disclude.ioPyPI / hypothesis / 6.170.9
hypothesis 6.170.9
- Source
- https://github.com/HypothesisWorks/hypothesis
- Artifact scanned
hypothesis-6.170.9.tar.gz- Compared with
hypothesis-6.170.8.tar.gz(0 signals introduced since)- Files
- 114 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 34 info
- Scan time
- 14.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-24 16:12
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
) = =likely benign Captures the calling frame so reject() can report where it was invoked.Reasoning
inspect.currentframe() is used to find the caller's location for an error message in reject(). It is a normal introspection pattern for reporting where a test helper was called, with no network, decoding or process spawning.
-
= =likely benign Captures the calling frame so assume() can record where the assumption was made.Reasoning
The same frame capture is used in assume() to build a location for diagnostics, and only when observability is enabled or the assumption fails. This is a legitimate testing-library pattern.
-
=likely benign Decompresses a base64-encoded reproduction blob that Hypothesis uses to replay failing examples.Reasoning
This is Hypothesis decoding a version-prefixed, zlib-compressed reproduction blob (for example a @reproduce_failure value) and raising InvalidArgument on error. The payload is user-supplied test data, not hidden code, so the decompression is ordinary deserialization.
-
likely benign Syntax-checks the repr of a parameter default before using it in generated test code.
Reasoning
compile() is applied to repr() of a strategy whose output is only checked for syntax validity inside a contextlib.suppress(SyntaxError). It does not run the result, so it is a syntax check on generated text.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Compiles a generated expression string only to validate its syntax.Reasoning
compile(r, ..., 'eval') validates an expression string built by the ghostwriter's code generator and is used to detect problems before writing output. It is a syntax check with no execution.
-
# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Checks that an identity repr is valid Python source, falling back to plain repr on failure.Reasoning
compile(identity_repr, ..., 'exec') checks whether a repr is valid Python and falls back to repr() on SyntaxError. The code is compiled, not run, and the surrounding comment is about not ghostwriting for hostile code.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionsrc/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks the call stack from a fixed depth to compute a size value.Reasoning
sys._getframe(2) is used to walk the stack for a size calculation in a utility helper. Stack inspection of this kind is common in Python libraries and has no malicious effect.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads the caller's file and line number to describe a coverage location.Reasoning
sys._getframe(depth + 2) reads the caller's filename and line number to label coverage-related descriptions. It is read-only introspection used for reporting.
-
=likely benign Evaluates reconstructed lambda source text to rebuild a lambda object.Reasoning
eval(source, f_globals) evaluates reconstructed lambda source that was taken from the library's own parsed source code to recreate a lambda object. It is a known Hypothesis technique for lambda reconstruction and is not fed from external or encoded input.
-
) =likely benign Executes a generated helper to reconstruct a lambda that has closure variables.Reasoning
exec(exec_str, f_globals) runs a generated helper that constructs a lambda with its free variables bound. The string is built internally from the function's own source, so this is a dynamic reconstruction tool rather than a payload.
-
assert = returnlikely benign Executes source text into a namespace to produce a callable, caching the result.Reasoning
exec(source, result.__dict__) turns a Python source string, cached by the source itself, into a module namespace. This matches the library's reflection utilities for rebuilding functions from source, and the input is not obfuscated or fetched from the network.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function for coverage tracking on older Python versions.Reasoning
sys.settrace(self.trace) is installed under a guard for Python versions lacking sys.monitoring, as part of the library's coverage and branch-tracking feature. It is a standard profiling hook that is removed again on exit.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function set up by the scrutineer's context manager.Reasoning
sys.settrace(None) is the matching teardown that removes the trace function installed on entry. Cleaning up a profiler hook is ordinary behavior.
-
info
warn→ info by reviewframe-introspectionsrc/hypothesis/strategies/_internal/strategies.py:103:31return : | None = =likely benign Walks up the stack past library frames to locate the user's calling code.Reasoning
sys._getframe(1) walks past Hypothesis's own frames to find the user's calling location for error reporting. This is read-only introspection in a testing library.
-
: | None = None : | None = = flikely benign Hypothesis's type-registration code uses sys._getframe to walk the stack and record the caller's file and line for diagnostics.Reasoning
The code walks the call stack to find the first frame outside Hypothesis's own package, recording file and line so it can report where a type's strategy was registered. This is a standard, well-understood debugging/diagnostic technique in a property-testing library. The snippet shows no network, process, decoding or dynamic execution, and the frame data is only formatted into a location string.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&