disclude.ioPyPI / hypothesis / 6.170.8
hypothesis 6.170.8
- Source
- https://github.com/HypothesisWorks/hypothesis
- Artifact scanned
hypothesis-6.170.8.tar.gz- Compared with
hypothesis-6.170.5.tar.gz(1 signals introduced since)- Files
- 114 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 34 info
- Scan time
- 12.5 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 14:13
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
info
warn→ info by reviewdynamic-executionsrc/hypothesis/extra/ghostwriter.py:1841:13new in this release# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Syntax-checks a repr string used when ghostwriting code, falling back to repr on SyntaxError.Reasoning
compile(identity_repr, ..., 'exec') is a syntax check on a repr string, with SyntaxError falling back to plain repr. The comment shows the authors are aware of the hostile-code caveat, and the call does not execute the code.
-
) = =likely benign Retrieves the current stack frame to record where reject() was called.Reasoning
Hypothesis uses inspect.currentframe to locate the caller of reject() for reporting. This is standard test-library introspection with no network, decoding, or process spawning.
-
= =likely benign Retrieves the current stack frame to record where assume() was called.Reasoning
Same pattern as the reject() call: the frame is used only to report the calling location of assume() when observability is enabled.
-
=likely benign Decompresses a base64-encoded reproduction blob for replaying a failing example.Reasoning
This is the decoder for Hypothesis's reproduce_failure blob: base64 decoding then zlib decompression of a user-supplied reproduction string, with zlib.error handled and re-raised as InvalidArgument. It is a documented feature, not a hidden payload.
-
likely benign Syntax-checks the repr of a parameter default to decide whether it can be used in generated code.
Reasoning
The compile() call is a syntax check on the repr of a strategy default, inside contextlib.suppress(SyntaxError). It compiles text and never executes it.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Validates generated strategy source text by compiling it in eval mode.Reasoning
compile(r, ..., 'eval') only validates the generated strategy expression text. The surrounding code is ghostwriter output validation, and nothing is executed.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionsrc/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks stack frames to estimate a size value for internal conjecture bookkeeping.Reasoning
sys._getframe(2) is used to walk the stack for size estimation in a testing utility. There is no suspicious behaviour.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads the caller's frame to label a coverage target with file and line.Reasoning
The caller frame is used to build a human-readable description of a coverage-tracked location. This is ordinary coverage-library introspection.
-
=likely benign Evaluates reconstructed lambda source in the function's global namespace.Reasoning
eval is used to rebuild a lambda from source text recovered from the user's own module, with that module's globals. This is reflection for error reporting and reproduction, not an attacker's payload.
-
) =likely benign Executes a generated helper that reconstructs a lambda with its free variables.Reasoning
exec builds a helper that reconstructs a lambda with its closure variables, from source derived from the user's own code. It is a known technique for recreating lambdas and does not reach the network or spawn processes.
-
assert = returnlikely benign Executes reconstructed function source into a fresh namespace and caches the result.Reasoning
exec runs source text that is the reconstructed lambda or function body, cached in eval_cache. This is the same reflection mechanism, operating on code the user's project already contains.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function for code-scrutiny analysis on older Python versions.Reasoning
sys.settrace installs a tracer for coverage/scrutiny analysis, and only on Python versions below 3.12 as the pragma comment states. It is a standard profiling hook.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function installed by the scrutineer on exit.Reasoning
Paired with the settrace install, this clears the trace function on exit in the same guarded branch. It is routine cleanup.
-
info
warn→ info by reviewframe-introspectionsrc/hypothesis/strategies/_internal/strategies.py:103:31return : | None = =likely benign Walks up the stack past Hypothesis frames to find the user's calling location.Reasoning
The frame walk skips Hypothesis's own files to find the user's calling location for error messages. This is a benign use of frame introspection.
-
: | None = None : | None = = flikely benign Hypothesis strategy code walks the call stack via sys._getframe to record source locations.Reasoning
sys._getframe() is used in Hypothesis's strategies module to walk the call stack and locate the user's source location for reporting, a common and legitimate testing-library pattern. No network, exec, or process spawning is present in the snippet; frame introspection alone is benign here.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&