[codemods,cli]"
  $PYTEST tests/codemods/

  if [ "$(python -c 'import sys; print(sys.version_info[:2] == (3, 11))')" = "True" ] ; then

info dynamic-execution hypothesis/scripts/other-tests.sh:71:3

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
  pip install "$(grep -E 'black(==| @)' ../requirements/coverage.txt)"
  $PYTEST tests/patching/
  pip uninstall -y libcst
```
info dynamic-execution hypothesis/scripts/other-tests.sh:76:3

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
  pip install attrs
  $PYTEST tests/ghostwriter/
  pip uninstall -y attrs
  pip uninstall -y black
```

info dynamic-execution hypothesis/scripts/other-tests.sh:89:7

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

      pip install .
      $PYTEST --count=2 --repeat-scope=session tests/numpy tests/crosshair
      # ...but running twice takes time, don't overdo it
      $PYTEST tests/array_api

info dynamic-execution hypothesis/scripts/other-tests.sh:91:7

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)

      # ...but running twice takes time, don't overdo it
      $PYTEST tests/array_api
    else
      $PYTEST tests/array_api tests/numpy

info dynamic-execution hypothesis/scripts/other-tests.sh:93:7

command name is a variable (`$PYTEST`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    else
      $PYTEST tests/array_api tests/numpy
    fi
  fi
```
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/control.py:50:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        )
    frame = inspect.currentframe()
    where = _calling_function_location("reject", frame)
    if currently_in_test_context():
```
likely benign LLM, confidence 0.93 Captures the caller frame to report where reject() was invoked.
Reasoning
inspect.currentframe used to locate the caller for error messages in reject(); standard testing-library introspection.
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/control.py:78:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    if observability_enabled() or not condition:
        frame = inspect.currentframe()
        where = _calling_function_location("assume", frame)
        if observability_enabled() and currently_in_test_context():
```
likely benign LLM, confidence 0.93 Captures the caller frame for assume() location reporting.
Reasoning
Same caller-location introspection for assume(), used for observability reporting.
info ~~warn~~ → info by review decoder-decompress-payload hypothesis/src/hypothesis/core.py:442:23

file imports decoder module(s) base64, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        try:
            decoded = zlib.decompress(decoded[1:])
        except zlib.error as err:
            raise InvalidArgument(
```
likely benign LLM, confidence 0.90 Decompresses the serialized blob used to replay failing test examples.
Reasoning
zlib.decompress on a value from the Hypothesis reproduce-blob encoding (version byte stripped, then decoded); this is the library's own serialization format for replaying failing examples, not a hidden payload.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/extra/ghostwriter.py:293:17

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            with contextlib.suppress(SyntaxError):
                compile(repr(st.just(param.default)), "<string>", "eval")
                elements.insert(0, param.default)
        if elements or types:
```
likely benign LLM, confidence 0.90 Syntax-checks repr of a parameter default before using it in generated code.
Reasoning
compile of repr() of a strategy used only as a syntax check to decide whether to insert a default value; it is a validation step on the library's own generated text.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/extra/ghostwriter.py:719:9

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        r = re.sub(r"(lambda.*?: )(<unknown>)([,)])", r"\1...\3", r)
        compile(r, "<string>", "eval")
        # Finally, try to work out the imports we need for builds(), .map(),
        # .filter(), and .flatmap() to work without NameError
```
likely benign LLM, confidence 0.90 Compiles generated expression text purely to validate its syntax.
Reasoning
compile used to validate generated source text for ghostwritten tests; a syntax check with no execution.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/extra/ghostwriter.py:1837:13

