ruff 0.17.1

Source: https://github.com/astral-sh/ruff
Artifact scanned: ruff-0.17.1.tar.gz (sdist · 5.1 MB · SHA-256 5bb796c5112e…)
Compared with: ruff-0.17.0.tar.gz (1 signals introduced since)
Files: 3421 scanned, 1694 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 105 info
Scan time: 22.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 03:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution README.md:149:1 new in this release

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# For a specific version.
curl -LsSf https://astral.sh/ruff/0.17.1/install.sh | sh
powershell -c "irm https://astral.sh/ruff/0.17.1/install.ps1 | iex"
```
likely benign LLM, confidence 0.90 Documented pinned-version curl-to-sh and PowerShell install commands for ruff.
Reasoning
The pinned-version installer command is the same documented pattern, with an explicit version in the URL. The PowerShell line is also a documented Windows installer.
info ~~warn~~ → info by review dynamic-execution README.md:143:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# On macOS and Linux.
curl -LsSf https://astral.sh/ruff/install.sh | sh

# On Windows.
```
likely benign LLM, confidence 0.90 Documented curl-to-sh install command for the ruff tool.
Reasoning
This is the documented one-line installer for ruff in a README, served over HTTPS from the project's own domain. Piping an install script to sh is a common, openly documented pattern, not hidden execution.

info high-complexity crates/ruff/src/commands/format.rs:1243:22

compression ratio 0.714 is >2σ above file mean 0.620 (raw pass, confidence 0.50)

                warn_user_once!(
                    "The isort option `isort.lines-between-types` with a value greater than 1 is incompatible with the formatter. To avoid unexpected behavior, we recommend setting the option to one of: `1` or `0` (default)."
                );
            }

info whitespace-anomaly crates/ruff/tests/cli/lint.rs:17:1

file mixes tab and space indentation (2 tab-indented and 3800 space-indented lines) (raw pass, confidence 0.40)

impl CliTest {
    fn check_command(&self) -> Command {
        let mut command = self.command();
        command.args(STDIN_BASE_OPTIONS);

info whitespace-anomaly crates/ruff_annotate_snippets/tests/color/multiline_removal_suggestion.rs:2:1

file mixes tab and space indentation (39 tab-indented and 40 space-indented lines) (raw pass, confidence 0.40)
```
use annotate_snippets::{
    AnnotationKind, Level, Origin, Patch, Renderer, Snippet, renderer::DecorStyle,
};
```

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:58

identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

  |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:75

identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

  |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:62

identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

  │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:79

identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

  │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3368:64

identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

��|�\u{0002}!5�cc\u{0015}\u{0002}�Ӻi��WWj�ȥ�'�}�\u{0012}�J�ȉ��W�\u{001e}O�@����\u{001c}w�V���LO����\u{0014}[ \u{0003}_�'���SQ�~ذ��ų&��-\t��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩\u{001d}�:�\u{001c}\u{0007}�";

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3396:31

identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

  |
1 | �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  | ^

info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3414:33

identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

  │
1 │ �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  │ ━

info whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:12:1

file mixes tab and space indentation (1 tab-indented and 3952 space-indented lines) (raw pass, confidence 0.40)
```
fn ends_on_col0() {
    let source = r#"
fn foo() {
}
```
info ~~warn~~ → info by review whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:4533:3

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
    let s = c"foo\
  ⟨U+00A0⟩          bar
             ";
    //~^^^ WARNING whitespace symbol '\u{a0}' is not skipped
```
likely benign LLM, confidence 0.85 Non-breaking space in a Rust test fixture for whitespace handling.
Reasoning
The no-break space appears inside a test string that deliberately exercises how whitespace symbols are handled, as the adjacent comment indicates. It is test data, not an attack.
info ~~warn~~ → info by review whitespace-anomaly crates/ruff_linter/src/lib.rs:77:9

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
            Args:
        ⟨U+00A0⟩ ⟨U+00A0⟩ Returns:
            """
"#;
```
likely benign LLM, confidence 0.80 Non-breaking space in indentation of a docstring example.
Reasoning
A non-breaking space in the indentation of a docstring inside a raw string literal in a linter source file. This is most likely a copy-paste artifact in documentation text, with no execution impact.

