PyCQA/docformatter

Review signals: 5 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 5 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• docformatter formats docstrings to follow PEP 257: Real input produced the expected result: Main function.

  Source: Formats docstrings to follow `PEP 257`_.

  Input: def main(): """Main function""" pass

  Expected: Docstring summary becomes Main function. on one line

  Command: <guest-path> -

  Observed: Main function.""" pass

Examples

• Run docformatter in place on a file, as in the README example: command completed successfully with no output

  Source: README.rst

  Input: example.py (already formatted by the README example run)

  Expected: Already formatted file is left unchanged, exit 0

  Command: <guest-path> --in-place example.py

Local or hosted: local

Format Python docstrings to PEP 257 style with the docformatter CLI

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; echo CDP=$CDP_URL; cat README.md | head -c 6000
cd <guest-path> && cat README.rst | head -c 7200
cd <guest-path> && ls .coldpass; grep -n -i "python_requires\|requires-python\|scripts\|docformatter =" pyproject.toml; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && sed -n 1,30p pyproject.toml; grep -n "python" pyproject.toml | head; ls -la .coldpass; python3 -m venv --help >/dev/null 2>&1 && echo venv_ok || echo venv_missing
python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; <guest-path> install <guest-path> 2>&1 | tail -4; <guest-path> --version
mkdir -p <guest-path> && cd <guest-path> && cat > example.py <<'EOF'
"""   Here are some examples.

    This module docstring should be dedented."""


def factorial(x):
    '''

    Return x factorial.

    This uses math.factorial.

    '''
    import math
    return math.factorial(x)


def print_factorial(x):
    """Print x factorial"""
    print(factorial(x))


def main():
    """Main
    function"""
    print_factorial(5)
    if factorial(10):
        print_factorial(22)
EOF
cp example.py example.orig.py && <guest-path> --in-place example.py; echo rc=$?; cat example.py
cd <guest-path> && grep -rn -i "exit\|returncode\|status code" <guest-path> --include=*.rst | head -8; printf 'def f(x):\n    """Print x factorial"""\n    return x\n' | <guest-path> -; echo rc=$?; printf 'def f(x):\n    """Print x factorial"""\n    return x\n' > s.py && <guest-path> --check s.py; echo rc=$?
sed -n 103,120p <guest-path>
cd <guest-path> && wc -l check.py && grep -n "source_file\|README\|expected_returncode\|output_directory\|stays_running" check.py | head -40
cd <guest-path> && grep -rn "stdin\|docformatter -\b" docs/source/*.rst | head -5; grep -n "PEP 257\`_\." README.rst
mkdir -p <guest-path> && cd <guest-path> && cat > claims.json <<'EOF'
[{"kind":"claim","claim":"docformatter formats docstrings to follow PEP 257","source":"Formats docstrings to follow `PEP 257`_.","source_file":"README.rst","input":"def main():\n    \"\"\"Main\n    function\"\"\"\n    pass\n","expected":"Docstring summary becomes Main function. on one line","probe_kind":"cli","argv":["<guest-path>","-"],"stdin":"def main():\n    \"\"\"Main\n    function\"\"\"\n    pass\n","expected_text":"Main function.","cwd":"<guest-path>"}]
EOF
cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","-"],"cwd":"<guest-path>","stdin":"def main():\n    \"\"\"Main\n    function\"\"\"\n    pass\n","expected_text":"Main function."}
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Run docformatter in place on a file, as in the README example","source":"README.rst","input":"example.py (already formatted by the README example run)","expected":"Already formatted file is left unchanged, exit 0","argv":["<guest-path>","--in-place","example.py"],"cwd":"<guest-path>","env":{},"expected_text":""}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (pyproject.toml scripts: docformatter=docformatter.__main__:main; README.rst). docformatter is a one-shot CLI with no cron, scheduler, loop, webhook or --once/--now mode; its only recurring use is an external PyCharm file watcher (docs/source/usage.rst), which is not a product cycle.","checks":[]}
EOF
for f in claims.json probe.json examples.json cycles.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done
cd <guest-path> && sed -i 's/,"expected_text":""}]/}]/' .coldpass/examples.json && python3 -I -m json.tool .coldpass/examples.json >/dev/null && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Format Python docstrings to PEP 257 style with the docformatter CLI","operation_scope":"Local CLI on Python 3.12.3 (pyproject requires ^3.10) in a venv at <guest-path>; no browser, credentials or network service needed. Source is the checked-out snapshot in <guest-path> (no git metadata present, so the pinned commit 82069d7f1e105bd86c69fd9ae0587ca00da3c312 was not independently verified).","steps":["python3 -m venv <guest-path>","<guest-path> install <guest-path>  (built docformatter 1.7.8)","<guest-path> --in-place example.py  (README example; exit 3 = file changed, as documented in docs/source/usage.rst)","printf source | <guest-path> -  (stdin mode; returned formatted docstring 'Main function.')"],"deviations":["Installed from the local checkout with pip rather than PyPI 'pip install --upgrade docformatter', so the pinned source was tested.","The /inputs/coldpass-preflight.py path given in the task does not exist; ran <guest-path> as the task's command instructed.","Cycles: none detected (one-shot CLI); recorded detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -m json.tool report.json >/dev/null && echo ok; ls -la <guest-path>