2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

91.4K

Stars

Rust

Language

611.8K

Lines of Code

1.6K

Files

1.4K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 9.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1318 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 54 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 56 finding(s).

PR Review Velocity Impact 11.9/100 · LOW

Which changes need focused human review? 1405 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 14MEDIUM 40LOW 1351

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1405 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1223 hits · 989 pts

Severity	File	Line	Snippet	Context
LOW	Cargo.toml	481	# full debug information in one warm edit/build/test replay on macOS:	COMMENT
LOW	Cargo.toml	501	# configuration and our benchmarking configuration, which is unfortunate.	COMMENT
LOW	crates/uv-auth/src/index.rs	21	#[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]	COMMENT
LOW	crates/uv-auth/src/store.rs	61	///	COMMENT
LOW	crates/uv-auth/src/middleware.rs	301	fn cache(&self) -> &CredentialsCache {	COMMENT
LOW	crates/uv-auth/src/middleware.rs	321	/// The discovered credentials must have the requested username to be used.	COMMENT
LOW	crates/uv-auth/src/realm.rs	1	use std::hash::{Hash, Hasher};	COMMENT
LOW	crates/uv-resolver-types/src/metadata.rs	21	/// A non-fatal error.	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	21	kind: &'static str,	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	41	/// The full combined PEP 508 and "conflict" marker.	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	61	/// So for example, if a particular dependency should only be activated	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	81	///	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	161	/// Combine this universal marker with the one given in a way that	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	341		COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	421		COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	681	fn encode_package_extra(package: &PackageName, extra: &ExtraName) -> ExtraName {	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	821	}	COMMENT
LOW	crates/uv-resolver-types/src/universal_marker.rs	1021	// I believe because markers are put into DNF, the marker we get here	COMMENT
LOW	crates/uv-resolver-types/src/output.rs	21	/// Includes a complete resolution graph in which every node represents a pinned package and every	COMMENT
LOW	crates/uv-resolver-types/src/output.rs	181	///	COMMENT
LOW	crates/uv-resolver-types/src/output.rs	401	`{marker1:?}` (for version `{version1}`) is not disjoint with \	COMMENT
LOW	crates/uv-keyring/tests/common/mod.rs	1	#![allow(dead_code)] // not all of these utilities are used by all tests	COMMENT
LOW	crates/uv-keyring/src/secret_service.rs	101	target: Option<String>,	COMMENT
LOW	crates/uv-keyring/src/secret_service.rs	161		COMMENT
LOW	crates/uv-keyring/src/secret_service.rs	361	for item in &search.locked {	COMMENT
LOW	crates/uv-keyring/src/error.rs	21	/// without a `SemVer` break. Clients should always have default handling	COMMENT
LOW	crates/uv-keyring/src/error.rs	41	NoEntry,	COMMENT
LOW	crates/uv-keyring/src/lib.rs	201	/// The specific reasons for invalidity are platform-dependent, but include length constraints.	COMMENT
LOW	crates/uv-keyring/src/lib.rs	221		COMMENT
LOW	crates/uv-keyring/src/lib.rs	241	/// Can return an [`Ambiguous`](Error::Ambiguous) error	COMMENT
LOW	crates/uv-keyring/src/lib.rs	261	}	COMMENT
LOW	crates/uv-keyring/src/lib.rs	281	///	COMMENT
LOW	crates/uv-keyring/src/lib.rs	301	///	COMMENT
LOW	crates/uv-keyring/src/lib.rs	321	/// on some platforms, and then only if a third-party	COMMENT
LOW	crates/uv-keyring/src/credential.rs	41	///	COMMENT
LOW	crates/uv-keyring/src/credential.rs	61	}	COMMENT
LOW	crates/uv-keyring/src/credential.rs	81	/// Delete the underlying credential, if there is one.	COMMENT
LOW	crates/uv-keyring/src/windows.rs	61	/// See the module header for the meanings of these fields.	COMMENT
LOW	crates/uv-keyring/src/windows.rs	101	/// The new credential replaces any existing one in the store.	COMMENT
LOW	crates/uv-requirements/src/lookahead.rs	21	/// The lookahead resolver resolves requirements recursively for direct URLs, so that the resolver	COMMENT
LOW	crates/uv-requirements/src/specification.rs	1	//! Collecting the requirements to compile, sync or install.	COMMENT
LOW	crates/uv-platform-tags/src/tags.rs	101	/// rows must be checked independently rather than combining their components here.	COMMENT
LOW	crates/uv-cache-key/src/canonical_url.rs	121	std::fmt::Display::fmt(&self.0, f)	COMMENT
LOW	crates/uv-pip-commands/src/tree.rs	461	.map(\|node\| {	COMMENT
LOW	crates/uv-platform/src/libc.rs	281	// unwrap-safety: Since we are guaranteed to have between 1 and 4 ASCII digits and the	COMMENT
LOW	crates/uv-platform/src/cpuinfo.rs	21	}	COMMENT
LOW	crates/uv-scripts/src/lib.rs	481	/// ```python	COMMENT
LOW	crates/uv-scripts/src/lib.rs	1301		COMMENT
LOW	crates/uv-python-types/src/request.rs	21	/// An appropriate default Python installation	COMMENT
LOW	crates/uv-python-types/src/request.rs	81	#[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]	COMMENT
LOW	crates/uv-python-types/src/request.rs	341	return Self::Key(request);	COMMENT
LOW	crates/uv-python-types/src/request.rs	381	/// prefixes (e.g. `"python"`, `"pythonw"`, or even `""`) or a set of specific Python	COMMENT
LOW	crates/uv-distribution/src/distribution_database.rs	1141	let mut hashers = algorithms.into_iter().map(Hasher::from).collect::<Vec<_>>();	COMMENT
LOW	crates/uv-distribution/src/variant/nvidia.rs	41	const MIN_COMPUTE_CAPABILITY: (u8, u8) = (5, 0);	COMMENT
LOW	crates/uv-distribution/src/index/built_wheel_index.rs	301	///	COMMENT
LOW	…ates/uv-distribution/src/metadata/dependency_groups.rs	21	///	COMMENT
LOW	crates/uv-distribution/src/metadata/requires_dist.rs	321	/// requires-python = ">=3.13.0"	COMMENT
LOW	crates/uv-distribution/src/metadata/requires_dist.rs	341	/// Provides-Extra: async	COMMENT
LOW	crates/uv-project-commands/src/check.rs	221	// as constructs like `members = ["../foo"]` are legal.	COMMENT
LOW	crates/uv-project-commands/src/run.rs	1261	}	COMMENT
1163 more matches not shown…

Empty Error Handlers12 hits · 60 pts

Severity	File	Line	Snippet	Context
HIGH	crates/uv-virtualenv/src/_virtualenv.py	88	except AttributeError:	CODE
HIGH	…s/uv-python-interpreter/python/get_interpreter_info.py	214	except (ImportError, AttributeError):	CODE
HIGH	…s/uv-python-interpreter/python/get_interpreter_info.py	374	except UnicodeDecodeError:	CODE
HIGH	…s/uv-python-interpreter/python/get_interpreter_info.py	663	except (ImportError, AttributeError):	CODE
HIGH	…ed/excluded/bird-feeder/check_installed_bird_feeder.py	7	except ModuleNotFoundError:	CODE
HIGH	…ce/packages/bird-feeder/check_installed_bird_feeder.py	7	except ModuleNotFoundError:	CODE
HIGH	…ce/packages/bird-feeder/check_installed_bird_feeder.py	7	except ModuleNotFoundError:	CODE
HIGH	…aces/albatross-in-example/check_installed_albatross.py	7	except ModuleNotFoundError:	CODE
HIGH	…le/examples/bird-feeder/check_installed_bird_feeder.py	7	except ModuleNotFoundError:	CODE
HIGH	agents/hooks/post-edit-format.py	27	except FileNotFoundError:	CODE
HIGH	agents/hooks/post-edit-format.py	40	except FileNotFoundError:	CODE
HIGH	agents/hooks/post-edit-format.py	53	except FileNotFoundError:	CODE

Unused Imports46 hits · 46 pts

Severity	File	Line	Context
LOW	crates/uv-build/python/uv_build/__init__.py	21	CODE
LOW	crates/uv-build/python/uv_build/__init__.py	21	CODE
LOW	crates/uv-build/python/uv_build/__init__.py	22	CODE
LOW	crates/uv-virtualenv/src/activator/activate_this.py	31	CODE
LOW	…s/uv-python-interpreter/python/get_interpreter_info.py	666	CODE
LOW	…s/uv-python-interpreter/python/packaging/_manylinux.py	8	CODE
LOW	…ed/excluded/bird-feeder/check_installed_bird_feeder.py	1	CODE
LOW	…ed/excluded/bird-feeder/check_installed_bird_feeder.py	4	CODE
LOW	…luded/excluded/bird-feeder/src/bird_feeder/__init__.py	1	CODE
LOW	…oject-in-excluded/packages/seeds/src/seeds/__init__.py	1	CODE
LOW	…lbatross-project-in-excluded/src/albatross/__init__.py	1	CODE
LOW	…ce/packages/bird-feeder/check_installed_bird_feeder.py	1	CODE
LOW	…ce/packages/bird-feeder/check_installed_bird_feeder.py	4	CODE
LOW	…space/packages/bird-feeder/src/bird_feeder/__init__.py	1	CODE
LOW	…ss-root-workspace/packages/seeds/src/seeds/__init__.py	1	CODE
LOW	…ces/albatross-root-workspace/src/albatross/__init__.py	1	CODE
LOW	…ce/packages/bird-feeder/check_installed_bird_feeder.py	1	CODE
LOW	…ce/packages/bird-feeder/check_installed_bird_feeder.py	4	CODE
LOW	…space/packages/bird-feeder/src/bird_feeder/__init__.py	1	CODE
LOW	…virtual-workspace/packages/seeds/src/seeds/__init__.py	1	CODE
LOW	…workspace/packages/albatross/src/albatross/__init__.py	1	CODE
LOW	…aces/albatross-in-example/check_installed_albatross.py	4	CODE
LOW	…le/examples/bird-feeder/check_installed_bird_feeder.py	1	CODE
LOW	…le/examples/bird-feeder/check_installed_bird_feeder.py	4	CODE
LOW	…ample/examples/bird-feeder/src/bird_feeder/__init__.py	1	CODE
LOW	…kspaces/albatross-in-example/src/albatross/__init__.py	1	CODE
LOW	…deptry_reproducer/python/deptry_reproducer/__init__.py	1	CODE
LOW	…ges/built-by-uv/src/built_by_uv/arithmetic/__init__.py	1	CODE
LOW	python/uv/_find_uv.py	1	CODE
LOW	python/uv/__init__.py	1	CODE
LOW	python/uv/__init__.py	3	CODE
LOW	scripts/publish-crates.py	12	CODE
LOW	scripts/update_schemastore.py	8	CODE
LOW	scripts/sync-python-version-constants.py	23	CODE
LOW	scripts/check-cargo-bans.py	10	CODE
LOW	scripts/check-cargo-lock-changes.py	10	CODE
LOW	scripts/check_cache_compat.py	7	CODE
LOW	scripts/vendor-packaging.py	19	CODE
LOW	scripts/build_uv_pgo.py	11	CODE
LOW	scripts/check_system_python.py	157	CODE
LOW	scripts/generate-known-stdlib.py	11	CODE
LOW	scripts/transform_readme.py	8	CODE
LOW	scripts/update-latest-changelog-section.py	10	CODE
LOW	scripts/patch-dist-manifest-checksums.py	10	CODE
LOW	scripts/create-python-mirror.py	19	CODE
LOW	scripts/check-trampoline-version-consistency.py	15	CODE

Self-Referential Comments15 hits · 45 pts

Severity	File	Line	Snippet	Context
MEDIUM	…tes/uv-python-interpreter/python/packaging/__init__.py	1	# This file is dual licensed under the terms of the Apache License, Version	COMMENT
MEDIUM	test/requirements/transformers/pyproject.toml	1	# This file is a translation of	COMMENT
MEDIUM	scripts/uv-run-remote-script-test.py	1	# This file is used to test `uv run <url>` in ../crates/uv/tests/run.rs	COMMENT
MEDIUM	scripts/update_schemastore.py	34	# Create a new branch tagged with the current uv commit up to date with the latest	COMMENT
MEDIUM	scripts/check_embedded_python.py	25	# Create a temporary directory.	COMMENT
MEDIUM	scripts/check_embedded_python.py	27	# Create a virtual environment with `uv`.	COMMENT
MEDIUM	scripts/check_cache_compat.py	124	# Create a temporary directory.	COMMENT
MEDIUM	scripts/check_system_python.py	165	# Create a temporary directory.	COMMENT
MEDIUM	scripts/check_system_python.py	223	# Create a virtual environment with `uv`.	COMMENT
MEDIUM	scripts/benchmark/src/benchmark/resolver.py	358	# Create a Poetry project.	COMMENT
MEDIUM	scripts/benchmark/src/benchmark/resolver.py	644	# Create a PDM project.	COMMENT
MEDIUM	scripts/benchmark/src/benchmark/resolver.py	1049	# Create a Poetry project.	COMMENT
MEDIUM	scripts/smoke-test/commands.sh	10	# Create a virtual environment and install a package with `uv pip`	COMMENT
MEDIUM	.github/workflows/release.yml	367	# Create a GitHub Release while uploading all files to it	COMMENT
MEDIUM	.github/workflows/release.yml	393	# Create a GitHub Release while uploading all files to it	COMMENT

Decorative Section Separators9 hits · 40 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	crates/uv-types/src/traits.rs	69	/// ┌────────────────┐	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	71	/// └───────▲────────┘	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	74	/// ┌───────┴────────┐	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	75	/// ┌─────────►│ uv-dispatch │◄─────────┐	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	76	/// │ └───────▲────────┘ │	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	79	/// ┌───────┴────────┐ ┌───────┴────────┐ ┌────────┴────────────────┐	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	81	/// └───────▲────────┘ └───────▲────────┘ └────────▲────────────────┘	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	83	/// └─────────────┐ │ ┌──────────────┘	COMMENT
MEDIUM⚡	crates/uv-types/src/traits.rs	86	/// └────────────────┘	COMMENT

AI Slop Vocabulary13 hits · 36 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/uv-distribution-types/src/any.rs	75	/// Like [`InstalledVersion`], but with [`CanonicalUrl`] to ensure robust URL comparisons.	COMMENT
MEDIUM	crates/uv-client/src/httpcache/mod.rs	256	/// whether a new request can utilize a cached response or not. This is	COMMENT
MEDIUM	crates/uv-extract/src/stream.rs	656	// that leverage this feature anyway.	COMMENT
MEDIUM	crates/uv-windows/src/exception.rs	37	/// halfway through a Rust operation. It needs to be robust to operating with unknown program	COMMENT
MEDIUM	crates/uv/tests/project/init.rs	2090	// robust to errors in discovery.	COMMENT
MEDIUM	crates/uv-trampoline/src/bounce.rs	196	/// PEP 405 specifies a more robust procedure (checking both the parent and grandparent	COMMENT
MEDIUM	crates/uv-trampoline/src/bounce.rs	407	// See also <https://github.com/astral-sh/uv/pull/18170> which explores a more robust solution	COMMENT
MEDIUM	crates/uv-environment-operations/src/lib.rs	366	/// This isn't fully robust, and cannot be, as the path may not exist.	COMMENT
MEDIUM	crates/uv-build-frontend/src/lib.rs	881	// allow us to leverage the hook in _most_ cases while still avoiding incorrect metadata for	COMMENT
MEDIUM	crates/uv-python-interpreter/src/environment.rs	327	// should be generally robust.	COMMENT
MEDIUM	crates/uv-python-interpreter/src/interpreter.rs	174	/// This routine mimics the CPython `getpath.py` logic in order to make a more robust assessment	COMMENT
LOW	test/ecosystem/openai-python/pyproject.toml	193	# it's fine to just use Pyright.	COMMENT
LOW	python/uv/__main__.py	12	# If it's already set, then just use it	COMMENT

Hyper-Verbose Identifiers23 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	crates/uv-test/src/archive.rs	78	def prepare_metadata_for_build_wheel(metadata_directory, config_settings=None):	CODE
LOW⚡	crates/uv-build/python/uv_build/__init__.py	92	def get_requires_for_build_sdist(	CODE
LOW⚡	crates/uv-build/python/uv_build/__init__.py	100	def get_requires_for_build_wheel(	CODE
LOW⚡	crates/uv-build/python/uv_build/__init__.py	108	def prepare_metadata_for_build_wheel(	CODE
LOW	crates/uv-build/python/uv_build/__init__.py	128	def get_requires_for_build_editable(	CODE
LOW	crates/uv-build/python/uv_build/__init__.py	136	def prepare_metadata_for_build_editable(	CODE
LOW	crates/uv/tests/pip_compile/pip_compile.rs	13421	def prepare_metadata_for_build_wheel(metadata_directory, config_settings=None):	CODE
LOW	crates/uv/tests/sync/sync.rs	7847	def prepare_metadata_for_build_editable(metadata_directory, config_settings=None):	CODE
LOW	crates/uv/tests/sync/sync.rs	7967	def prepare_metadata_for_build_editable(metadata_directory, config_settings=None):	STRING
LOW	crates/uv/tests/sync/sync.rs	18907	def get_requires_for_build_wheel(config_settings=None):	STRING
LOW	…s/uv-python-interpreter/python/get_interpreter_info.py	110	def _running_under_legacy_virtualenv() -> bool:	CODE
LOW	…s/uv-python-interpreter/python/get_interpreter_info.py	283	def _should_use_osx_framework_prefix() -> bool:	CODE
LOW	…s/uv-python-interpreter/python/get_interpreter_info.py	420	def get_operating_system_and_architecture():	CODE
LOW	…s/uv-python-interpreter/python/packaging/_manylinux.py	83	def _glibc_version_string_confstr() -> "str \| None":	CODE
LOW	…s/uv-python-interpreter/python/packaging/_manylinux.py	102	def _glibc_version_string_ctypes() -> "str \| None":	CODE
LOW	scripts/publish-crates.py	110	def build_cargo_publish_command(	CODE
LOW	scripts/build_uv_pgo.py	347	def extend_project_environments(project: EcosystemProject, content: str) -> str:	CODE
LOW	scripts/create-python-mirror.py	71	def collect_metadata_from_git_history() -> list[dict]:	CODE
LOW	scripts/check-trampoline-version-consistency.py	24	def get_locked_windows_version(lockfile_path: Path) -> str \| None:	CODE
LOW	scripts/publish/test_publish.py	448	def _verify_same_file_reupload(self, project: BuiltProject):	CODE
LOW	scripts/publish/test_publish.py	478	def _verify_existing_files_skipped(self, project: BuiltProject):	CODE
LOW	scripts/publish/test_publish.py	515	def _verify_modified_files_rejected(self, project: BuiltProject):	CODE
LOW	scripts/publish/test_publish.py	689	def _check_index_for_provenance(self, project: BuiltProject):	CODE

