Tootfinder

Opt-in global Mastodon full text search. Join the index!

@mgorny@social.treehouse.systems
2026-07-25 17:00:41

In the meantime, #GitPython, the package that used to be dead (because the author is busily working on their next great thing) is now slopping out 4 "security" releases a week, as their #slop machine is busily fixing unintended variable expansion in every single URL they call. Unfortunately, they probably don't have enough tokens to fix them all at once, so instead all downstreams have to deal with the churn of endless security releases. Or the brain to figure out that maybe they could just disable variable expansion by default and solve them all at once.
It's truly a great time to be a #Python packager.
#NoAI #NoLLM