mpmath 1.5.0a2

Source: https://github.com/mpmath/mpmath
Artifact scanned: mpmath-1.5.0a2-py3-none-any.whl (wheel · 617.4 KB · SHA-256 fe01e8a594a9…)
Compared with: mpmath-1.5.0a1-py3-none-any.whl (0 signals introduced since)
Files: 98 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 9.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-30 09:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution mpmath/identification.py:786:27

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            namespace = dict((name, getattr(ctx,name)) for name in dir(ctx))
            constants = [(eval(p, namespace), p) for p in constants]
    else:
        constants = []
```
likely benign LLM, confidence 0.80 eval of constant-name expressions inside mpmath's identification routine.
Reasoning
The eval runs over constant expression strings (such as 'pi' or 'log(2)') evaluated in a namespace built from the mpmath context. That is the expected behaviour of a constant-identification routine in a math library. The input is internal, not attacker-controlled, and the snippet shows nothing like network or process activity.
info ~~warn~~ → info by review dynamic-execution mpmath/libmp/libhyper.py:288:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    exec(source, globals(), namespace)

    #print source
```
likely benign LLM, confidence 0.75 exec of generated Python source in mpmath's hypergeometric helper.
Reasoning
exec runs generated source for hypergeometric helper code in a controlled namespace. Code generation via exec is a common, legitimate technique in numerical libraries. The snippet does not show where the source string comes from, which keeps confidence below the highest level, but nothing indicates untrusted input.
info identifier-low-length mpmath/matrices/eigen_symmetric.py:1:1

1020 of 2446 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_basic_ops.py:772:12

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert repr(x) != "mpf('0.11458149882303958')"
    assert eval(repr(x)) == x
```
likely benign LLM, confidence 0.95 Test checking that repr of an mpf evaluates back to the same value.
Reasoning
The test round-trips an mpf through repr and eval to check that its representation is reversible. This is a standard test pattern on a value the test itself creates.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_basic_ops.py:781:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                x = rand()
                assert eval(repr(x)) == x, (prec, x)
                n = random.randint(-100, 300)
                if n > 0:
```
likely benign LLM, confidence 0.95 Randomized test that evals repr of generated mpf values.
Reasoning
This is a randomized round-trip test that evals repr(x) for values the test generates. It is ordinary test code.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_basic_ops.py:787:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                    x /= 10**n
                assert eval(repr(x)) == x, (prec, x)
```
likely benign LLM, confidence 0.95 Randomized repr round-trip assertion in the test suite.
Reasoning
Same randomized repr/eval round-trip as the neighbouring test, on test-generated values.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_convert.py:135:20

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            a = mpf(random.random())**0.5 * 10**random.randint(-100, 100)
            assert eval(repr(a)) == a

def test_str_bugs():
```
likely benign LLM, confidence 0.95 Test asserting repr/eval round-trip of random mpf values.
Reasoning
The test evals repr of a randomly generated mpf to confirm conversion round-trips. It is a benign test assertion.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_extra_gamma.py:146:9

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    mp.dps = 1010
    z = eval(z)
    mp.dps = 1050
    if result is None:
```
likely benign LLM, confidence 0.90 Test evaluating a z expression string from a static gamma test table.
Reasoning
The test evals a z string taken from a hard-coded table of test cases for gamma-function checks. The inputs are static test data, not external input.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_extra_gamma.py:154:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    else:
        loggamma_val = eval(result)
        gamma_val = exp(loggamma_val)
        factorial_val = z * gamma_val
```
likely benign LLM, confidence 0.90 Test evaluating expected loggamma strings from static test data.
Reasoning
This evals a loggamma result string from the same static test table to compare values at high precision. It is benign test code.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_linalg.py:222:64

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
              'qr_solve(%s, %s)' % (A, b), 'qr_solve(%s, %s)' % (B, b)]:
        pytest.raises((ZeroDivisionError, ValueError), lambda: eval(i))

def test_cholesky():
```
likely benign LLM, confidence 0.92 Test evaluating constructed linear-algebra call strings to check exceptions.
Reasoning
The test evals strings of the form 'qr_solve(A, b)' that it builds itself to check that singular inputs raise the expected exceptions. This is benign test code.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_matrices.py:30:18

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert A6.tolist() == l
    assert A6 == eval(repr(A6))
    A6 = fp.matrix(A6)
    assert A6 == eval(repr(A6))
```
likely benign LLM, confidence 0.95 Test asserting that a matrix repr evaluates back to an equal matrix.
Reasoning
The matrix test evals repr of a matrix it built to check round-tripping. It is a standard test assertion.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_matrices.py:32:18

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    A6 = fp.matrix(A6)
    assert A6 == eval(repr(A6))
    assert A6*1j == eval(repr(A6*1j))
    assert A3 * 10 == 10 * A3 == A6
```
likely benign LLM, confidence 0.95 Test asserting matrix repr round-trip, including a complex-scaled matrix.
Reasoning
Same matrix repr/eval round-trip assertion, applied to a complex-scaled matrix built in the test.
info ~~warn~~ → info by review dynamic-execution mpmath/tests/test_matrices.py:33:21

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    assert A6 == eval(repr(A6))
    assert A6*1j == eval(repr(A6*1j))
    assert A3 * 10 == 10 * A3 == A6
    assert A2.rows == 3
```
likely benign LLM, confidence 0.95 Matrix repr round-trip assertion in the test suite.
Reasoning
Another repr round-trip assertion in the matrix test suite, on test-built values.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o mpmath-1.5.0a2-py3-none-any.whl https://files.pythonhosted.org/packages/9f/1d/74a5ae2ff010d48db42f753366e0bec558446e5ab522810049726136a580/mpmath-1.5.0a2-py3-none-any.whl
printf '%s  %s\n' fe01e8a594a900d2b553659d9587925e6f44c838ab2e22f9de78ef7357ae3ec3 mpmath-1.5.0a2-py3-none-any.whl | shasum -a 256 -c -
unzip -q mpmath-1.5.0a2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg