disclude.ioPyPI / hypothesis / 6.170.6
hypothesis 6.170.6
- Source
- https://github.com/HypothesisWorks/hypothesis
- Artifact scanned
hypothesis-6.170.6.tar.gz- Compared with
hypothesis-6.170.5.tar.gz(1 signals introduced since)- Files
- 114 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 34 info
- Scan time
- 13.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 14:12
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
info
warn→ info by reviewdynamic-executionsrc/hypothesis/extra/ghostwriter.py:1841:13new in this release# executed; so you still shouldn't ghostwrite for hostile code. =dismissed Checks whether an identity repr is valid Python, falling back to repr on failure.Reasoning
The code compiles identity_repr only to detect SyntaxError and falls back to repr. The comment notes that the module is not run, so this is a syntax probe.
-
) = =likely benign Reads the caller's stack frame to record where reject() was called.Reasoning
The frame is used only to locate the caller of reject() for error reporting and observability. This is ordinary test-framework behaviour with no network, exec or payload involved.
-
= =likely benign Reads the caller's stack frame to record where assume() was called.Reasoning
Same pattern as the reject() call: the frame feeds a location string for assume() reporting, with no suspicious effect.
-
=likely benign Base64-decodes and zlib-decompresses a reproduction blob supplied to reproduce_failure.Reasoning
This is the decoder for Hypothesis's reproduce_failure blob: a base64 string with a version byte followed by zlib data. The decompressed bytes are parsed as recorded choices, not executed, so it is a legitimate serialization format.
-
dismissed Checks that a parameter default's repr is valid Python syntax.
Reasoning
compile() is used only as a syntax-validity check on a repr string inside a suppress(SyntaxError) block. The result is never run.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrordismissed Validates generated strategy source as a Python expression.Reasoning
compile(r, ..., 'eval') validates generated source text as an expression before further processing. It is a syntax check, not execution of untrusted input.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionsrc/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks the call stack to compute a frame-depth size value.Reasoning
sys._getframe(2) walks the call stack to measure its depth for a size estimate. This is a common internal technique with no harmful effect.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads the caller frame to label a coverage entry with file and line.Reasoning
The frame is used to label coverage-collection entries with the caller's file and line. This is internal bookkeeping for the library's own coverage reporting.
-
=likely benign Evaluates reconstructed lambda source to rebuild a callable.Reasoning
The eval reconstructs a lambda from source the library extracted from the user's own code, to recover a callable for display and reproduction. The input is the project's own source, not attacker-controlled data.
-
) =likely benign Executes a generated wrapper to reconstruct a lambda with closure variables.Reasoning
The exec builds a wrapper function that rebuilds a lambda with its closure variables, from source derived from the user's code. It is a known technique for lambda reconstruction, and no network or process activity is involved.
-
assert = returnlikely benign Executes reconstructed function source into a fresh namespace and caches the result.Reasoning
Source text, which comes from the project's own functions, is exec'd into a fresh namespace and cached by source string. This is reflection machinery for rebuilding callables, with no evident malicious behaviour.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function on Python versions before 3.12 for coverage analysis.Reasoning
sys.settrace installs the library's own tracer for branch and coverage analysis on pre-3.12 Python, guarded by a version check. This is a legitimate profiling mechanism.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function installed for coverage analysis.Reasoning
This is the matching teardown of the tracer installed earlier, clearing it with settrace(None). It is paired cleanup for legitimate tracing.
-
info
warn→ info by reviewframe-introspectionsrc/hypothesis/strategies/_internal/strategies.py:103:31return : | None = =likely benign Walks the stack past library frames to find the user's call site.Reasoning
The loop walks up the stack past Hypothesis's own files to find the user's calling location, for error messages. It is benign introspection.
-
: | None = None : | None = = flikely benign Hypothesis walks the call stack via sys._getframe to record the source location where a type strategy was created.Reasoning
sys._getframe is used to walk the call stack and locate the user-code frame that defined a strategy, for reporting purposes. This is a standard debugging/introspection technique in a property-testing library (Hypothesis), with no network, decoding, or execution of dynamic code. The snippet reads frame metadata only, so the finding is a legitimate pattern.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&