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            # executed; so you still shouldn't ghostwrite for hostile code.
            compile(repr(identity), "<string>", "exec")
        except SyntaxError:
            identity = repr(identity)
```
likely benign LLM, confidence 0.90 Syntax-checks a repr string to decide how to emit an identity in generated code.
Reasoning
compile(repr(identity)) is a syntax-validity probe; the comment indicates intent, and the result only decides whether to fall back to repr.

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:182:27

identifier `aᵏ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # The sum of a geometric series is given by (ref: wikipedia):
    #     ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1)
    #               = S(m) / S(0)
    # assuming a != 1 and using the definition

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:182:35

identifier `aᵐ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # The sum of a geometric series is given by (ref: wikipedia):
    #     ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1)
    #               = S(m) / S(0)
    # assuming a != 1 and using the definition

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:185:23

identifier `aᵐ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # assuming a != 1 and using the definition
    #         S(m) := aᵐ⁺¹ - 1.
    # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is
    #     ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0)

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:187:27

identifier `aᵏ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is
    #     ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0)
    def S(n):
        return alphabet_size ** (n + 1) - 1

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:187:50

identifier `aᵏ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is
    #     ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0)
    def S(n):
        return alphabet_size ** (n + 1) - 1

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/datatree.py:187:78

identifier `aᵏ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is
    #     ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0)
    def S(n):
        return alphabet_size ** (n + 1) - 1

info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/internal/conjecture/junkdrawer.py:316:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = sys._getframe(2)
    size = 1
    while frame:
```
likely benign LLM, confidence 0.93 Walks the call stack to estimate object size for internal bookkeeping.
Reasoning
sys._getframe used to walk the stack for size estimation in a testing utility; ordinary introspection.

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:225:72

identifier `ˆøπ` mixes scripts: Other + Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    # common unicode characters
    "Ω≈ç√∫˜µ≤≥÷åß∂ƒ©˙∆˚¬…æœ∑´®†¥¨ˆøπ“‘¡™£¢∞§¶•ªº–≠¸˛Ç◊ı˜Â¯˘¿ÅÍÎÏ˝ÓÔ⟨U+F8FF⟩ÒÚÆ☃Œ„´‰ˇÁ¨ˆØ∏”’`⁄€‹›ﬁﬂ‡°·‚—±",
    # characters which increase in length when lowercased

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:225:170

identifier `ˇÁ` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    # common unicode characters
    "Ω≈ç√∫˜µ≤≥÷åß∂ƒ©˙∆˚¬…æœ∑´®†¥¨ˆøπ“‘¡™£¢∞§¶•ªº–≠¸˛Ç◊ı˜Â¯˘¿ÅÍÎÏ˝ÓÔ⟨U+F8FF⟩ÒÚÆ☃Œ„´‰ˇÁ¨ˆØ∏”’`⁄€‹›ﬁﬂ‡°·‚—±",
    # characters which increase in length when lowercased

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:225:176

identifier `ˆØ` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    # common unicode characters
    "Ω≈ç√∫˜µ≤≥÷åß∂ƒ©˙∆˚¬…æœ∑´®†¥¨ˆøπ“‘¡™£¢∞§¶•ªº–≠¸˛Ç◊ı˜Â¯˘¿ÅÍÎÏ˝ÓÔ⟨U+F8FF⟩ÒÚÆ☃Œ„´‰ˇÁ¨ˆØ∏”’`⁄€‹›ﬁﬂ‡°·‚—±",
    # characters which increase in length when lowercased

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:230:6

identifier `æœÆŒﬀʤʨß` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
    # ligatures
    "æœÆŒﬀʤʨß",
    # emoticons
    "(╯°□°）╯︵ ┻━┻)",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:254:6

identifier `ʇǝɯɐ` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
    # upsidown text
    "ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥",
    # reserved strings in windows
    "NUL",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:254:15

identifier `ʇᴉs` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
    # upsidown text
    "ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥",
    # reserved strings in windows
    "NUL",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:254:22

identifier `ɹolop` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
    # upsidown text
    "ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥",
    # reserved strings in windows
    "NUL",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:254:29

identifier `ɯnsdᴉ` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
    # upsidown text
    "ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥",
    # reserved strings in windows
    "NUL",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:254:38

identifier `ɯǝɹo` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
    # upsidown text
    "ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥",
    # reserved strings in windows
    "NUL",
```

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:262:146

identifier `ͅi` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣",

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:262:179

identifier `iͅn` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣",

info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:262:317

identifier `ͅi` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣",
```
info unicode-mixed-script hypothesis/src/hypothesis/internal/conjecture/providers.py:262:337

identifier `ͅc` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
```
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣",
```
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/internal/coverage.py:74:18

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # stack frames up.
        caller = sys._getframe(depth + 2)
        fname = pretty_file_name(caller.f_code.co_filename)
        local_description = f"{name} at {fname}:{caller.f_lineno}"
```
likely benign LLM, confidence 0.93 Reads caller frame metadata to label coverage observations.
Reasoning
sys._getframe used to find the caller's filename and line for coverage-description labels; standard debug/introspection use.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/internal/lambda_sources.py:265:20

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    if not f_code.co_freevars and not referenced_modules:
        compiled = eval(source, f_globals)
    else:
        if f_code.co_freevars:
```
likely benign LLM, confidence 0.85 Evaluates reconstructed lambda source to rebuild a function for display or reuse.
Reasoning
eval of reconstructed lambda source from the library's own source-extraction logic, for recreating lambdas in repr output; the source comes from the user's own code being tested, not an external payload.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/internal/lambda_sources.py:298:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        )
        exec(exec_str, f_globals)
        compiled = f_globals["__construct_lambda"]()
```
likely benign LLM, confidence 0.85 Execs generated code to reconstruct a lambda that has free variables.
Reasoning
exec of a generated construction string for lambdas with closures, reconstructing function objects from their extracted source; a known metaprogramming pattern in this module, operating on local code.
info ~~warn~~ → info by review dynamic-execution hypothesis/src/hypothesis/internal/reflection.py:367:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert isinstance(source, str)
    exec(source, result.__dict__)
    eval_cache[source] = result
    return result
```
likely benign LLM, confidence 0.85 Executes reconstructed function source into a fresh namespace with caching.
Reasoning
exec of source text into a result module dict, used to reconstruct functions from source for caching; this is the library's dynamic-function-building utility, with the source derived from the user's own code.
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/internal/scrutineer.py:114:13

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if not hasattr(sys, "monitoring"):  # pragma: no cover  # only on Python < 3.12
            sys.settrace(self.trace)
            return self
```
likely benign LLM, confidence 0.93 Installs a trace function for code-behavior analysis on older Pythons.
Reasoning
sys.settrace installs a tracer for coverage/scrutiny analysis, guarded for Python versions without sys.monitoring; a legitimate profiling mechanism.
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/internal/scrutineer.py:137:13

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if not hasattr(sys, "monitoring"):  # pragma: no cover  # only on Python < 3.12
            sys.settrace(None)
            return
```
likely benign LLM, confidence 0.93 Removes the trace function installed by the scrutineer.
Reasoning
Paired removal of the trace function set above; normal cleanup.
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/strategies/_internal/strategies.py:102:31

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        return location
    frame: FrameType | None = sys._getframe(1)
    while frame is not None and is_hypothesis_file(frame.f_code.co_filename):
        frame = frame.f_back
```
likely benign LLM, confidence 0.85 Stack walk to find the user-code location of a strategy definition.
Reasoning
sys._getframe(1) walks up the stack past Hypothesis's own files to report the user's call site for strategy location. This is a standard debugging/location technique in a testing library, not evasion.
info ~~warn~~ → info by review frame-introspection hypothesis/src/hypothesis/strategies/_internal/types.py:227:37

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    found_loc: str | None = None
    frame: types.FrameType | None = sys._getframe()
    while frame is not None:
        loc = f"{frame.f_code.co_filename}:{frame.f_lineno}"
```
likely benign LLM, confidence 0.85 Frame walk to locate the calling user code for error or repr reporting.
Reasoning
sys._getframe() walks frames to find the first non-Hypothesis location, used for reporting where a type-resolved strategy was created. Legitimate library introspection.
info ~~critical~~ → info by review dynamic-execution hypothesis/tests/codemods/test_codemod_cli.py:40:12

`subprocess.run` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run(command, *, cwd=None, input=None):
    return subprocess.run(
        command,
        input=input,
```
likely benign LLM, confidence 0.75 Test helper that shells out to run the codemod CLI.
Reasoning
A test helper runs a command via shell=True, but the caller is a test utility for invoking the codemod CLI with test-supplied arguments. The pattern is risky in general, but here it is confined to test code with no attacker-controlled input path shown.
info ~~warn~~ → info by review frame-introspection hypothesis/tests/conjecture/test_junkdrawer.py:201:16

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
def recur(i):
    assert len(inspect.stack(0)) == stack_depth_of_caller()
    if i >= 1:
        recur(i - 1)
```
likely benign LLM, confidence 0.90 Test asserting stack-depth helper behavior via recursion.
Reasoning
inspect.stack(0) is used in a test to check that stack depth matches the caller's depth. Purely a test of the junkdrawer utility.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_feature_flags.py:58:14

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert not flags.is_enabled("off")
    flags2 = eval(repr(flags))
    assert flags2.is_enabled("on")
    assert not flags2.is_enabled("off")
```
likely benign LLM, confidence 0.90 Round-trip test evaluating the repr of a feature-flags object.
Reasoning
eval(repr(flags)) is a round-trip test confirming the repr of a FeatureFlags object reconstructs an equivalent object. The eval input is the library's own repr output, not external data.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_feature_flags.py:72:14

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    flags2 = eval(repr(flags))

    for f in features:
```
likely benign LLM, confidence 0.90 Round-trip eval of feature-flags repr in a test.
Reasoning
Same repr round-trip pattern as the earlier feature-flags test, evaluating the library's own repr output in a test.
info ~~warn~~ → info by review frame-introspection hypothesis/tests/cover/test_observability.py:337:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # the line `offset` lines below the `def` statement of the calling function
    frame = inspect.currentframe().f_back
    return f"{__file__}:{frame.f_code.co_firstlineno + offset}"
```
likely benign LLM, confidence 0.90 Test helper computing a caller's file and line for assertions.
Reasoning
inspect.currentframe().f_back is used to compute the line number of a calling function for test expectations. Ordinary test helper behavior.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_pretty.py:596:14

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    ]:
        r2 = eval(pretty.pretty(r), globals())
        assert r.pattern == r2.pattern
        assert r.flags == r2.flags
```
likely benign LLM, confidence 0.92 Round-trip test evaluating pretty-printed regex output.
Reasoning
eval of pretty.pretty(r) checks that a regex pretty-printed representation reconstructs the same object. Self-generated input in a test.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_pretty.py:625:9

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert float_to_lex(obj) == float_to_lex(
        eval(rep, {"struct": struct, "nan": float("nan")})
    )
```
likely benign LLM, confidence 0.92 Test evaluating a generated repr string for float round-trip checks.
Reasoning
Evaluates a repr string with a restricted namespace to check float lexing for NaN and struct values. Test-generated input in a controlled namespace.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_pretty.py:686:26

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def test_pretty_prints_enums_as_code(rep):
    assert pretty.pretty(eval(rep)) == rep
```
likely benign LLM, confidence 0.92 Test evaluating enum repr strings from parametrized fixtures.
Reasoning
Evaluates a parametrized repr string of an enum and checks it pretty-prints back to the same text. Test fixture input only.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_pretty.py:770:12

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert got == f"{x:#_x}"  # hexadecimal with underscores
    assert eval(got) == x
```
likely benign LLM, confidence 0.92 Test evaluating a formatted integer literal to verify it round-trips.
Reasoning
eval(got) checks that a formatted hexadecimal-with-underscores string parses back to the original integer. Self-generated test value.
info ~~warn~~ → info by review decoder-import-with-exec hypothesis/tests/cover/test_reproduce_failure.py:146:20

file imports decoder module(s) base64, zlib and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
    extract = exp.search(notes)
    reproduction = eval(extract.group(0))
    test = reproduction(test)
```
likely benign LLM, confidence 0.80 Decodes and evals a reproduction blob for the reproduce_failure feature.
Reasoning
The file imports base64 and zlib and evals decoded text. This matches the multi-stage shape, but it is the library's own reproduce_failure decorator decoding a blob from the user's notes and reconstructing a test. Legitimate, documented feature under test.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/cover/test_reproduce_failure.py:146:20

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    extract = exp.search(notes)
    reproduction = eval(extract.group(0))
    test = reproduction(test)
```
likely benign LLM, confidence 0.80 Eval of the decoded reproduction blob in reproduce_failure handling.
Reasoning
Same eval call as the decoder-import finding, flagged separately as a dynamic-execution signal. Same legitimate reproduce_failure mechanism applies.
info unicode-homoglyph hypothesis/tests/cover/test_simple_characters.py:114:68

identifier `te02тест49st` contains homoglyph candidates: е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
    with pytest.raises(InvalidArgument):
        check_can_generate_examples(characters(include_characters="te02тест49st"))
```
info unicode-mixed-script hypothesis/tests/cover/test_simple_characters.py:114:68

identifier `te02тест49st` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
    with pytest.raises(InvalidArgument):
        check_can_generate_examples(characters(include_characters="te02тест49st"))
```
info unicode-homoglyph hypothesis/tests/cover/test_simple_characters.py:118:19

identifier `te02тест49st` contains homoglyph candidates: е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
def test_whitelisted_characters_overlap_blacklisted_characters():
    good_chars = "te02тест49st"
    bad_chars = "ts94тсет"
    with pytest.raises(InvalidArgument) as exc:
```

info unicode-mixed-script hypothesis/tests/cover/test_simple_characters.py:118:19

identifier `te02тест49st` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

def test_whitelisted_characters_overlap_blacklisted_characters():
    good_chars = "te02тест49st"
    bad_chars = "ts94тсет"
    with pytest.raises(InvalidArgument) as exc:

info unicode-homoglyph hypothesis/tests/cover/test_simple_characters.py:119:18

identifier `ts94тсет` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)
```
    good_chars = "te02тест49st"
    bad_chars = "ts94тсет"
    with pytest.raises(InvalidArgument) as exc:
        check_can_generate_examples(
```
info unicode-mixed-script hypothesis/tests/cover/test_simple_characters.py:119:18

identifier `ts94тсет` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
    good_chars = "te02тест49st"
    bad_chars = "ts94тсет"
    with pytest.raises(InvalidArgument) as exc:
        check_can_generate_examples(
```
info unicode-homoglyph hypothesis/tests/cover/test_simple_characters.py:134:24

identifier `teтестst` contains homoglyph candidates: е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
def test_whitelisted_characters_override():
    good_characters = "teтестst"
    st = characters(
        min_codepoint=ord("0"),
```
info unicode-mixed-script hypothesis/tests/cover/test_simple_characters.py:134:24

identifier `teтестst` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
def test_whitelisted_characters_override():
    good_characters = "teтестst"
    st = characters(
        min_codepoint=ord("0"),
```
info unicode-homoglyph hypothesis/tests/cover/test_simple_characters.py:148:18

identifier `te02тест49st` contains homoglyph candidates: е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
def test_blacklisted_characters():
    bad_chars = "te02тест49st"
    st = characters(
        min_codepoint=ord("0"), max_codepoint=ord("9"), exclude_characters=bad_chars
```

info unicode-mixed-script hypothesis/tests/cover/test_simple_characters.py:148:18

identifier `te02тест49st` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

def test_blacklisted_characters():
    bad_chars = "te02тест49st"
    st = characters(
        min_codepoint=ord("0"), max_codepoint=ord("9"), exclude_characters=bad_chars

info ~~warn~~ → info by review unicode-mixed-script hypothesis/tests/cover/test_unicode_identifiers.py:37:1

identifier `is_approx_π` mixes scripts: Latin + Greek (raw pass, confidence 0.80)
```
is_approx_π = lambda x: x == 3.1415
```
dismissed LLM, confidence 0.97 Lambda named with a Greek pi, testing unicode identifier support.
Reasoning
The Greek letter pi in an identifier is deliberate, as the test file is named for unicode identifiers. Mixed-script identifiers in a test are expected and not a deceptive homoglyph attack.
info ~~warn~~ → info by review unicode-mixed-script hypothesis/tests/cover/test_unicode_identifiers.py:41:44

identifier `is_approx_π` mixes scripts: Latin + Greek (raw pass, confidence 0.80)
```
def test_can_handle_unicode_identifier_in_same_line_as_lambda_def():
    assert get_pretty_function_description(is_approx_π) == "lambda x: x == 3.1415"
```
dismissed LLM, confidence 0.97 Test referencing the unicode-named lambda for description output.
Reasoning
Reuses the deliberately unicode-named lambda to test description output. Same intentional test content.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/recorded/magic_builtins.txt:112:5

[markup prose] `eval` called on a string literal (ast pass, confidence 0.85)
```
    eval(source, globals, locals)
```
dismissed LLM, confidence 0.90 Recorded documentation text containing an eval example.
Reasoning
This is recorded prose/doc output in a text file, showing an eval signature in an example. It is not executable code in the library and is markup text.
info ~~warn~~ → info by review decoder-import-with-exec hypothesis/tests/ghostwriter/test_expected_output.py:302:5

file imports decoder module(s) base64 and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
    assert actual == expected  # We got the expected source code
    exec(expected, {})  # and there are no SyntaxError or NameErrors
```
likely benign LLM, confidence 0.93 Test helper that execs ghostwriter-generated source to verify it is valid Python.
Reasoning
This is a test in the Hypothesis ghostwriter test suite. The exec call runs generated source code the test itself produced, to check it has no SyntaxError or NameError. The base64 import is incidental to the test's purpose and not a decoding payload.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:302:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert actual == expected  # We got the expected source code
    exec(expected, {})  # and there are no SyntaxError or NameErrors
```
likely benign LLM, confidence 0.93 exec of expected generated source in a test to confirm it runs cleanly.
Reasoning
exec of a variable holding generated expected source in a test assertion context. This is a test-validation pattern, not an attack; the source is a fixture the test controls.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:317:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert actual == expected
    exec(expected, {"not_set": not_set})
```
likely benign LLM, confidence 0.92 Test execs generated expected source to check it resolves names correctly.
Reasoning
Same test pattern: exec on the expected generated source with a namespace containing a sentinel. Used to validate ghostwriter output in tests.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:339:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert actual == expected  # We got the expected source code
    exec(expected, {})  # and there are no SyntaxError or NameErrors
```
likely benign LLM, confidence 0.92 Test execs generated source to confirm validity.
Reasoning
Repeated test pattern of exec on generated expected source to validate it compiles and runs; no network, decoding, or persistence behaviour.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:56:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        exec(source_code, namespace)
    except Exception:
        print(f"************\n{source_code}\n************")
```
likely benign LLM, confidence 0.92 Test helper execs generated source and logs it on exception.
Reasoning
Helper inside a test that execs generated source and prints it on failure for debugging. Standard test scaffolding for code generation.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:206:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.magic(socket)
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs ghostwriter-generated source.
Reasoning
Test calls ghostwriter.magic to generate source and execs it to ensure it runs. Expected for a code generator's test suite.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:213:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.binary_operation(takes_frozensets)
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs generated binary-operation source.
Reasoning
Generated binary-operation source is exec'd in a test to check it executes without error.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:234:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Most importantly: the code should execute without NameError
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs generated code to check for NameError.
Reasoning
Test comment explicitly states the purpose is that generated code runs without NameError. Standard validation.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:436:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.binary_operation(compose_types)
    exec(source_code, {})
    # and also works with explicit identity element
    source_code = ghostwriter.binary_operation(compose_types, identity=type)
```
likely benign LLM, confidence 0.92 Test execs generated binary-operation source.
Reasoning
Test execs generated binary-operation source, including an identity-element variant. Test-only code generation check.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:439:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.binary_operation(compose_types, identity=type)
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs generated binary-operation source with identity.
Reasoning
Same pattern as the preceding finding for the explicit-identity case.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:846:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert "one_of(" in source_code
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs generated one_of source after asserting its content.
Reasoning
Test asserts generated source content and then execs it. Ordinary test of a code generator.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:854:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.ufunc(numpy.isnan)
    exec(source_code, {})
    # Also cover passing an explicit `annotate`, rather than the default None.
    source_code = ghostwriter.ufunc(numpy.isnan, annotate=True)
```
likely benign LLM, confidence 0.92 Test execs generated ufunc source.
Reasoning
Test execs ufunc-generated source, including an annotate variant. Test-only validation.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:857:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.ufunc(numpy.isnan, annotate=True)
    exec(source_code, {})
```
likely benign LLM, confidence 0.92 Test execs generated ufunc source with annotate.
Reasoning
Same ufunc generated-source exec in a test with annotate=True.
info ~~critical~~ → info by review dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12

`subprocess.run` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run(cmd, *, cwd=None):
    return subprocess.run(
        cmd, capture_output=True, shell=True, text=True, cwd=cwd, encoding="utf-8"
    )
```
likely benign LLM, confidence 0.90 Test helper wrapping subprocess.run with shell=True to invoke CLI commands.
Reasoning
A small test-helper wrapper around subprocess.run for invoking the CLI in tests. shell=True is used with a test-supplied command string, not untrusted input from outside the test suite. Flagged as critical by pattern alone, but the context is a test runner utility.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/nocover/test_pretty_repr.py:102:16

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    r = repr(strategy)
    via_eval = eval(r, strategy_globals)
    r2 = repr(via_eval)
    assert r == r2
```
likely benign LLM, confidence 0.90 Test evals a strategy repr to verify round-trip stability.
Reasoning
Test evals the repr of a Hypothesis strategy to check repr round-tripping. The input is strategy repr output generated within the test, so it is not attacker-controlled.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/nocover/test_pretty_repr.py:116:17

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def test_sampled_transform_reprs(r):
    assert repr(eval(r, strategy_globals)) == r
```
likely benign LLM, confidence 0.90 Test evals sampled strategy reprs for round-trip checks.
Reasoning
Parametrized test evaluating sampled strategy reprs to check they round-trip. Test-only use of eval on controlled strings.
info ~~warn~~ → info by review dynamic-execution hypothesis/tests/numpy/test_floor_ceil.py:35:18

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def test_our_floor_and_ceil_avoid_numpy_rounding(value):
    a = np.array(eval(value))
    f = floor(a)
    c = ceil(a)
```
likely benign LLM, confidence 0.70 A pytest test function uses eval on a parameter to build a numpy array for testing floor and ceil behavior.
Reasoning
eval is called on a function parameter named value, so the input is non-literal and unvalidated. In a test file, this is most likely a parametrized test where value is a string literal like '[1.5, -2.5]' from a test decorator, used to build numpy arrays. Still, eval on arbitrary input is a risky pattern and the snippet does not show the callers, so the benign reading is the most likely but not certain.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/HypothesisWorks/hypothesis hypothesis && cd hypothesis
git checkout v6.170.1
disclude scan --severity info --diff v6.170.0 hypothesis