info whitespace-anomaly crates/ruff_linter/src/linter.rs:41:1

file mixes tab and space indentation (58 tab-indented and 965 space-indented lines) (raw pass, confidence 0.40)

pub struct LinterResult {
    /// A collection of diagnostic messages generated by the linter.
    pub diagnostics: Vec<Diagnostic>,
    /// Flag indicating that the parsed source code does not contain any

info unicode-homoglyph crates/ruff_linter/src/locator.rs:78:37

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    ///
    /// let locator = Locator::new("α");
    ///
    /// assert_eq!(
```

info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:426:68

identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

            &settings::LinterSettings {
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,

info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:444:68

identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                unresolved_target_version: PythonVersion::PY313.into(),
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,

info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:453:68

identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                unresolved_target_version: PythonVersion::PY314.into(),
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,

info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:470:68

identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                preview: PreviewMode::Enabled,
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,

info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:12

identifier `Ηello` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
```
/// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
```
info unicode-mixed-script crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:12

identifier `Ηello` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
```
info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:33

identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
```
/// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
```
info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:14

identifier `nоqa` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)
```
/// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
```
info unicode-mixed-script crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:14

identifier `nоqa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
/// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
```
info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:24

identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)
```
/// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
```

info proc-macro-presence crates/ruff_macros/src/lib.rs:23:1

proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)


#[proc_macro_derive(OptionsMetadata, attributes(option, option_group))]
pub fn derive_options_metadata(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);

info whitespace-anomaly crates/ruff_python_codegen/src/generator.rs:8:1

file mixes tab and space indentation (1 tab-indented and 2004 space-indented lines) (raw pass, confidence 0.40)

use ruff_python_ast::{
    self as ast, Alias, AnyStringFlags, ArgOrKeyword, BoolOp, BytesLiteralFlags, CmpOp,
    Comprehension, ConversionFlag, DebugText, ExceptHandler, Expr, Identifier, MatchCase, Operator,
    Parameter, Parameters, Pattern, Singleton, Stmt, StringFlags, Suite, TypeParam,

info whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:13:1

file mixes tab and space indentation (1 tab-indented and 253 space-indented lines) (raw pass, confidence 0.40)
```
pub struct Stylist<'a> {
    indentation: Indentation,
    quote: Quote,
    line_ending: LineEndingDetection<'a>,
```
info ~~warn~~ → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:255:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
x = (
⟨U+00A0⟩1,
⟨U+00A0⟩2,
⟨U+00A0⟩3,
```
likely benign LLM, confidence 0.80 Non-breaking space in a codegen test string containing Python source.
Reasoning
The non-breaking space sits in test source text used to check indentation detection in the stylist. The fixture is expected to contain odd whitespace.
info ~~warn~~ → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:256:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
⟨U+00A0⟩1,
⟨U+00A0⟩2,
⟨U+00A0⟩3,
)
```
likely benign LLM, confidence 0.80 Non-breaking space in a codegen test string containing Python source.
Reasoning
Same pattern as the adjacent finding: a whitespace-edge-case fixture within a test of Python code style detection.
info ~~warn~~ → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:257:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
⟨U+00A0⟩2,
⟨U+00A0⟩3,
)
";
```
likely benign LLM, confidence 0.80 Non-breaking space in a codegen test string containing Python source.
Reasoning
Same test fixture with whitespace edge cases for indentation and line-ending detection. No malicious effect.
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/black/cases/docstring.py:2:1

file mixes tab and space indentation (12 tab-indented and 95 space-indented lines) (raw pass, confidence 0.40)
```
class MyClass:
  """ Multiline
  class docstring
  """
```
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/generics_wrapping.py:1:1

168 of 250 non-conventional identifiers are single-character (67%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/import_comments.py:1:1

18 of 43 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_570.py:1:1

34 of 69 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_572_py310.py:1:1

29 of 56 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_646.py:1:1

mean non-conventional identifier length 1.88 over 420 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/percent_precedence.py:1:1

mean non-conventional identifier length 1.15 over 26 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/power_op_spacing_long.py:1:1

mean non-conventional identifier length 1.00 over 53 names (token pass, confidence 0.50)
info ~~warn~~ → info by review narrow-file-charset crates/ruff_python_formatter/resources/test/fixtures/black/cases/power_op_spacing_long.py:1:1

file uses only 11 distinct printable characters ("*.01=abcdef") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
a = 1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1
b = 1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1
c = 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1
```
likely benign LLM, confidence 0.90 Repeated power-operator arithmetic in a formatter test fixture.
Reasoning
The file is a Black formatter test fixture for power-operator spacing, made of repeated 1**1 expressions. A small character set comes from the content, not from encoded or constrained obfuscation, and it does not execute anything.

info high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings.py:311:12

compression ratio 0.831 is >2σ above file mean 0.705 (raw pass, confidence 0.50)


log.info(f'Skipping: {desc["db_id"]} {foo("bar",x=123)} {"foo" != "bar"} {(x := "abc=")} {pos_share=} {desc["status"]} {desc["exposure_max"]}')

log.info(f'Skipping: {desc["db_id"]} {desc["ms_name"]} {money=} {(x := "abc=")=} {pos_share=} {desc["status"]} {desc["exposure_max"]}')

info ~~warn~~ → info by review high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__east_asian_width.py:5:10

string literal compression ratio 0.970 (132 bytes) (raw pass, confidence 0.60)
```
hangul = '코드포인트 수는 적으나 실제 터미널이나 에디터에서 렌더링될 땐 너무 길어서 줄바꿈이 필요한 문자열'
hanzi = '中文測試：代碼點數量少，但在真正的終端模擬器或編輯器中呈現時太長，因此需要換行的字符串。'
```
dismissed LLM, confidence 0.90 Multilingual string literals used to test East Asian width handling.
Reasoning
Plain Chinese, Korean and Japanese string literals in a formatter test that checks line width for East Asian characters. The compression ratio flag is a false positive on natural text.
info ~~critical~~ → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__regression.py:20:9

`os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    def foo():
        os.system("This is a regression test. xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxxx.".format("xxxxxxxxxx", "xxxxxx", "xxxxxxxxxx"))
```
likely benign LLM, confidence 0.85 os.system call with a formatted literal string in a formatter test fixture.
Reasoning
This is a formatter regression fixture. The os.system argument is a literal string with a .format call, used only to test line-breaking. The critical severity comes from the non-literal heuristic and does not reflect any real command injection.

info high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__regression.py:235:17

compression ratio 0.845 is >2σ above file mean 0.458 (raw pass, confidence 0.50)


cmd_fstring = f"sudo -E deluge-console info --detailed --sort-reverse=time_added {'{{}}' if ID is None else ID} | perl -nE 'print if /^{field}:/'"

cmd_fstring = f"sudo -E deluge-console info --detailed --sort-reverse=time_added {{'' if ID is None else ID}} | perl -nE 'print if /^{field}:/'"

info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/skip_magic_trailing_comma_generic_wrap.py:1:1

128 of 176 non-conventional identifiers are single-character (73%) (token pass, confidence 0.50)
info ~~warn~~ → info by review unicode-invisible crates/ruff_python_formatter/resources/test/fixtures/black/cases/tricky_unicode_symbols.py:4:2

U+E0100 VARIATION SELECTOR SUPPLEMENT (invisible payload carrier, encodes byte 0x10) in source (raw pass, confidence 0.90)
```
蟒 = 3
x⟨U+E0100⟩ = 4
មុ = 1
Q̇_per_meter = 4
```
likely benign LLM, confidence 0.70 Identifier containing an invisible variation selector in a Unicode-handling test fixture.
Reasoning
The file is named tricky_unicode_symbols and tests how the formatter handles unusual Unicode identifiers. The variation selector supplement inside an identifier is an invisible character that could hide content, but in a test fixture it is deliberate input for parser coverage. The residual doubt keeps this from being higher.
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring.py:2:1

file mixes tab and space indentation (6 tab-indented and 72 space-indented lines) (raw pass, confidence 0.40)
```
def single_line_backslashes1():
  """ content\     """
  return
```
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring_code_examples.py:12:1

file mixes tab and space indentation (27 tab-indented and 634 space-indented lines) (raw pass, confidence 0.40)
```
def doctest_simple():
    """
    Do cool stuff.
```
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring_tab_indentation.py:7:1

file mixes tab and space indentation (28 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
```
def tab_argument(arg1: str) -> None:
	"""
	Arguments:
		arg1: super duper arg with 2 tabs in front
```
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/attribute.py:1:1

55 of 126 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:27:1

file mixes tab and space indentation (2 tab-indented and 489 space-indented lines) (raw pass, confidence 0.40)
```
lambda x: lambda y: lambda z: (
    x,
    y,
z)  # Trailing
```
info ~~warn~~ → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:845:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
def foo():
    subprocess.check_call(f"rm -rf {' '.join(map(lambda object_name: os.path.join(dest_path, object_name), objects_to_remove))}", shell=True)

def bar():
```
likely benign LLM, confidence 0.80 subprocess.check_call with shell=True and an f-string command in a formatter test fixture.
Reasoning
This is a formatter fixture testing lambda formatting inside an f-string. The shell=True call with an rm -rf command is only illustrative code that is never run, and the f-string interpolates computed paths. The pattern is unsafe in general, but it is not hidden or malicious here.
info ~~warn~~ → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:858:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
def foo():
    subprocess.check_call(f"rm -rf {' '.join(map(lambda object_name: max(candidate_paths, key=lambda candidate: os.path.join(dest_path, object_name, candidate)), objects_to_remove))}", shell=True)

# Regression test for https://github.com/astral-sh/ruff/issues/25397
```
likely benign LLM, confidence 0.80 subprocess.check_call with shell=True in a lambda-formatting regression fixture.
Reasoning
Same formatter fixture testing lambda layout inside a shell command string, with the regression issue cited in a comment. The code is test input for the formatter and is not executed.
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/nested_string_quote_style.py:1:1

mean non-conventional identifier length 1.93 over 41 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/tstring.py:1:1

239 of 558 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info long-line crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/tuple.py:15:1

line length 569 characters (raw pass, confidence 0.50)

c1 = (("cicero"), ("Qui", "autem,", "si", "maxime", "hoc", "placeat,", "moderatius", "tamen", "id", "uolunt", "fieri,", "difficilem", "quandam", "temperantiam", "postulant", "in", "eo,", "quod", "semel", "admissum", "coerceri", "reprimique", "non", "potest,", "ut", "propemodum", "iustioribus", "utamur", "illis,", "qui"

info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/unary.py:2:1

file mixes tab and space indentation (2 tab-indented and 129 space-indented lines) (raw pass, confidence 0.40)
```
if not aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
    pass

a = True
```
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/fluent.py:1:1

mean non-conventional identifier length 1.00 over 41 names (token pass, confidence 0.50)
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_on_off/mixed_space_and_tab.py:2:1

file mixes tab and space indentation (1 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
```
def test():
 # fmt: off
 	a_very_small_indent
 	(
```
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_on_off/off_on_off_on.py:1:1

mean non-conventional identifier length 1.30 over 27 names (token pass, confidence 0.50)
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_skip/compound_one_liners.py:15:1

file mixes tab and space indentation (1 tab-indented and 14 space-indented lines) (raw pass, confidence 0.40)
```
if True:
    for i in range(10): print(i)  # fmt: skip

# Multiple statements in body (should not apply - multiline)
```
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/parentheses/nested.py:1:1

mean non-conventional identifier length 1.54 over 28 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/delete.py:1:1

80 of 98 non-conventional identifiers are single-character (82%) (token pass, confidence 0.50)
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/match.py:3:1

file mixes tab and space indentation (22 tab-indented and 474 space-indented lines) (raw pass, confidence 0.40)
```
match foo:  # dangling match comment
    case "bar":
        pass
```
info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/type_alias.py:42:1

file mixes tab and space indentation (3 tab-indented and 44 space-indented lines) (raw pass, confidence 0.40)
```
type \
	X = int
type X \
	= int
```
info identifier-low-length crates/ruff_python_parser/resources/inline/err/different_match_pattern_bindings.py:1:1

mean non-conventional identifier length 1.98 over 41 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/inline/err/duplicate_type_parameter_names.py:1:1

25 of 39 non-conventional identifiers are single-character (64%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/inline/err/invalid_annotation_function.py:1:1

32 of 76 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:1:6

identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
```
info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:2:4

identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
```
info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:3:8

identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
rb"a𝐁c123"
b"""123a𝐁c"""
```
info identifier-low-length crates/ruff_python_parser/resources/inline/ok/ambiguous_lpar_with_items_binary_expr.py:1:1

mean non-conventional identifier length 1.97 over 30 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/inline/ok/non_duplicate_type_parameter_names.py:1:1

17 of 30 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/bool_op.py:1:1

mean non-conventional identifier length 1.73 over 52 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/compare.py:1:1

mean non-conventional identifier length 1.73 over 75 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/lambda.py:1:1

48 of 78 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/t_string.py:1:1

mean non-conventional identifier length 1.34 over 58 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/tuple.py:1:1

mean non-conventional identifier length 1.33 over 24 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/other/decorator.py:1:1

16 of 40 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/statement/delete.py:1:1

mean non-conventional identifier length 1.86 over 21 names (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/statement/function.py:1:1

114 of 262 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
info identifier-low-length crates/ruff_python_parser/resources/valid/statement/type.py:1:1

100 of 249 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info whitespace-anomaly crates/ruff_python_parser/resources/valid/statement/type.py:27:1

file mixes tab and space indentation (6 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
```
type \
	X = int
type X \
	= int
```

info unicode-mixed-script crates/ruff_python_parser/src/lexer.rs:2117:43

identifier `aβ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    fn non_ascii_identifier_flag() {
        let mut lexer = Lexer::new("a€\naβ = β\nascii", Mode::Module, TextSize::default());
        let mut flags = Vec::new();
        loop {

info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1549:29

identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                    // test_err invalid_byte_literal
                    // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""

info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1550:27

identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                    // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {

info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1551:31

identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {
                        value: Box::new([]),

info ~~warn~~ → info by review encoding-hex crates/ruff_python_parser/src/string.rs:939:78

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
```
likely benign LLM, confidence 0.97 A Rust test table of byte escape sequences covering all byte values, inside the ruff Python parser's string handling code.
Reasoning
The snippet is a sequence of byte escapes enumerating all byte values 0x00 through 0x7f in order, which is the typical shape of a test fixture for a Python string/byte-literal parser (checking escape handling and non-ASCII bytes). The Rust file is a parser implementation in the ruff project, a well-known linter; raw-pass escape-hex heuristics fire on test tables like this, and there is no execution or payload behavior.
info ~~warn~~ → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:939:247

129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)
```
NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
```
likely benign LLM, confidence 0.96 Continuation of a sequential byte-escape test table in the ruff Python parser's string module.
Reasoning
This is the continuation of the same sequential byte table (0x80 through 0xc1 and beyond). It is a systematic enumeration of byte values used for parser test coverage of the ruff project, not an encoded payload; the raw-pass escape-soup signal is a known false positive for such fixtures.
info ~~warn~~ → info by review encoding-hex crates/ruff_python_parser/src/string.rs:947:78

18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)
```
\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
```
likely benign LLM, confidence 0.97 A second Rust test table enumerating byte escape values in the ruff Python parser's string tests.
Reasoning
Same sequential byte-escape enumeration as the earlier finding at line 939, repeated in a second test case with a quoted double-quote variant. This is a legitimate parser test fixture covering all byte values, with no decoding or execution behavior.
info ~~warn~~ → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:947:247

129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)
```
NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
```
likely benign LLM, confidence 0.96 Continuation of the second sequential byte-escape test table in the ruff parser's string module.
Reasoning
Continuation of the systematic byte-value table in the same test fixture. Its structure (ordered 0x80 onward) and location in a parser test module point to legitimate test data, not obfuscated malicious content.

info unicode-mixed-script crates/ruff_python_parser/src/string.rs:1149:29

identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    fn test_invalid_byte_literal_error() {
        let source = r"b'123a𝐁c'";
        let error = parse_suite(source).unwrap_err();
        insta::assert_debug_snapshot!(error);

info unicode-mixed-script crates/ruff_python_stdlib/src/identifiers.rs:113:32

identifier `πr` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        assert!(is_identifier("кириллица"));
        assert!(is_identifier("πr"));
        assert!(!is_identifier(""));
        assert!(!is_identifier("percentile_co³t"));

info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:17:27

identifier `αbc` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
/// assert!(is_lowercase("_"));
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:17:27

identifier `αbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(is_lowercase("_"));
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
```
info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:18:28

identifier `αBC` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:18:28

identifier `αBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:19:28

identifier `Ωbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
pub fn is_lowercase(s: &str) -> bool {
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:54:27

identifier `ΩBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(is_uppercase("_"));
/// assert!(is_uppercase("ΩBC"));
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:55:28

identifier `Ωbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(is_uppercase("ΩBC"));
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
```
info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:56:28

identifier `αBC` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
pub fn is_uppercase(s: &str) -> bool {
```
info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:56:28

identifier `αBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
pub fn is_uppercase(s: &str) -> bool {
```

info unicode-homoglyph crates/ruff_workspace/src/options.rs:706:44

identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

            # which could be confused for "-", "p", and "*", respectively.
            allowed-confusables = ["−", "ρ", "∗"]
        "#
    )]

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o ruff-0.17.1.tar.gz https://files.pythonhosted.org/packages/f9/e7/e6d5749983b020e6cb1055abec0a6f361a8e94f0184cdcf56d4760995f02/ruff-0.17.1.tar.gz
printf '%s  %s\n' 5bb796c5112e9fb9527f2ef2faa0a130d6312d19de92bcfaddd70dbb2d41020f ruff-0.17.1.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf ruff-0.17.1.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg