mypy 2.4.0

Source: https://github.com/python/mypy
Tag scanned: v2.4.0
Compared with: v2.3.1 (0 signals introduced since)
Files: 1545 scanned, 334 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 15 info
Scan time: 10.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review unicode-zero-width CHANGELOG.md:4195:1

U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
```
⟨U+200B⟩Thanks to all mypy contributors who contributed to this release:

- Aleksi Tarvainen
```
likely benign LLM, confidence 0.90 Zero-width space in a markdown changelog contributor list.
Reasoning
A zero-width space before a changelog line in a mypy release note is a stray typographic artifact from copy-paste; no code execution or hidden payload is present.
info ~~warn~~ → info by review unicode-zero-width CHANGELOG.md:4286:1

U+200B ZERO WIDTH SPACE in source (raw pass, confidence 0.75)
```
⟨U+200B⟩Thanks to all mypy contributors who contributed to this release:

- Alex Waygood
```
likely benign LLM, confidence 0.95 A zero-width space appears in a changelog contributor line.
Reasoning
A zero-width space in a markdown changelog line is a stray typographic artifact from copy-paste; no execution or hidden payload is possible in prose. Raw-pass unicode signal with no malicious context.
info identifier-low-length docs/source/kinds_of_types.rst:19:1

[embedded python] 13 of 32 non-conventional identifiers are single-character (41%) (token pass, confidence 0.50)

info dynamic-execution misc/build-debug-python.sh:32:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)

make install
$PREFIX/bin/python3 -m pip install virtualenv
$PREFIX/bin/python3 -m virtualenv $VENV
ln -s python3-config $PREFIX/bin/python-config

info dynamic-execution misc/build-debug-python.sh:33:1

command name is a variable (`$PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$PREFIX/bin/python3 -m pip install virtualenv
$PREFIX/bin/python3 -m virtualenv $VENV
ln -s python3-config $PREFIX/bin/python-config
```
info ~~warn~~ → info by review dynamic-execution misc/docker/run-wrapper.sh:13:1

command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
# Run the wrapped command
"$@"
```
likely benign LLM, confidence 0.85 Docker run wrapper that executes its arguments as the wrapped command.
Reasoning
A wrapper script that execs "$@" is the standard pattern for passing a command through a container entrypoint. The caller determines the command by design, not via hidden obfuscation.
info ~~critical~~ → info by review dynamic-execution misc/incremental_checker.py:69:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def execute(command: list[str], fail_on_error: bool = True) -> tuple[str, str, int]:
    proc = subprocess.Popen(
        " ".join(command), stderr=subprocess.PIPE, stdout=subprocess.PIPE, shell=True
    )
```
likely benign LLM, confidence 0.85 Dev helper running a joined command list through a shell.
Reasoning
This is a developer test-harness helper in mypy's misc directory that joins a command list and runs it with shell=True. The command is built from internal call sites, not untrusted input, so this is a common dev-tool pattern rather than an attack, though shell=True with a joined list is a minor risk.
info ~~critical~~ → info by review dynamic-execution misc/perf_checker.py:32:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def execute(command: list[str]) -> None:
    proc = subprocess.Popen(
        " ".join(command), stderr=subprocess.PIPE, stdout=subprocess.PIPE, shell=True
    )
```
likely benign LLM, confidence 0.85 Perf-checking helper running a joined command through a shell.
Reasoning
Same pattern as the incremental checker: a developer benchmarking script that runs internally supplied commands with shell=True. No obfuscation or malicious indicators.
info ~~warn~~ → info by review dynamic-execution mypy/dmypy/client.py:556:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
        # ( see https://github.com/python/cpython/issues/74261 )
        os.system("")
    if "error" in response:
        fail(response["error"])
```
likely benign LLM, confidence 0.90 Empty os.system call used to enable Windows console ANSI handling.
Reasoning
os.system("") with an empty literal is a known idiom to enable ANSI escape processing on Windows consoles, as the comment referencing the CPython issue indicates. Entirely benign.
info ~~critical~~ → info by review dynamic-import mypy/stubtest.py:226:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            # mentioned in __all__
            __import__(module_name, fromlist=["*"])
    return runtime
```
likely benign LLM, confidence 0.85 Dynamic module import used by stubtest to load runtime modules.
Reasoning
stubtest imports modules by name to inspect runtime objects; __import__ on a computed module name is the expected mechanism for a stub-testing tool. Legitimate in context.
info ~~critical~~ → info by review dynamic-execution mypy/test/testdaemon.py:89:18

`subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    try:
        output = subprocess.check_output(
            input, shell=True, stderr=subprocess.STDOUT, text=True, cwd=test_temp_dir, env=env
        )
```
likely benign LLM, confidence 0.80 Test helper invoking a shell command in a temp directory.
Reasoning
A test helper runs a test command string through shell=True in a temporary test directory with a controlled env. This is ordinary test-suite plumbing, not hidden malicious behavior.
info ~~critical~~ → info by review dynamic-execution mypyc/external/googletest/src/gtest-death-test.cc:981:3

`execve` called with a non-literal path (ast pass, confidence 0.90)
```
  // one path separator.
  execve(args->argv[0], args->argv, GetEnviron());
  DeathTestAbort(std::string("execve(") + args->argv[0] + ", ...) in " +
                 original_dir + " failed: " +
```
likely benign LLM, confidence 0.90 Vendored googletest death-test child process calling execve.
Reasoning
This is the vendored googletest death-test code forking and calling execve on the test binary's argv. It is the standard implementation in a well-known third-party library.
info ~~warn~~ → info by review macro-keyword-override mypyc/lib-rt/vecs/vec_bool.c:10:1

`#define ITEM_C_TYPE char` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define ITEM_TYPE_MAGIC VEC_ITEM_TYPE_BOOL
#define ITEM_C_TYPE char
#define FEATURES Vec_BoolAPI
```
likely benign LLM, confidence 0.80 Macro defining the C item type for the bool vector template.
Reasoning
This is a macro-based C template where ITEM_C_TYPE is intentionally defined per item type (char for bool). Macro aliasing of a type is a normal generics technique in mypyc's runtime, not an attack.
info ~~warn~~ → info by review macro-keyword-override mypyc/lib-rt/vecs/vec_float.c:10:1

`#define ITEM_C_TYPE double` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define ITEM_TYPE_MAGIC VEC_ITEM_TYPE_FLOAT
#define ITEM_C_TYPE double
#define FEATURES Vec_FloatAPI
```
likely benign LLM, confidence 0.80 Macro defining the C item type for the float vector template.
Reasoning
Same generic-template macro pattern as vec_bool.c, here defining double as the item type. Ordinary C code generation technique.
info ~~warn~~ → info by review dynamic-execution mypyc/test/test_run.py:134:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            with open(script_name, "rb") as f:
                exec(f.read(), g)
        finally:
            sys.argv = save_argv
```
likely benign LLM, confidence 0.85 Test runner exec-ing a test script file with adjusted argv.
Reasoning
A test runner executes a script file's bytes via exec with a globals dict while adjusting sys.argv, mirroring how a script would run. In a test harness this is expected; the script is a repo-local test file.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/python/mypy mypy && cd mypy
git checkout v2.4.0
disclude scan --severity info --diff v2.3.1 .