Synthetic Comment Markers2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	dist-workspace.toml	57	# Whether CI should include auto-generated code to build local artifacts	COMMENT
HIGH	crates/uv-types/src/requirements.rs	33	/// A set of requirements as requested by a parent requirement.	COMMENT

Deep Nesting13 hits · 13 pts

Severity	File	Line	Context
LOW	crates/uv-python-managed/fetch-download-metadata.py	224	CODE
LOW	crates/uv-python-managed/fetch-download-metadata.py	601	CODE
LOW	crates/uv-python-managed/fetch-download-metadata.py	711	CODE
LOW	crates/uv-virtualenv/src/_virtualenv.py	51	CODE
LOW	…s/uv-python-interpreter/python/get_interpreter_info.py	420	CODE
LOW	…s/uv-python-interpreter/python/packaging/_manylinux.py	214	CODE
LOW	agents/hooks/post-edit-format.py	57	CODE
LOW	scripts/check-cargo-bans.py	22	CODE
LOW	scripts/build_uv_pgo.py	312	CODE
LOW	scripts/registries-test.py	79	CODE
LOW	scripts/registries-test.py	180	CODE
LOW	scripts/codspeed-profiles.py	209	CODE
LOW	scripts/publish/test_publish.py	620	CODE

Verbosity Indicators9 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	crates/uv-pip-commands/src/tree.rs	241	// Step 1: Add each installed package.	COMMENT
LOW	crates/uv-pip-commands/src/tree.rs	255	// Step 2: Add all dependencies.	COMMENT
LOW⚡	crates/uv-pip-commands/src/tree.rs	289	// Step 2: Reverse the graph.	COMMENT
LOW⚡	crates/uv-pip-commands/src/tree.rs	294	// Step 3: Filter the graph to those nodes reachable from the target packages.	COMMENT
LOW	crates/uv/tests/pip_install/pip_install.rs	18156	// Step 1: Install as editable first.	COMMENT
LOW	crates/uv/tests/pip_install/pip_install.rs	18169	// Step 2: Use `--no-sources`; we should retain the package.	COMMENT
LOW	crates/uv/tests/sync/sync.rs	18207	// Step 1: `uv sync --no-sources` should install `anyio` from PyPI.	STRING
LOW	crates/uv/tests/sync/sync.rs	18220	// Step 2: `uv sync` should switch to an editable installation.	STRING
LOW	crates/uv/tests/sync/sync.rs	18234	// Step 3: `uv sync --no-sources` again should switch back to PyPI package.	STRING

Structural Annotation Overuse6 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	crates/uv-pip-commands/src/tree.rs	241	// Step 1: Add each installed package.	COMMENT
LOW	crates/uv-pip-commands/src/tree.rs	255	// Step 2: Add all dependencies.	COMMENT
LOW⚡	crates/uv-pip-commands/src/tree.rs	289	// Step 2: Reverse the graph.	COMMENT
LOW⚡	crates/uv-pip-commands/src/tree.rs	294	// Step 3: Filter the graph to those nodes reachable from the target packages.	COMMENT
LOW	crates/uv/tests/pip_install/pip_install.rs	18156	// Step 1: Install as editable first.	COMMENT
LOW	crates/uv/tests/pip_install/pip_install.rs	18169	// Step 2: Use `--no-sources`; we should retain the package.	COMMENT

Example Usage Blocks7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	scripts/publish-crates.py	8	# Usage:	COMMENT
LOW	scripts/install-cargo-extensions.sh	8	## Usage:	COMMENT
LOW	scripts/check-release-artifact-sboms.sh	7	## Usage:	COMMENT
LOW	scripts/codesign-macos.sh	5	# Usage:	COMMENT
LOW	scripts/nextest-setup-hook-unix.sh	7	# Usage:	COMMENT
LOW	scripts/apply-ci-snapshots.sh	4	# Usage:	COMMENT
LOW	scripts/cargo.sh	6	## Usage:	COMMENT

Modern AI Meta-Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/uv-project-commands/src/init.rs	1022	/// The module name inferred from a distribution and any override needed by the scaffold.	COMMENT
MEDIUM	crates/uv-cache/src/lib.rs	462	/// Populate the cache scaffold.	COMMENT
MEDIUM	.github/zizmor.yml	4	# We use `secrets: inherit` pervasively in uv's CI to orchestrate reusable	COMMENT

Modern Structural Boilerplate9 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	crates/uv-python-managed/fetch-download-metadata.py	68	logger = logging.getLogger(__name__)	CODE
LOW	…ges/built-by-uv/src/built_by_uv/arithmetic/__init__.py	3	__all__ = ["circle_area"]	CODE
LOW	python/uv/__init__.py	5	__all__ = ["find_uv_bin"]	CODE
LOW	scripts/update_schemastore.py	21	def update_schemastore(schemastore: Path, *, root: Path) -> None:	CODE
LOW	scripts/check_embedded_python.py	12	logger = logging.getLogger(__name__)	CODE
LOW	scripts/check_cache_compat.py	16	logger = logging.getLogger(__name__)	CODE
LOW	scripts/check_system_python.py	18	logger = logging.getLogger(__name__)	CODE
LOW	scripts/create-python-mirror.py	48	logger = logging.getLogger(__name__)	CODE
LOW	scripts/benchmark/src/benchmark/resolver.py	63	logger = logging.getLogger(__name__)	CODE

Fake / Example Data8 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	crates/uv-build-backend/src/metadata.rs	1358	extend_project(r#"maintainers = [{ email = "ferris@example.org", extra = true }]"#);	CODE
LOW	crates/uv-build-backend/src/metadata.rs	1362	4 \| maintainers = [{ email = "ferris@example.org", extra = true }]	CODE
LOW	crates/uv-build-backend/src/metadata.rs	1382	let contents = extend_project(r#"authors = [["Ferris", "ferris@example.org"]]"#);	CODE
LOW	crates/uv-build-backend/src/metadata.rs	1386	4 \| authors = [["Ferris", "ferris@example.org"]]	CODE
LOW	crates/uv/tests/project/edit.rs	11187	packages.child("placeholder").touch()?;	CODE
LOW	crates/uv/tests/project/edit.rs	11241	packages.child("placeholder").touch()?;	CODE
LOW	crates/uv/tests/project/edit.rs	11478	packages.child("placeholder").touch()?;	CODE
LOW	docs/guides/projects.md	87	{ name = "ferris", email = "ferris@example.org" }	CODE

Excessive Try-Catch Wrapping3 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/uv/tests/project/run.rs	4361	print(f"Error: Expected pythonw.exe but got: {executable}", file=sys.stderr)	CODE
MEDIUM	scripts/repair-sdist-cargo-lock.py	42	print(f"Error: {sdist_path} is not a valid tar file", file=sys.stderr)	CODE
LOW	scripts/create-python-mirror.py	93	except Exception:	CODE

Redundant / Tautological Comments4 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	scripts/update_schemastore.py	70	# Check if the schema has changed	COMMENT
LOW	scripts/nextest-setup-hook-unix.sh	18	# Set UV_TEST_CODESIGN_IDENTITY to enable signing. See `scripts/codesign-macos.sh`.	COMMENT
LOW	scripts/apply-ci-snapshots.sh	83	# Check if any artifacts were downloaded	COMMENT
LOW	scripts/generate-crate-readmes.py	126	# Check if README already exists	STRING

astral-sh/uv

Open-Source Code Quality, Security and Technical Debt Review