disclude.io

PyPI / rich / 15.0.0

rich 15.0.0

Source
https://github.com/Textualize/rich
Tag scanned
v15.0.0
Compared with
v14.3.4 (0 signals introduced since)
Files
319 scanned, 217 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 24 info
Scan time
18.1 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 19 of 19 warn and critical signals; 19 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 18:17

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review unicode-zero-width README.fa.md:30:129

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    
[ریچ](https://rich.readthedocs.io/en/latest/) افزودن رنگ و سبک به خروجی ترمینال را آسان می⟨U+200C⟩کند.
ریچ همچنین می⟨U+200C⟩تواند جدول های زیبا، نوار های پیشرفت
(progress bars),
    likely benign LLM, confidence 0.97 Persian README text containing zero-width non-joiners used for correct word shaping.
    Reasoning

    U+200C ZWNJ is a standard, required character in Persian orthography (for example in می⟨U+200C⟩کند and نوار های). The file is Persian prose in a markdown README, so this is normal text rendering, not hidden content.

  2. info warn → info by review unicode-zero-width README.fa.md:31:25

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    [ریچ](https://rich.readthedocs.io/en/latest/) افزودن رنگ و سبک به خروجی ترمینال را آسان می⟨U+200C⟩کند.
ریچ همچنین می⟨U+200C⟩تواند جدول های زیبا، نوار های پیشرفت
(progress bars),
مارک داون
    likely benign LLM, confidence 0.97 Persian documentation paragraph with ZWNJ characters in normal words.
    Reasoning

    Same ZWNJ usage in ordinary Persian prose (می⟨U+200C⟩کند, مارک داون context). It is required for correct Persian spelling and has no executable effect in markdown.

  3. info warn → info by review unicode-zero-width README.fa.md:133:49

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    داخلی پایتون نیست.
ریچ متن شما را به صورت کلمه⟨U+200C⟩ای
(واژه بندی شده)
در نظر میگیرد تا در عرض
    likely benign LLM, confidence 0.97 Persian README sentence about text wrapping, with standard ZWNJ spelling.
    Reasoning

    ZWNJ within Persian compounds such as کلمه⟨U+200C⟩ای is standard orthography. The surrounding text is a translated description of Rich's word-wrapping behavior.

  4. info warn → info by review unicode-zero-width README.fa.md:321:202

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    wnloader.py) را ببینید که می⟨U+200C⟩تواند چندین لینک URL را به طور همزمان بارگیری کند و پیشرفت را نشان دهد.
    likely benign LLM, confidence 0.97 Persian documentation sentence with normal ZWNJ usage.
    Reasoning

    ZWNJ in Persian words such as می⟨U+200C⟩کند is expected orthography. The snippet is documentation prose about a progress-bar example.

  5. info warn → info by review unicode-zero-width README.fa.md:328:323

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    �خنده (spinner) را نمایش می⟨U+200C⟩دهد. این انیمیشن شما را از استفاده عادی از کنسول باز نمی دارد. مثال آن به صورت زیر است:
    likely benign LLM, confidence 0.96 Persian README line describing a spinner example, with standard ZWNJ spelling.
    Reasoning

    ZWNJ in Persian words such as می⟨U+200C⟩دهد and نمی دارد is normal writing. The only oddity is a replacement or emoji glyph before 'خنده', which is a rendering artifact in a README.

  6. info warn → info by review unicode-mixed-script README.ja.md:36:2

    identifier `Richについての人々の感想を見る` mixes scripts: Latin + Hiragana + Han + Other (raw pass, confidence 0.80)

    
[Richについての人々の感想を見る。](https://www.willmcgugan.com/blog/pages/post/rich-tweets/)

## 互換性
    likely benign LLM, confidence 0.96 Japanese markdown link text containing the product name Rich alongside kana and kanji.
    Reasoning

    Japanese prose mixing Latin 'Rich' with Hiragana and Han is normal. The identifier is actually a link label in a markdown heading-adjacent sentence, not a code identifier, so mixed scripts are expected.

