hypothesis 6.170.5

Source: https://github.com/HypothesisWorks/hypothesis
Tag scanned: v6.170.5
Directory: hypothesis (only this part of the repository was scanned)
Compared with: v6.170.4 (0 signals introduced since)
Files: 537 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 14 warn · 92 info
Scan time: 26.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 32 of 47 warn and critical signals; 32 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 00:58

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12

`subprocess.run` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run(cmd, *, cwd=None):
    return subprocess.run(
        cmd, capture_output=True, shell=True, text=True, cwd=cwd, encoding="utf-8"
    )
```

warn dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:302:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)

    assert actual == expected  # We got the expected source code
    exec(expected, {})  # and there are no SyntaxError or NameErrors

warn dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:317:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        assert actual == expected
    exec(expected, {"not_set": not_set})
```

warn dynamic-execution hypothesis/tests/ghostwriter/test_expected_output.py:339:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)

    assert actual == expected  # We got the expected source code
    exec(expected, {})  # and there are no SyntaxError or NameErrors

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:56:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)

    try:
        exec(source_code, namespace)
    except Exception:
        print(f"************\n{source_code}\n************")

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:206:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.magic(socket)
    exec(source_code, {})
```
warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:213:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.binary_operation(takes_frozensets)
    exec(source_code, {})
```
warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:234:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Most importantly: the code should execute without NameError
    exec(source_code, {})
```

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:436:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)

    source_code = ghostwriter.binary_operation(compose_types)
    exec(source_code, {})
    # and also works with explicit identity element
    source_code = ghostwriter.binary_operation(compose_types, identity=type)

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:439:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.binary_operation(compose_types, identity=type)
    exec(source_code, {})
```
warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:846:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert "one_of(" in source_code
    exec(source_code, {})
```

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:854:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)

    source_code = ghostwriter.ufunc(numpy.isnan)
    exec(source_code, {})
    # Also cover passing an explicit `annotate`, rather than the default None.
    source_code = ghostwriter.ufunc(numpy.isnan, annotate=True)

warn dynamic-execution hypothesis/tests/ghostwriter/test_ghostwriter.py:857:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    source_code = ghostwriter.ufunc(numpy.isnan, annotate=True)
    exec(source_code, {})
```
warn dynamic-execution hypothesis/tests/nocover/test_pretty_repr.py:102:16

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    r = repr(strategy)
    via_eval = eval(r, strategy_globals)
    r2 = repr(via_eval)
    assert r == r2
```
warn dynamic-execution hypothesis/tests/nocover/test_pretty_repr.py:116:17

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
def test_sampled_transform_reprs(r):
    assert repr(eval(r, strategy_globals)) == r
```
info ~~critical~~ → info by review dynamic-execution hypothesis/docs/conf.py:185:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
_version_file = root.joinpath("src", "hypothesis", "version.py")
exec(_version_file.read_text(encoding="utf-8"), _d)
version = _d["__version__"]
release = _d["__version__"]
```
likely benign LLM, confidence 0.85 Docs config execs the project's own version.py to read __version__.
Reasoning
The exec reads the version.py file from the project's own source tree and runs it into a dict to extract __version__. This is a common Sphinx docs pattern; the path is a fixed local file, not attacker-controlled data or a network payload. Flagged as critical by severity heuristics, but the context is benign.

info long-line hypothesis/docs/usage.rst:8:1

line length 1436 characters (raw pass, confidence 0.50)

The following notable open-source projects use Hypothesis to test their code: `pytorch <https://github.com/pytorch/pytorch>`_, `jax <https://github.com/jax-ml/jax>`_, `PyPy <https://github.com/pypy/pypy>`_, `numpy <https://github.com/numpy/numpy>`_, `pandas <https://github.com/pandas-dev/pandas>`_, `attrs <https://gith

info dynamic-execution hypothesis/scripts/basic-test.sh:26:1