disclude.ioPyPI / hypothesis / 6.170.5
hypothesis 6.170.5
- Source
- https://github.com/HypothesisWorks/hypothesis
- Artifact scanned
hypothesis-6.170.5.tar.gz- Compared with
hypothesis-6.170.4.tar.gz(0 signals introduced since)- Files
- 114 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 34 info
- Scan time
- 13.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 11:36
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
) = =likely benign Uses inspect.currentframe to find the call site of reject() for reporting.Reasoning
Frame introspection to locate the caller of reject() for error reporting and observability. This is standard for a testing library and has no network, decoding, or process-spawning behavior.
-
= =likely benign Uses inspect.currentframe to record the call site of assume() for reporting.Reasoning
Same caller-location lookup as in reject(), this time for assume(). It feeds observability and error messages only.
-
=likely benign Base64-decodes and zlib-decompresses an internal encoded key, raising InvalidArgument on error.Reasoning
Decompresses a zlib payload that follows a version byte after base64 decoding, in the context of decoding Hypothesis database or reproduction keys. It is wrapped in a try/except that raises InvalidArgument on corrupt input, which is typical encoding code rather than a hidden dropper.
-
likely benign Syntax-validates a repr of a parameter default before using it in generated code.
Reasoning
compile(repr(...)) is only used to check whether a generated default value is valid syntax before inserting it. The expression is produced by repr of a strategy, not attacker-controlled input.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Checks generated strategy source for syntax validity via compile in eval mode.Reasoning
Compiles generated strategy source in eval mode purely to validate syntax before emitting it. It is a validation step that does not run the code.
-
# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Tests whether a repr of an identity value is valid Python, falling back to the repr on SyntaxError.Reasoning
compile(repr(identity)) only tests whether a repr is valid Python, and the except branch falls back to repr. The adjacent comment shows the author is aware of the risks of executing hostile code and does not execute it here.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionsrc/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Uses sys._getframe to walk the call stack when computing an internal size.Reasoning
Walks frames with sys._getframe(2) to compute a size or depth for internal bookkeeping. No data leaves the process and nothing is executed.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads caller frame file and line via sys._getframe to describe a coverage location.Reasoning
Reads the caller's filename and line number from a stack frame to label coverage or observation entries. This is local diagnostic code.
-
=likely benign Evaluates reconstructed lambda source in the function's globals to rebuild the callable.Reasoning
eval runs reconstructed lambda source inside the function's own globals so that Hypothesis can recover lambda objects for display and caching. The source comes from the user's own code objects, not an external feed, which is a known pattern for this library.
-
) =likely benign Executes generated helper source to reconstruct a lambda that has closure variables.Reasoning
exec builds a helper that reconstructs a closure when the lambda has free variables. Its input is generated from the code object of a function the user already has loaded, so it is not an external payload.
-
assert = returnlikely benign Executes function source into a result namespace to rebuild a callable, caching the result.Reasoning
Executes source text into a fresh module dict to rebuild a function from its source for caching, as part of Hypothesis's reflection utilities. The source comes from the user's own code, and the code is not hidden or obfuscated.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function on Python versions lacking sys.monitoring for test scrutiny.Reasoning
sys.settrace is installed only on Python versions without sys.monitoring, and it is used for coverage-style tracing during tests. The pragma comment confirms that this is intended.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Clears the trace function on exit for the same version-gated tracing context.Reasoning
Removes the trace function that was installed by the matching settrace call, with the same version guard. This is cleanup for a tracing context manager.
-
info
warn→ info by reviewframe-introspectionsrc/hypothesis/strategies/_internal/strategies.py:102:31return : | None = =likely benign Walks frames upward past Hypothesis files to find the user's call location.Reasoning
Walks up past Hypothesis's own frames to find the user's calling location for error messages. This is ordinary frame introspection for diagnostics.
-
: | None = None : | None = = flikely benign Hypothesis walks the call stack via sys._getframe to record source locations of frames, a diagnostic use.Reasoning
The snippet shows sys._getframe used to walk the call stack and record filename and line numbers, which is a known pattern in Hypothesis for locating where a strategy type was registered or defined so it can report or warn about the location. It is plain diagnostic introspection in a well-known testing library, with no decoding, execution, network, or process spawning, and it is not obfuscated.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&