  7. info warn → info by review unicode-homoglyph README.ru.md:38:4

    identifier `Cовместимость` contains homoglyph candidates: о (043E)→o, е (0435)→e, с (0441)→c, о (043E)→o (raw pass, confidence 0.70)

    
## Cовместимость

Rich работает с Linux, OSX и Windows. True color / эмоджи работают с новым терминалом Windows, классический терминал лимитирован 16 цветами. Rich требует Python 3.6.3 или более новый.
    likely benign LLM, confidence 0.85 Russian README heading whose first letter is a Latin C instead of Cyrillic С.
    Reasoning

    The heading 'Cовместимость' has a Latin 'C' where Cyrillic 'С' is expected. This is a plausible typo in a Russian markdown heading, not executable code. A deliberate homoglyph here would have no effect, so it is most likely a documentation typo.

  8. info warn → info by review unicode-mixed-script README.ru.md:38:4

    identifier `Cовместимость` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
## Cовместимость

Rich работает с Linux, OSX и Windows. True color / эмоджи работают с новым терминалом Windows, классический терминал лимитирован 16 цветами. Rich требует Python 3.6.3 или более новый.
    likely benign LLM, confidence 0.85 Russian README heading mixing Latin and Cyrillic characters in one word.
    Reasoning

    Same heading as the homoglyph finding. Mixing Latin C with Cyrillic letters is consistent with a typing error in prose. It is in markdown text, so there is no execution path.

  9. info warn → info by review unicode-homoglyph README.ru.md:91:17

    identifier `Сonsole` contains homoglyph candidates: С (0421)→C (raw pass, confidence 0.70)

    
У класса Сonsole есть метод `print` который имеет идентичный встроенной функции функционал `print`. Вот пример использования:

```python
    likely benign LLM, confidence 0.85 Russian README sentence referring to the Console class with a mistyped first letter.
    Reasoning

    'Сonsole' in running Russian prose refers to Rich's Console class. The Cyrillic С in place of Latin C is most likely a typing mistake. The surrounding text is documentation and no code is executed.

  10. info warn → info by review unicode-mixed-script README.ru.md:91:17

    identifier `Сonsole` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)

    
У класса Сonsole есть метод `print` который имеет идентичный встроенной функции функционал `print`. Вот пример использования:

```python
    likely benign LLM, confidence 0.85 Russian README token mixing Cyrillic and Latin letters for the Console class name.
    Reasoning

    Same mixed-script 'Сonsole' token in prose. It is consistent with a typo and carries no executable or identifier-spoofing risk in a README.

  11. info warn → info by review unicode-homoglyph README.ru.md:142:17

    identifier `Сonsole` contains homoglyph candidates: С (0421)→C (raw pass, confidence 0.70)

    В классе Сonsole есть метод `log()` который имеет интерфейс, аналогичный `print()`, но также отображает колонку текущим временем, именем файла и номером строки кода в которой был вызван
    likely benign LLM, confidence 0.85 Russian README sentence about Console.log with the same mixed-script spelling.
    Reasoning

    Another occurrence of 'Сonsole' in Russian documentation prose describing the log() method. The Cyrillic С is a likely typo in a markdown file, not code obfuscation.

  12. info warn → info by review unicode-mixed-script README.ru.md:142:17

    identifier `Сonsole` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)

    В классе Сonsole есть метод `log()` который имеет интерфейс, аналогичный `print()`, но также отображает колонку текущим временем, именем файла и номером строки кода в которой был вызван
    likely benign LLM, confidence 0.75 A Russian README mentions a class name with a Cyrillic first letter.
    Reasoning

    The Cyrillic 'С' in 'Сonsole' is a homoglyph, but it sits in Russian prose in a README. It has no execution path and reads as a typing slip by a Russian-speaking author, not an attack on code.

  13. info unicode-mixed-script benchmarks/snippets.py:114:2

    identifier `Richについての人々の感想を見る` mixes scripts: Latin + Hiragana + Han + Other (in string/comment) (raw pass, confidence 0.40)

    
[Richについての人々の感想を見る。](https://www.willmcgugan.com/blog/pages/post/rich-tweets/)

## 互換性
  14. info long-line docs/source/layout.rst:41:1

    line length 585 characters (raw pass, confidence 0.50)

        <pre style="font-size:90%;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace"><span style="color: #000080">╭─────────────────────────────── </span><span style="color: #008000">'upper'</span><span style="color: #000080"> </span><span
  15. info warn → info by review frame-introspection rich/console.py:1932:21

    `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

    
            frame = inspect.currentframe()
        else:
            frame = currentframe()
    likely benign LLM, confidence 0.95 Console logging uses inspect.currentframe to find the caller's location.
    Reasoning

    Caller frame introspection is how rich's logging helper records the calling file and line. It is a documented feature of a mainstream terminal library, and the snippet shows no network, file or exec activity.

