disclude.io

PyPI / ruff / 0.17.2

ruff 0.17.2

Source
https://github.com/astral-sh/ruff
Artifact scanned
ruff-0.17.2.tar.gz (sdist · 5.1 MB · SHA-256 84d632402d14…)
Compared with
ruff-0.17.1.tar.gz (1 signals introduced since)
Files
3423 scanned, 1695 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 105 info
Scan time
20.2 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 17:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review dynamic-execution README.md:149:1 new in this release

    [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

    # For a specific version.
curl -LsSf https://astral.sh/ruff/0.17.2/install.sh | sh
powershell -c "irm https://astral.sh/ruff/0.17.2/install.ps1 | iex"
    likely benign LLM, confidence 0.85 README documents a version-pinned curl-to-sh and PowerShell ruff installer.
    Reasoning

    Same official README install section, this time pinned to a specific ruff version, with a PowerShell counterpart. Pinning and the project's own domain make it a legitimate install instruction.

  2. info warn → info by review dynamic-execution README.md:143:1

    [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

    # On macOS and Linux.
curl -LsSf https://astral.sh/ruff/install.sh | sh

# On Windows.
    likely benign LLM, confidence 0.85 README documents installing ruff via a curl-to-sh installer.
    Reasoning

    This is the official ruff install instruction in the project README, piping the vendor's install script to sh. The pattern is risky in general, but in project docs for the project's own installer it is an ordinary, expected install method.

  3. info high-complexity crates/ruff/src/commands/format.rs:1243:22

    compression ratio 0.714 is >2σ above file mean 0.620 (raw pass, confidence 0.50)

                    warn_user_once!(
                    "The isort option `isort.lines-between-types` with a value greater than 1 is incompatible with the formatter. To avoid unexpected behavior, we recommend setting the option to one of: `1` or `0` (default)."
                );
            }
  4. info whitespace-anomaly crates/ruff/tests/cli/lint.rs:17:1

    file mixes tab and space indentation (2 tab-indented and 3800 space-indented lines) (raw pass, confidence 0.40)

    impl CliTest {
    fn check_command(&self) -> Command {
        let mut command = self.command();
        command.args(STDIN_BASE_OPTIONS);
  5. info whitespace-anomaly crates/ruff_annotate_snippets/tests/color/multiline_removal_suggestion.rs:2:1

    file mixes tab and space indentation (39 tab-indented and 40 space-indented lines) (raw pass, confidence 0.40)

    use annotate_snippets::{
    AnnotationKind, Level, Origin, Patch, Renderer, Snippet, renderer::DecorStyle,
};
  6. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:58

    identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation
  7. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:2991:75

    identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      |  ___________^
4 | |     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 | | ]
  | |_^ annotation
  8. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:62

    identifier `Aͫ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation
  9. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3005:79

    identifier `Lͨͧͩ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

      │ ┏━━━━━━━━━━━┛
4 │ ┃     { name = "Z͑ͫ̓ͪ̂ͫ̽⟨U+034F⟩̴̙̤̞͉͚̯̞̠͍A̴̵̜̰͔ͫ͗͢L̠ͨͧͩ͘G̴̻͈͍͔̹̑͗̎̅͛́Ǫ̵̹̻̝̳͂̌̌͘", email = 1 }
5 │ ┃ ]
  ╰╴┗━┛ annotation
  10. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3368:64

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

    ��|�\u{0002}!5�cc\u{0015}\u{0002}�Ӻi��WWj�ȥ�'�}�\u{0012}�J�ȉ��W�\u{001e}O�@����\u{001c}w�V���LO����\u{0014}[ \u{0003}_�'���SQ�~ذ��ų&��-\t��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩\u{001d}�:�\u{001c}\u{0007}�";
  11. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3396:31

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

      |
1 | �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  | ^
  12. info unicode-mixed-script crates/ruff_annotate_snippets/tests/formatter.rs:3414:33

    identifier `Ӻi` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

      │
1 │ �|�␂!5�cc␕␂�Ӻi��WWj�ȥ�'�}�␒�J�ȉ��W�␞O�@����␜w�V���LO����␔[ ␃_�'���SQ�~ذ��ų&��-    ��lN~��!@␌ _#���kQ��h⟨U+E1C5⟩�⟨U+F3C1⟩␝�:�␜␇�
  │ ━
  13. info whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:12:1

    file mixes tab and space indentation (1 tab-indented and 3952 space-indented lines) (raw pass, confidence 0.40)

    fn ends_on_col0() {
    let source = r#"
fn foo() {
}
  14. info warn → info by review whitespace-anomaly crates/ruff_annotate_snippets/tests/rustc_tests.rs:4533:3

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

        let s = c"foo\
  ⟨U+00A0⟩          bar
             ";
    //~^^^ WARNING whitespace symbol '\u{a0}' is not skipped
    likely benign LLM, confidence 0.90 Deliberate non-breaking space inside a rustc-compatibility test string.
    Reasoning

    The NBSP sits inside a test string literal whose comment expects the warning 'whitespace symbol \u{a0} is not skipped'. The character is deliberate test input for whitespace handling.

  15. info warn → info by review whitespace-anomaly crates/ruff_linter/src/lib.rs:77:9

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

                Args:
        ⟨U+00A0⟩ ⟨U+00A0⟩ Returns:
            """
"#;
    likely benign LLM, confidence 0.85 Non-breaking space in indented raw-string content in the linter crate.
    Reasoning

    The NBSP appears in an indented docstring/raw string in a Rust source file of a Python linter. Such characters commonly appear in test or doc fixtures and do not execute or hide logic.

  16. info whitespace-anomaly crates/ruff_linter/src/linter.rs:41:1

    file mixes tab and space indentation (58 tab-indented and 965 space-indented lines) (raw pass, confidence 0.40)

    pub struct LinterResult {
    /// A collection of diagnostic messages generated by the linter.
    pub diagnostics: Vec<Diagnostic>,
    /// Flag indicating that the parsed source code does not contain any
  17. info unicode-homoglyph crates/ruff_linter/src/locator.rs:78:37

    identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

        ///
    /// let locator = Locator::new("α");
    ///
    /// assert_eq!(
  18. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:426:68

    identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                &settings::LinterSettings {
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,
  19. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:444:68

    identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                    unresolved_target_version: PythonVersion::PY313.into(),
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,
  20. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:453:68

    identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                    unresolved_target_version: PythonVersion::PY314.into(),
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,
  21. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/mod.rs:470:68

    identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                    preview: PreviewMode::Enabled,
                allowed_confusables: FxHashSet::from_iter(['−', 'ρ', '∗']),
                ..settings::LinterSettings::for_rules(vec![
                    Rule::AmbiguousUnicodeCharacterString,
  22. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:12

    identifier `Ηello` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

    /// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
  23. info unicode-mixed-script crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:12

    identifier `Ηello` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
  24. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:37:33

    identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

    /// ```python
/// print("Ηello, world!")  # "Η" is the Greek eta (`U+0397`).
/// ```
///
  25. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:14

    identifier `nоqa` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

    /// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
  26. info unicode-mixed-script crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:14

    identifier `nоqa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

    /// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
  27. info unicode-homoglyph crates/ruff_linter/src/rules/ruff/rules/ambiguous_unicode_character.rs:145:24

    identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

    /// ```python
/// foo()  # nоqa  # "о" is Cyrillic (`U+043E`)
/// ```
///
  28. info proc-macro-presence crates/ruff_macros/src/lib.rs:23:1

    proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)

    
#[proc_macro_derive(OptionsMetadata, attributes(option, option_group))]
pub fn derive_options_metadata(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);
  29. info whitespace-anomaly crates/ruff_python_codegen/src/generator.rs:8:1

    file mixes tab and space indentation (1 tab-indented and 2004 space-indented lines) (raw pass, confidence 0.40)

    use ruff_python_ast::{
    self as ast, Alias, AnyStringFlags, ArgOrKeyword, BoolOp, BytesLiteralFlags, CmpOp,
    Comprehension, ConversionFlag, DebugText, ExceptHandler, Expr, Identifier, MatchCase, Operator,
    Parameter, Parameters, Pattern, Singleton, Stmt, StringFlags, Suite, TypeParam,
  30. info whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:13:1

    file mixes tab and space indentation (1 tab-indented and 253 space-indented lines) (raw pass, confidence 0.40)

    pub struct Stylist<'a> {
    indentation: Indentation,
    quote: Quote,
    line_ending: LineEndingDetection<'a>,
  31. info warn → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:255:1

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

    x = (
⟨U+00A0⟩1,
⟨U+00A0⟩2,
⟨U+00A0⟩3,
    likely benign LLM, confidence 0.85 NBSP within an embedded Python sample used by stylist tests.
    Reasoning

    The line is part of a Python code sample embedded in a Rust test string for the stylist's indentation and newline detection. The NBSP is a test input for whitespace handling.

  32. info warn → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:256:1

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

    ⟨U+00A0⟩1,
⟨U+00A0⟩2,
⟨U+00A0⟩3,
)
    likely benign LLM, confidence 0.85 NBSP within an embedded Python sample used by stylist tests.
    Reasoning

    Continuation of the same embedded Python test sample for stylist whitespace detection; the NBSP is test data, not runtime logic.

  33. info warn → info by review whitespace-anomaly crates/ruff_python_codegen/src/stylist.rs:257:1

    invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)

    ⟨U+00A0⟩2,
⟨U+00A0⟩3,
)
";
    likely benign LLM, confidence 0.85 NBSP within an embedded Python sample used by stylist tests.
    Reasoning

    Continuation of the same embedded Python test sample in stylist.rs; the whitespace anomaly is intentional test input.

  34. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/black/cases/docstring.py:2:1

    file mixes tab and space indentation (12 tab-indented and 95 space-indented lines) (raw pass, confidence 0.40)

    class MyClass:
  """ Multiline
  class docstring
  """
  35. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/generics_wrapping.py:1:1

    168 of 250 non-conventional identifiers are single-character (67%) (token pass, confidence 0.50)

  36. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/import_comments.py:1:1

    18 of 43 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)

  37. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_570.py:1:1

    34 of 69 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)

  38. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_572_py310.py:1:1

    29 of 56 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)

  39. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/pep_646.py:1:1

    mean non-conventional identifier length 1.88 over 420 names (token pass, confidence 0.50)

  40. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/percent_precedence.py:1:1

    mean non-conventional identifier length 1.15 over 26 names (token pass, confidence 0.50)

  41. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/power_op_spacing_long.py:1:1

    mean non-conventional identifier length 1.00 over 53 names (token pass, confidence 0.50)

  42. info warn → info by review narrow-file-charset crates/ruff_python_formatter/resources/test/fixtures/black/cases/power_op_spacing_long.py:1:1

    file uses only 11 distinct printable characters ("*.01=abcdef") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)

    a = 1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1
b = 1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1**1
c = 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1 ** 1
    likely benign LLM, confidence 0.90 Formatter test fixture of repeated exponentiation expressions.
    Reasoning

    The file is a formatter fixture for power-operator spacing, made of repeated 1**1 expressions. The small character set reflects the arithmetic under test, not an obfuscated payload.

  43. info high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings.py:311:12

    compression ratio 0.831 is >2σ above file mean 0.705 (raw pass, confidence 0.50)

    
log.info(f'Skipping: {desc["db_id"]} {foo("bar",x=123)} {"foo" != "bar"} {(x := "abc=")} {pos_share=} {desc["status"]} {desc["exposure_max"]}')

log.info(f'Skipping: {desc["db_id"]} {desc["ms_name"]} {money=} {(x := "abc=")=} {pos_share=} {desc["status"]} {desc["exposure_max"]}')
  44. info warn → info by review high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__east_asian_width.py:5:10

    string literal compression ratio 0.970 (132 bytes) (raw pass, confidence 0.60)

    hangul = '코드포인트 수는 적으나 실제 터미널이나 에디터에서 렌더링될 땐 너무 길어서 줄바꿈이 필요한 문자열'
hanzi = '中文測試：代碼點數量少，但在真正的終端模擬器或編輯器中呈現時太長，因此需要換行的字符串。'
    likely benign LLM, confidence 0.90 Korean and Chinese string literals in a formatter width test.
    Reasoning

    The strings are ordinary Korean and Chinese text used to test line-width handling in a formatter fixture. Compression ratio on natural-language text is not a sign of obfuscation.

  45. info critical → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__regression.py:20:9

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        def foo():
        os.system("This is a regression test. xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxxx.".format("xxxxxxxxxx", "xxxxxx", "xxxxxxxxxx"))
    likely benign LLM, confidence 0.85 os.system call with a .format argument inside a formatter test fixture.
    Reasoning

    This is a formatter regression fixture from black's test suite. The os.system call is parsed as source text for formatting and is never executed, and the argument is a literal string with .format applied.

  46. info high-complexity crates/ruff_python_formatter/resources/test/fixtures/black/cases/preview_long_strings__regression.py:235:17

    compression ratio 0.845 is >2σ above file mean 0.458 (raw pass, confidence 0.50)

    
cmd_fstring = f"sudo -E deluge-console info --detailed --sort-reverse=time_added {'{{}}' if ID is None else ID} | perl -nE 'print if /^{field}:/'"

cmd_fstring = f"sudo -E deluge-console info --detailed --sort-reverse=time_added {{'' if ID is None else ID}} | perl -nE 'print if /^{field}:/'"
  47. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/black/cases/skip_magic_trailing_comma_generic_wrap.py:1:1

    128 of 176 non-conventional identifiers are single-character (73%) (token pass, confidence 0.50)

  48. info warn → info by review unicode-invisible crates/ruff_python_formatter/resources/test/fixtures/black/cases/tricky_unicode_symbols.py:4:2

    U+E0100 VARIATION SELECTOR SUPPLEMENT (invisible payload carrier, encodes byte 0x10) in source (raw pass, confidence 0.90)

    蟒 = 3
x⟨U+E0100⟩ = 4
មុ = 1
Q̇_per_meter = 4
    likely benign LLM, confidence 0.75 Formatter fixture with a variation selector deliberately placed in a Python identifier.
    Reasoning

    This is black's tricky-unicode-symbols fixture, which deliberately includes unusual identifier characters, including a variation selector in an identifier. The invisible character is intentional test input, though it is the kind of thing a supply-chain scanner should flag in general.

  49. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring.py:2:1

    file mixes tab and space indentation (6 tab-indented and 72 space-indented lines) (raw pass, confidence 0.40)

    def single_line_backslashes1():
  """ content\     """
  return
  50. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring_code_examples.py:12:1

    file mixes tab and space indentation (27 tab-indented and 634 space-indented lines) (raw pass, confidence 0.40)

    def doctest_simple():
    """
    Do cool stuff.
  51. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/docstring_tab_indentation.py:7:1

    file mixes tab and space indentation (28 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)

    def tab_argument(arg1: str) -> None:
	"""
	Arguments:
		arg1: super duper arg with 2 tabs in front
  52. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/attribute.py:1:1

    55 of 126 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)

  53. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:27:1

    file mixes tab and space indentation (2 tab-indented and 489 space-indented lines) (raw pass, confidence 0.40)

    lambda x: lambda y: lambda z: (
    x,
    y,
z)  # Trailing
  54. info warn → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:845:5

    `subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    def foo():
    subprocess.check_call(f"rm -rf {' '.join(map(lambda object_name: os.path.join(dest_path, object_name), objects_to_remove))}", shell=True)

def bar():
    likely benign LLM, confidence 0.80 Formatter fixture containing a subprocess shell=True call with lambda-built arguments.
    Reasoning

    This is a ruff formatter fixture testing lambda formatting. The shell=True call is never executed, and the interpolated command is only source text to format.

  55. info warn → info by review dynamic-execution crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/lambda.py:858:5

    `subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    def foo():
    subprocess.check_call(f"rm -rf {' '.join(map(lambda object_name: max(candidate_paths, key=lambda candidate: os.path.join(dest_path, object_name, candidate)), objects_to_remove))}", shell=True)

# Regression test for https://github.com/astral-sh/ruff/issues/25397
    likely benign LLM, confidence 0.80 Formatter fixture containing another subprocess shell=True call with nested lambdas.
    Reasoning

    Another lambda-formatting test case from the same ruff fixture file, with the same shell=True pattern used as parseable source, not as code that runs.

  56. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/nested_string_quote_style.py:1:1

    mean non-conventional identifier length 1.93 over 41 names (token pass, confidence 0.50)

  57. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/tstring.py:1:1

    239 of 558 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

  58. info long-line crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/tuple.py:15:1

    line length 569 characters (raw pass, confidence 0.50)

    c1 = (("cicero"), ("Qui", "autem,", "si", "maxime", "hoc", "placeat,", "moderatius", "tamen", "id", "uolunt", "fieri,", "difficilem", "quandam", "temperantiam", "postulant", "in", "eo,", "quod", "semel", "admissum", "coerceri", "reprimique", "non", "potest,", "ut", "propemodum", "iustioribus", "utamur", "illis,", "qui"
  59. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/expression/unary.py:2:1

    file mixes tab and space indentation (2 tab-indented and 129 space-indented lines) (raw pass, confidence 0.40)

    if not aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:
    pass

a = True
  60. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/fluent.py:1:1

    mean non-conventional identifier length 1.00 over 41 names (token pass, confidence 0.50)

  61. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_on_off/mixed_space_and_tab.py:2:1

    file mixes tab and space indentation (1 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)

    def test():
 # fmt: off
 	a_very_small_indent
 	(
  62. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_on_off/off_on_off_on.py:1:1

    mean non-conventional identifier length 1.30 over 27 names (token pass, confidence 0.50)

  63. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/fmt_skip/compound_one_liners.py:15:1

    file mixes tab and space indentation (1 tab-indented and 14 space-indented lines) (raw pass, confidence 0.40)

    if True:
    for i in range(10): print(i)  # fmt: skip

# Multiple statements in body (should not apply - multiline)
  64. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/parentheses/nested.py:1:1

    mean non-conventional identifier length 1.54 over 28 names (token pass, confidence 0.50)

  65. info identifier-low-length crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/delete.py:1:1

    80 of 98 non-conventional identifiers are single-character (82%) (token pass, confidence 0.50)

  66. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/match.py:3:1

    file mixes tab and space indentation (22 tab-indented and 474 space-indented lines) (raw pass, confidence 0.40)

    match foo:  # dangling match comment
    case "bar":
        pass
  67. info whitespace-anomaly crates/ruff_python_formatter/resources/test/fixtures/ruff/statement/type_alias.py:42:1

    file mixes tab and space indentation (3 tab-indented and 44 space-indented lines) (raw pass, confidence 0.40)

    type \
	X = int
type X \
	= int
  68. info identifier-low-length crates/ruff_python_parser/resources/inline/err/different_match_pattern_bindings.py:1:1

    mean non-conventional identifier length 1.98 over 41 names (token pass, confidence 0.50)

  69. info identifier-low-length crates/ruff_python_parser/resources/inline/err/duplicate_type_parameter_names.py:1:1

    25 of 39 non-conventional identifiers are single-character (64%) (token pass, confidence 0.50)

  70. info identifier-low-length crates/ruff_python_parser/resources/inline/err/invalid_annotation_function.py:1:1

    32 of 76 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)

  71. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:1:6

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
  72. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:2:4

    identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    b'123a𝐁c'
rb"a𝐁c123"
b"""123a𝐁c"""
  73. info unicode-mixed-script crates/ruff_python_parser/resources/inline/err/invalid_byte_literal.py:3:8

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    rb"a𝐁c123"
b"""123a𝐁c"""
  74. info identifier-low-length crates/ruff_python_parser/resources/inline/ok/ambiguous_lpar_with_items_binary_expr.py:1:1

    mean non-conventional identifier length 1.97 over 30 names (token pass, confidence 0.50)

  75. info identifier-low-length crates/ruff_python_parser/resources/inline/ok/non_duplicate_type_parameter_names.py:1:1

    17 of 30 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)

  76. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/bool_op.py:1:1

    mean non-conventional identifier length 1.73 over 52 names (token pass, confidence 0.50)

  77. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/compare.py:1:1

    mean non-conventional identifier length 1.73 over 75 names (token pass, confidence 0.50)

  78. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/lambda.py:1:1

    48 of 78 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)

  79. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/t_string.py:1:1

    mean non-conventional identifier length 1.34 over 58 names (token pass, confidence 0.50)

  80. info identifier-low-length crates/ruff_python_parser/resources/valid/expressions/tuple.py:1:1

    mean non-conventional identifier length 1.33 over 24 names (token pass, confidence 0.50)

  81. info identifier-low-length crates/ruff_python_parser/resources/valid/other/decorator.py:1:1

    16 of 40 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

  82. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/delete.py:1:1

    mean non-conventional identifier length 1.86 over 21 names (token pass, confidence 0.50)

  83. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/function.py:1:1

    114 of 262 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)

  84. info identifier-low-length crates/ruff_python_parser/resources/valid/statement/type.py:1:1

    100 of 249 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

  85. info whitespace-anomaly crates/ruff_python_parser/resources/valid/statement/type.py:27:1

    file mixes tab and space indentation (6 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)

    type \
	X = int
type X \
	= int
  86. info unicode-mixed-script crates/ruff_python_parser/src/lexer.rs:2117:43

    identifier `aβ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        fn non_ascii_identifier_flag() {
        let mut lexer = Lexer::new("a€\naβ = β\nascii", Mode::Module, TextSize::default());
        let mut flags = Vec::new();
        loop {
  87. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1541:29

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // test_err invalid_byte_literal
                    // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
  88. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1542:27

    identifier `a𝐁c123` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // b'123a𝐁c'
                    // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {
  89. info unicode-mixed-script crates/ruff_python_parser/src/parser/expression.rs:1543:31

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

                        // rb"a𝐁c123"
                    // b"""123a𝐁c"""
                    StringType::Bytes(ast::BytesLiteral {
                        value: Box::new([]),
  90. info warn → info by review encoding-hex crates/ruff_python_parser/src/string.rs:939:78

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

    \x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
    likely benign LLM, confidence 0.97 A Rust string literal enumerating byte values as \xNN escapes, likely in parser test data.
    Reasoning

    This is a byte-escape test table, a sequence of all byte values 0x00 to 0x7f and beyond inside a Rust string literal in a Python parser's test or fixture code. Consecutive hex escapes are expected for this purpose and it is not obfuscation.

  91. info warn → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:939:247

    129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)

    NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
    likely benign LLM, confidence 0.97 Continuation of the exhaustive byte-escape table in the ruff parser's string handling code.
    Reasoning

    Same byte-enumeration test table in the ruff Python parser source; the long escape run is an exhaustive byte-value table used to exercise string escape handling, consistent with a legitimate parser test.

  92. info warn → info by review encoding-hex crates/ruff_python_parser/src/string.rs:947:78

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

    \x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\
    likely benign LLM, confidence 0.97 A second byte-value escape enumeration in the same Rust parser test code.
    Reasoning

    Duplicate of the same exhaustive byte-value test table in the ruff parser's string.rs, a sequential enumeration of all byte values used for testing escape handling rather than any hidden payload.

  93. info warn → info by review encoding-escape-soup crates/ruff_python_parser/src/string.rs:947:247

    129 consecutive `\xNN` escapes (entropy 7.0 bits/byte) (raw pass, confidence 0.80)

    NOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\x
    likely benign LLM, confidence 0.97 Continuation of the second byte-value enumeration in the ruff parser string code.
    Reasoning

    Same exhaustive sequential byte table continuing in the parser source; the monotonically increasing values are a test fixture, not encoded or executed data.

  94. info unicode-mixed-script crates/ruff_python_parser/src/string.rs:1149:29

    identifier `a𝐁c` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        fn test_invalid_byte_literal_error() {
        let source = r"b'123a𝐁c'";
        let error = parse_suite(source).unwrap_err();
        insta::assert_debug_snapshot!(error);
  95. info unicode-mixed-script crates/ruff_python_stdlib/src/identifiers.rs:113:32

    identifier `πr` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            assert!(is_identifier("кириллица"));
        assert!(is_identifier("πr"));
        assert!(!is_identifier(""));
        assert!(!is_identifier("percentile_co³t"));
  96. info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:17:27

    identifier `αbc` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    /// assert!(is_lowercase("_"));
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
  97. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:17:27

    identifier `αbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(is_lowercase("_"));
/// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
  98. info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:18:28

    identifier `αBC` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    /// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
  99. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:18:28

    identifier `αBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(is_lowercase("αbc"));
/// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
  100. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:19:28

    identifier `Ωbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(!is_lowercase("αBC"));
/// assert!(!is_lowercase("Ωbc"));
/// ```
pub fn is_lowercase(s: &str) -> bool {
  101. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:54:27

    identifier `ΩBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(is_uppercase("_"));
/// assert!(is_uppercase("ΩBC"));
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
  102. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:55:28

    identifier `Ωbc` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(is_uppercase("ΩBC"));
/// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
  103. info unicode-homoglyph crates/ruff_python_stdlib/src/str.rs:56:28

    identifier `αBC` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    /// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
pub fn is_uppercase(s: &str) -> bool {
  104. info unicode-mixed-script crates/ruff_python_stdlib/src/str.rs:56:28

    identifier `αBC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// assert!(!is_uppercase("Ωbc"));
/// assert!(!is_uppercase("αBC"));
/// ```
pub fn is_uppercase(s: &str) -> bool {
  105. info unicode-homoglyph crates/ruff_workspace/src/options.rs:706:44

    identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                # which could be confused for "-", "p", and "*", respectively.
            allowed-confusables = ["−", "ρ", "∗"]
        "#
    )]

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o ruff-0.17.2.tar.gz https://files.pythonhosted.org/packages/ae/58/690cf56da80c8f2c8bf12042b6017beac2c34fe961f65420bcb3fb7fac38/ruff-0.17.2.tar.gz
printf '%s  %s\n' 84d632402d14c23b488f941db23712d6736a013225162062d34558c3f3c780eb ruff-0.17.2.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf ruff-0.17.2.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg