disclude.io

PyPI / rich / 15.0.0

rich 15.0.0

Source
https://github.com/Textualize/rich
Tag scanned
v15.0.0
Compared with
v14.3.4 (0 signals introduced since)
Files
319 scanned, 217 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 24 info
Scan time
18.9 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 19 of 19 warn and critical signals; 19 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-21 22:38

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review unicode-zero-width README.fa.md:30:129

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    
[ریچ](https://rich.readthedocs.io/en/latest/) افزودن رنگ و سبک به خروجی ترمینال را آسان می⟨U+200C⟩کند.
ریچ همچنین می⟨U+200C⟩تواند جدول های زیبا، نوار های پیشرفت
(progress bars),
    likely benign LLM, confidence 0.95 ZWNJ in Persian prose in a translated README.
    Reasoning

    U+200C ZERO WIDTH NON-JOINER is a normal orthographic character in Persian text and appears throughout this Persian translation of the README in ordinary words. Raw-pass unicode findings are high false-positive, and this is not hidden content.

  2. info warn → info by review unicode-zero-width README.fa.md:31:25

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    [ریچ](https://rich.readthedocs.io/en/latest/) افزودن رنگ و سبک به خروجی ترمینال را آسان می⟨U+200C⟩کند.
ریچ همچنین می⟨U+200C⟩تواند جدول های زیبا، نوار های پیشرفت
(progress bars),
مارک داون
    likely benign LLM, confidence 0.95 ZWNJ in Persian prose in a translated README.
    Reasoning

    Same as the other Persian ZWNJ findings: the character is required in Persian orthography (for example in می⟨U+200C⟩کند) and the context is ordinary documentation prose.

  3. info warn → info by review unicode-zero-width README.fa.md:133:49

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    داخلی پایتون نیست.
ریچ متن شما را به صورت کلمه⟨U+200C⟩ای
(واژه بندی شده)
در نظر میگیرد تا در عرض
    likely benign LLM, confidence 0.95 ZWNJ in Persian prose in a translated README.
    Reasoning

    ZWNJ between Persian word parts in normal documentation text. No code, no hidden instructions, no concealed payload.

  4. info warn → info by review unicode-zero-width README.fa.md:321:202

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    wnloader.py) را ببینید که می⟨U+200C⟩تواند چندین لینک URL را به طور همزمان بارگیری کند و پیشرفت را نشان دهد.
    likely benign LLM, confidence 0.95 ZWNJ in Persian prose in a translated README.
    Reasoning

    ZWNJ in a Persian sentence describing a downloader example. Normal Persian orthography.

  5. info warn → info by review unicode-zero-width README.fa.md:328:323

    U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

    �خنده (spinner) را نمایش می⟨U+200C⟩دهد. این انیمیشن شما را از استفاده عادی از کنسول باز نمی دارد. مثال آن به صورت زیر است:
    likely benign LLM, confidence 0.95 ZWNJ in Persian prose in a translated README.
    Reasoning

    ZWNJ in a Persian sentence about a spinner demo. Normal orthography in documentation prose.

  6. info warn → info by review unicode-mixed-script README.ja.md:36:2

    identifier `Richについての人々の感想を見る` mixes scripts: Latin + Hiragana + Han + Other (raw pass, confidence 0.80)

    
[Richについての人々の感想を見る。](https://www.willmcgugan.com/blog/pages/post/rich-tweets/)

## 互換性
    dismissed LLM, confidence 0.93 Japanese link text in a README mixing Latin, kana, and kanji.
    Reasoning

    A Japanese link label mixing Latin, Hiragana, and Han is standard Japanese typography. It is markdown prose in a README heading, not an identifier in executable code.

  7. info warn → info by review unicode-homoglyph README.ru.md:38:4

    identifier `Cовместимость` contains homoglyph candidates: о (043E)→o, е (0435)→e, с (0441)→c, о (043E)→o (raw pass, confidence 0.70)

    
## Cовместимость

Rich работает с Linux, OSX и Windows. True color / эмоджи работают с новым терминалом Windows, классический терминал лимитирован 16 цветами. Rich требует Python 3.6.3 или более новый.
    likely benign LLM, confidence 0.85 Russian README heading with a stray Latin character.
    Reasoning

    The heading 'Cовместимость' has a Latin С at the start with Cyrillic letters after it. This looks like an accidental keyboard-layout typo in documentation. It has no effect on code, and the mixed-script heading is not a spoofed identifier in executable code.

  8. info warn → info by review unicode-mixed-script README.ru.md:38:4

    identifier `Cовместимость` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
## Cовместимость

Rich работает с Linux, OSX и Windows. True color / эмоджи работают с новым терминалом Windows, классический терминал лимитирован 16 цветами. Rich требует Python 3.6.3 или более новый.
    likely benign LLM, confidence 0.85 Russian README heading mixing Latin and Cyrillic letters.
    Reasoning

    Same heading as the homoglyph finding. The mixed script comes from one stray Latin letter in a Russian README heading, which is most plausibly a typo.

  9. info warn → info by review unicode-homoglyph README.ru.md:91:17

    identifier `Сonsole` contains homoglyph candidates: С (0421)→C (raw pass, confidence 0.70)

    
У класса Сonsole есть метод `print` который имеет идентичный встроенной функции функционал `print`. Вот пример использования:

```python
    likely benign LLM, confidence 0.80 Russian README text with a Cyrillic С in the class name Console.
    Reasoning

    'Сonsole' in Russian prose uses a Cyrillic С where the class name is Console. This is a documentation typo; it does not occur in code that runs, and it does not hide a payload.

  10. info warn → info by review unicode-mixed-script README.ru.md:91:17

    identifier `Сonsole` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)

    
У класса Сonsole есть метод `print` который имеет идентичный встроенной функции функционал `print`. Вот пример использования:

```python
    likely benign LLM, confidence 0.80 Russian README text mixing Cyrillic and Latin in the class name.
    Reasoning

    Same class-name typo in prose, mixed script from the Cyrillic С. Low impact documentation error, not a functional identifier.

  11. info warn → info by review unicode-homoglyph README.ru.md:142:17

    identifier `Сonsole` contains homoglyph candidates: С (0421)→C (raw pass, confidence 0.70)

    В классе Сonsole есть метод `log()` который имеет интерфейс, аналогичный `print()`, но также отображает колонку текущим временем, именем файла и номером строки кода в которой был вызван
    likely benign LLM, confidence 0.80 Russian README prose with a Cyrillic С in Console.
    Reasoning

    Another occurrence of the Cyrillic С in 'Сonsole' in Russian prose. Consistent with an accidental typo repeated in documentation.

  12. info warn → info by review unicode-mixed-script README.ru.md:142:17

    identifier `Сonsole` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)

    В классе Сonsole есть метод `log()` который имеет интерфейс, аналогичный `print()`, но также отображает колонку текущим временем, именем файла и номером строки кода в которой был вызван
    likely benign LLM, confidence 0.80 Russian README prose mixing Cyrillic and Latin in Console.
    Reasoning

    Same as the other Сonsole mixed-script finding: a documentation typo in prose, not executable code.

  13. info unicode-mixed-script benchmarks/snippets.py:114:2

    identifier `Richについての人々の感想を見る` mixes scripts: Latin + Hiragana + Han + Other (in string/comment) (raw pass, confidence 0.40)

    
[Richについての人々の感想を見る。](https://www.willmcgugan.com/blog/pages/post/rich-tweets/)

## 互換性
  14. info long-line docs/source/layout.rst:41:1

    line length 585 characters (raw pass, confidence 0.50)

        <pre style="font-size:90%;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace"><span style="color: #000080">╭─────────────────────────────── </span><span style="color: #008000">'upper'</span><span style="color: #000080"> </span><span
  15. info warn → info by review frame-introspection rich/console.py:1932:21

    `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

    
            frame = inspect.currentframe()
        else:
            frame = currentframe()
    dismissed LLM, confidence 0.95 Rich's console uses frame introspection to locate the caller for log output.
    Reasoning

    Rich's Console.log uses inspect.currentframe to find the caller's file and line number so it can show them in the log output. This is a documented, intended feature of a terminal formatting library, and the code only reads frame metadata.

  16. info critical → info by review builtins-write rich/pretty.py:204:13

    `builtins._ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

                assert console is not None
            builtins._ = None  # type: ignore[attr-defined]
            console.print(
                (
    likely benign LLM, confidence 0.90 Pretty-printer temporarily sets builtins._ to mirror interactive REPL behaviour.
    Reasoning

    The module writes builtins._ to None just before printing, which mirrors how the interactive interpreter's displayhook manages the `_` name. This is a deliberate, documented-style behaviour of a pretty-printing library, not hidden malicious tampering, though writing a builtin is still a global side effect worth noting.

  17. info critical → info by review builtins-write rich/pretty.py:221:13

    `builtins._ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

                )
            builtins._ = value  # type: ignore[attr-defined]

    try:
    likely benign LLM, confidence 0.90 Pretty-printer assigns the last displayed value to builtins._ in REPL fashion.
    Reasoning

    The same pattern appears after printing, assigning the displayed value to builtins._ so the REPL-style `_` variable reflects the last result. It is the companion of the earlier assignment and fits the library's purpose of emulating the interactive display hook.

  18. info high-complexity tests/test_inspect.py:364:17

    compression ratio 0.331 is >2σ above file mean 0.216 (raw pass, confidence 0.50)

        expected = "╭─ <class 'tests.test_inspect.test_broken_call_attr.<locals>.Foo'> ─╮\n│ foo = NotCallable()                                               │\n╰─────────────────────────────────────────────────
  19. info high-complexity tests/test_live.py:168:17

    compression ratio 0.230 is >2σ above file mean 0.106 (raw pass, confidence 0.50)

        print(repr(result))
    expected = "\x1b[?1049h\x1b[H\x1b[?25l\x1b[Hfoo                 \n                    \n                    \n                    \n                    \x1b[Hfoo                 \n                    \n                    \n                    \n                    \x1b[?25h\x1b[?1049l"
  20. info high-complexity tests/test_syntax.py:136:17

    compression ratio 0.742 is >2σ above file mean 0.191 (raw pass, confidence 0.50)

        print(repr(rendered_syntax))
    expected = '\x1b[2;37m│   \x1b[0m\x1b[33m"""Iterate and generate a tuple with a flag for first an\x1b[0m\n\x1b[2m│   \x1b[0miter_values = \x1b[36miter\x1b[0m(values)\n'
    assert rendered_syntax == expected
  21. info warn → info by review dynamic-execution tests/test_traceback.py:195:9

    `exec` called on a non-literal expression (ast pass, confidence 0.70)

        try:
        exec(compile("1/0", filename="<string>", mode="exec"))
    except Exception:
        console.print_exception()
    likely benign LLM, confidence 0.93 Test executes a hardcoded division-by-zero snippet to exercise traceback rendering.
    Reasoning

    The exec call runs a fixed literal string, "1/0", compiled with a filename, inside a test that deliberately raises ZeroDivisionError to check traceback printing. The flagged non-literal is only the compile() result, and there is no external input.

  22. info warn → info by review dynamic-execution tests/test_traceback.py:205:9

    `exec` called on a non-literal expression (ast pass, confidence 0.70)

        try:
        exec(compile("1/0", filename="string", mode="exec"))
    except Exception:
        console.print_exception()
    likely benign LLM, confidence 0.93 Test executes a constant 1/0 snippet to generate a traceback for assertion.
    Reasoning

    This is the same deliberate test pattern: a constant code string compiled and executed to produce a traceback for the console.print_exception test. No untrusted data reaches exec.

  23. info warn → info by review dynamic-execution tools/make_width_tables.py:22:1

    `subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
subprocess.run(f"black {path}", shell=True)
    likely benign LLM, confidence 0.75 Developer script runs black on a path via shell=True with an f-string.
    Reasoning

    The shell=True call interpolates a path into a black command in a developer tool script. Injection risk exists only if the path comes from an untrusted source, and this is a maintainer utility, so it is a minor hygiene issue rather than evidence of malice.

  24. info warn → info by review dynamic-execution tools/make_width_tables.py:53:5

    `subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
    subprocess.run(f"black {path}", shell=True)
    likely benign LLM, confidence 0.75 Table generator invokes black through shell=True with an interpolated path.
    Reasoning

    This is a repeated invocation of the same formatting command in the table generator tool. Like the earlier call, it is a build-time helper with no sign of obfuscation or hidden behaviour; only the shell=True style is worth tightening.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/Textualize/rich rich && cd rich
git checkout v15.0.0
disclude scan --severity info --diff v14.3.4 .