  16. info critical → info by review builtins-write rich/pretty.py:204:13

    `builtins._ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

                assert console is not None
            builtins._ = None  # type: ignore[attr-defined]
            console.print(
                (
    likely benign LLM, confidence 0.85 A pretty-print display helper temporarily sets builtins._ to match REPL expression-result behaviour.
    Reasoning

    This mirrors the REPL convention of setting builtins._ around a display call, as sys.displayhook does. The global side effect is unusual but is a known pattern in rich's pretty-display helper and does not carry out an attack.

  17. info critical → info by review builtins-write rich/pretty.py:221:13

    `builtins._ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

                )
            builtins._ = value  # type: ignore[attr-defined]

    try:
    likely benign LLM, confidence 0.85 The display helper stores the displayed value in builtins._ as a REPL would.
    Reasoning

    This is the same display helper assigning builtins._ to the displayed value, matching the interactive-shell convention. The flagged code is legitimate rich behaviour and not a dropper or hook.

  18. info high-complexity tests/test_inspect.py:364:17

    compression ratio 0.331 is >2σ above file mean 0.216 (raw pass, confidence 0.50)

        expected = "╭─ <class 'tests.test_inspect.test_broken_call_attr.<locals>.Foo'> ─╮\n│ foo = NotCallable()                                               │\n╰─────────────────────────────────────────────────
  19. info high-complexity tests/test_live.py:168:17

    compression ratio 0.230 is >2σ above file mean 0.106 (raw pass, confidence 0.50)

        print(repr(result))
    expected = "\x1b[?1049h\x1b[H\x1b[?25l\x1b[Hfoo                 \n                    \n                    \n                    \n                    \x1b[Hfoo                 \n                    \n                    \n                    \n                    \x1b[?25h\x1b[?1049l"
  20. info high-complexity tests/test_syntax.py:136:17

    compression ratio 0.742 is >2σ above file mean 0.191 (raw pass, confidence 0.50)

        print(repr(rendered_syntax))
    expected = '\x1b[2;37m│   \x1b[0m\x1b[33m"""Iterate and generate a tuple with a flag for first an\x1b[0m\n\x1b[2m│   \x1b[0miter_values = \x1b[36miter\x1b[0m(values)\n'
    assert rendered_syntax == expected
  21. info warn → info by review dynamic-execution tests/test_traceback.py:195:9

    `exec` called on a non-literal expression (ast pass, confidence 0.70)

        try:
        exec(compile("1/0", filename="<string>", mode="exec"))
    except Exception:
        console.print_exception()
    likely benign LLM, confidence 0.95 A test executes a fixed snippet that raises an exception so the traceback printer can be checked.
    Reasoning

    The exec call runs a fixed literal '1/0' compiled with a filename, purely to produce a ZeroDivisionError for a traceback-rendering test. The input is not attacker-controlled.

  22. info warn → info by review dynamic-execution tests/test_traceback.py:205:9

    `exec` called on a non-literal expression (ast pass, confidence 0.70)

        try:
        exec(compile("1/0", filename="string", mode="exec"))
    except Exception:
        console.print_exception()
    likely benign LLM, confidence 0.95 Another traceback test runs a fixed exception-raising snippet via exec.
    Reasoning

    This is the same test pattern with a fixed literal '1/0' input used to exercise traceback output. It is a test fixture, not malicious execution.

  23. info warn → info by review dynamic-execution tools/make_width_tables.py:22:1

    `subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
subprocess.run(f"black {path}", shell=True)
    likely benign LLM, confidence 0.80 A developer tool shells out to black to format a file path.
    Reasoning

    A maintainer script runs black on a local path through a shell. The path comes from the developer's own tooling, not from untrusted input, so the risk is only a minor injection hygiene issue.

  24. info warn → info by review dynamic-execution tools/make_width_tables.py:53:5

    `subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
    subprocess.run(f"black {path}", shell=True)
    likely benign LLM, confidence 0.80 A second call in the same tool runs black through a shell on a local path.
    Reasoning

    This is the same maintainer-side call to black with shell=True on a local path. It is a build-tool convenience with no sign of a dropper or remote payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Textualize/rich rich && cd rich
git checkout v15.0.0
disclude scan --severity info --diff v14.3.4 .