mypy 2.4.0

Source: https://github.com/python/mypy
Artifact scanned: mypy-2.4.0-py3-none-any.whl (wheel · 2.7 MB · SHA-256 d01c5d26a352…)
Compared with: mypy-2.3.1-py3-none-any.whl (0 signals introduced since)
Files: 1224 scanned, 15 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 10.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 07:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution mypy/dmypy/client.py:556:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
        # ( see https://github.com/python/cpython/issues/74261 )
        os.system("")
    if "error" in response:
        fail(response["error"])
```
dismissed LLM, confidence 0.95 An empty os.system call used to flush or enable console handling on Windows.
Reasoning
os.system is called with an empty literal string. This is a known workaround that makes the Windows console process ANSI escape codes. It runs no command and has no malicious content.
info ~~critical~~ → info by review dynamic-import mypy/stubtest.py:226:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            # mentioned in __all__
            __import__(module_name, fromlist=["*"])
    return runtime
```
likely benign LLM, confidence 0.90 Dynamic module import in stubtest to fetch a runtime module for stub comparison.
Reasoning
__import__ loads a module by name so stubtest can inspect the runtime module object for comparison against stubs. The fromlist argument is a standard idiom for importing submodules. The module name comes from the package being checked, not from attacker-controlled input, so this is a normal dynamic import.
info ~~critical~~ → info by review dynamic-execution mypy/test/testdaemon.py:89:18

`subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    try:
        output = subprocess.check_output(
            input, shell=True, stderr=subprocess.STDOUT, text=True, cwd=test_temp_dir, env=env
        )
```
likely benign LLM, confidence 0.80 Test helper that executes repository-defined shell commands for the mypy daemon tests.
Reasoning
This is a test harness that runs shell commands taken from test case definitions in the repository, with shell=True. The command source is repo-controlled test data rather than untrusted input, and the code is consistent with a test runner. Shell=True with a non-literal string is still a risky pattern worth noting, so confidence is moderate.
info ~~warn~~ → info by review macro-keyword-override mypyc/lib-rt/vecs/vec_bool.c:10:1

`#define ITEM_C_TYPE char` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define ITEM_TYPE_MAGIC VEC_ITEM_TYPE_BOOL
#define ITEM_C_TYPE char
#define FEATURES Vec_BoolAPI
```
likely benign LLM, confidence 0.85 Preprocessor macro defining the element C type for a boolean vector implementation.
Reasoning
The macro ITEM_C_TYPE expands to char, which is a legitimate C type. The macro name is not a keyword and this is a standard template-style parameterization pattern for generating vector implementations per item type. Nothing is hidden or obfuscated.
info ~~warn~~ → info by review macro-keyword-override mypyc/lib-rt/vecs/vec_float.c:10:1

`#define ITEM_C_TYPE double` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define ITEM_TYPE_MAGIC VEC_ITEM_TYPE_FLOAT
#define ITEM_C_TYPE double
#define FEATURES Vec_FloatAPI
```
likely benign LLM, confidence 0.85 Preprocessor macro defining the element C type for a float vector implementation.
Reasoning
The macro ITEM_C_TYPE expands to double. This matches the same generic-vector template pattern used in the other vec_* files, with no obfuscation or malicious content.
info ~~warn~~ → info by review dynamic-execution mypyc/test/test_run.py:134:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            with open(script_name, "rb") as f:
                exec(f.read(), g)
        finally:
            sys.argv = save_argv
```
likely benign LLM, confidence 0.85 Test runner executes compiled test script contents via exec.
Reasoning
The exec call runs the contents of a test script file in a controlled globals dict, as part of mypyc's run-test harness. The script comes from the repository's test data. This is an expected pattern for a test runner rather than a dropper.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o mypy-2.4.0-py3-none-any.whl https://files.pythonhosted.org/packages/81/12/46ae8670c98a3cd0286ca5645c2f918f8f6be65edfed81b916010619f668/mypy-2.4.0-py3-none-any.whl
printf '%s  %s\n' d01c5d26a352acc6d5cf3128225477e1e8465e8d3029d4c345807fbf7f3cf093 mypy-2.4.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q mypy-2.4.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg