Tootfinder

🧩 Rich plugin ecosystem: hundreds of plugins run tasks anywhere — local, SSH, #Docker, #Kubernetes or serverless task runners — and code in any language including #Python, Node.js, R, Go and S…

The conclusion from a big #Python 3.15 #Gentoo porting run today: the most common kind of #NIH Python package is one providing colorful output on the terminal…

PEP 832 – Virtual environment discovery
#python

#Python #uv users on #Debian: I've been using this setup:
apt install extrepo
extrepo enable uv
apt install uv
That worked perfectly for all local users using standard Debian package management …

I’d like to announce the most unlikely #Python package release:
service-identity 26.1.0, the best way to verify if a certificate is valid for a hostname, IP, or URI is out!
The main change is that we were able to switch from pyasn1 (thank you for more than a decade of great service! 🫡💛) to do everything within PyCA's cryptography.

Release 26.1.0 · pyca/service-identity
Highlights The true highlight is that thanks to cryptography 47, we can drop two dependencies (that have served use very well for more than a decade; thank you so much pyasn1 maintainers!). Full c...

The #Gentoo #Python 3.14 switch / 3.11 3.13t removal PR is green. Doing some final testing locally before merging it (one that involves 350 "merge wait" packages, what could possibly go wrong…).
https://codeberg.org/gentoo/gentoo/pulls/1031

On my way to Cologne for the next workshop on test-driven development with Python.
#TDD #Python #Testing

#Python 3.15 #Lazy #Imports: Faster Startup Times and the Design Behind PEP 810

#Steady #Klimacrew
#BahnMonitor-Projekt: 7. Zufall ist nicht gleich Zufall. 🤭
Nach der Verspätungsmeldung kommt ein Wissenshäppchen. Der

Python-Projekt mit Bahn-API: 7. JSON-Wissenshäppchen: Zufall clever gemacht
So ergänzt dein Python-Bot Mastodon-Posts mit JSON-Wissenshäppchen – zufällig ausgewählt und fair rotiert.

It's always important to have a consistent #security policy.
For example, a policy of "If somebody filed a CVE, it's an important security issue, and we will fix it as such, no matter how meaningless the fix is. If nobody did, it's just a glorified bug fix, no matter how serious the bug was."
So we've just seen a #pip security release over "installing random packages can overwrite pip's files and pip can lazy-import some of them immediately afterwards", with a fix of "pip will no longer load them until you run it again" (leaving the underlying security issue of "any #Python package can override files installed by any other Python package" as intended behavior). As Eli Schwartz beautifully put it, you are not expected to be using the virtual environment; you should create it, install packages into it (at most once!), and then frame it and put it on the wall to admire.
Now we're seeing a "bug fix" for "malicious entry point names can write outside of virtual environment". If nobody filed a CVE, it's obviously not a security issue at all. At least upstream graced us with fixing it without correcting the spec to forbid that first.
https://github.com/pypa/pip/issues/14000

A cool recent #Python change is PEP 783 <#pyodide

Is it only me, or has the hashtag #Python converted in to a LinkedIn-like wave of marketing bullshit? I really like Python, and use it a lot, but this is becoming unbearable.

I have a #Python favor to ask. Could someone look at Python 3.15 test failures in itsdangerous? It's blocking quite a large part of package dependency graph in #Gentoo, and the failure looks, errr, dangerous.
https://github.com/pallets/itsdangerous/issues/420

Taking Measure spoke to Guido van Rossum to find out more about #Python, what he gets up to in his spare time, and his brief spell at #nist

The Programming Language Named for Monty Python Evolved at NIST
The creator of the popular programming language Python worked at NIST while developing it.

It's 2026 and :python: #Python's standard library *still* does not have a flatten function? 🤨
(Yes, more-itertools, that's not the point)

#Steady #Klimacrew
#BahnMonitor-Projekt: 5. Automatisierte Skripte brauchen Kontrolle – besonders bei API-Aufrufen.
Jetzt bekommt das

Python-Projekt mit Bahn-API: 5. Fehlerprotokollierung und Logfile
So richtest du Logging in deinem Python-Projekt ein: UTF-8-Logfile, CSV-Struktur, automatische Dateierstellung inklusive.

TIL " #Python, for example, is a popular programming language that is famously smooth at handling integers of any size. If you peek into Python's underlying source code (search “Karatsuba” here)"

Mathematicians still don’t know the fastest way to multiply numbers
A 23-year-old student overturned an ancient conjecture about one of math’s simplest operations

What are we using to package up Python application & dependencies into a single distributable file now?
I'm thinking of bundlers like RollupJS.
PEX? Zipapp? Docker image? Trying really dang hard to only use stdlib and shipping a boring wheel?
#python #packaging #askfedi

for no particular reason whatsoever, I've updated my guide on how to measure #Python coverage across GitHub Action containers without an external service (*cough* Codecov *cough*)
https://hynek.me/articles/ditch-codeco

How to Ditch Codecov for Python Projects
Codecov’s unreliability breaking CI on my open source projects has been a constant source of frustration for me for years. I have found a way to enforce coverage over a whole GitHub Actions build matrix that doesn’t rely on third-party services.

Well, we've finally packaged #Valkey (another #Redis fork) in #Gentoo, along with its #Python bindings.
Not that we wanted to, but #FakeRedis now started requiring it for tests so heavily that it was too much effort to patch it out. Just to be clear, it just requires the Python bindings, because its test suite happily runs against either Redis or Valkey, and literally doesn't support testing against both simultaneously. But to add the bindings, we needed the database to test them against. And since I've added the package too, I've put a lot of effort (and swearing) to test FakeRedis against both servers.
Should you be using Valkey? Well, let's put it like this. You shouldn't be using Redis, because it's enterprise quality shit. Valkey is roughly what happens when you fork enterprise quality shit and have no clue what you're doing. Though you are able to mostly get renaming right (one valkey-py test failed over the server calling itself "Valkey" rather than "Redis").
Disclaimer: I've only looked at the Python bindings. Maybe the maintainers are more knowledgeable with the server itself.

Video tutorials for modern ideas and open source tools. #python

Code. Simply. Clearly. Calmly.
Short and simple video lessons that start from scratch. Tools and thoughts that might make your professional life more enjoyable.

0 days since we went from "we should replace `setup.py` with a bunch of standardized #PEP517 backends" to "every package must have its own local PEP517 backend".
#Python

📆 On 13 August, all #Berlin #Python user groups – @…, @…

Python in Berlin BBQ @ c-base, Thu, Aug 13, 2026, 7:00 PM | Meetup
Normally we announce our talks here, but this time we are taking a short summer break and therefore invite you to a barbecue at the Spree. The BBQ is for all Berlin Python

speaking of slophub, here's environ-config 26.1.0 (my #Python take on loading config from env variables and secrets from safe places) a minor modernization update. thanks so much to every single name in the thanking section and to github who made it possible:

Release 26.1.0 · hynek/environ-config
Highlights Mostly packaging, small bugs, and docs updates. Only heads-up is that the created classes are now using attrs's NG-style ones with subtly different defaults. Full changelog below! Specia...

So virtualenv solves the issue of brutal incompatibilities between python stuff (at the cost of huge amounts of diskspace), but the minute uwsgi comes into play, it is overboard and there is hardly any way to activate plugins for old python interpreters. #pythonwoes

Who thought it was a good idea to put spinners in a shell script?
`pip install` has been running for a few minutes now at 100% CPU and all progress I see is an effing spinner on the last line.
Had to look at process list to see it's not stuck.
#python #pip

> No significant changes.
Looks inside.
> Significant changes.
#Python

Vulnerability and malware checks in #uv
#python

Also, zero days (well, minus a lot of days because I've been slacking) since a random #Python package got a new #NIH dependency on another Python package which is actually a "fastest" #RustLang package which cannot be built because the author thinks it a great idea to require a nightly Rust compiler.
…and of course it's full of "unsafe" calls. Because Rust is obviously such a great language for making secure code.
https://github.com/awolverp/cachebox/issues/62

Fun fact: #Azure Pipelines don't support #YAML files with anchors/aliases.
Also fun fact: both #PyYAML and #RuamelYAML *insist* on emitting anchors/aliases, and at least the PyYAML authors seem pretty, errr, opinionated on emitting them.
#Python

🎬 Supported events include batch job completion, video generation via #Veo, and agent workflow signals. One WebhookConfig object wired directly into your generate_videos() or batch call.
🐍 The #Python SDK makes it trivial — pass a WebhookConfig with your URI and subscribed events to any long-…

I’m somewhat embarrassed to finally announce svcs 26.1.0 – my solution to #Python service location and dependency injection.
It’s been a minute, and the changelog is chuck-full, but the main features are autowiring, which looked like a simple add-on that grew to a four-digit monster diff, and of course, TypeForms that allow registering/getting abstract types!

Release 26.1.0 · hynek/svcs
Highlights In the spirit of "we do these things not because they are easy, but because we thought they were going to be easy" this release brings a great new feature: autowiring! It resolves depend...

I've been sad about the upcoming removal of #PyPy from #Gentoo, but given how many regressions I've been seeing recently in a variety of #Python packages, I'm eagerly waiting for the day when I'll remove the support and be able to stop having to deal with the test failures somehow. Not that at this point any other way of dealing besides skipping them makes any sense.

Are you really expected to run five type-checkers now?
#python

Zero days since I've discovered a random #CPython bug that triggers in very specific circumstances and I don't really have time to report it, nor can expect anyone to do it for me.
This time it's a test failure and refcounts being broken while running fastjsonschema's test suite on #Python 3.15 freethreading with pytest's --junit-xml option enabled 😱. And of course removing --junit-xml makes all tests pass.
EDIT: and of course I cannot reproduce outside Portage. Yet inside, it reliably crashes every single time.

I wish #mypy would slow down with adding new features to mypyc, and instead focused on fixing the train wreck that mypyc is right now (since 2023 at least). Like, if your code crashes hard with assertions enabled, then it's broken, period. Ignoring proper testing and shoving the issue under the carpet doesn't make it right.
#Python

If #Python package releases continue at this rate, I'm going to have to start getting up earlier.
Or just stop doing all of them in the morning.
#Gentoo

> #Python Stable ABI
> makes extensions unstable (they start segfaulting)
https://github.com/pikepdf/pikepdf/issues/723#issuecomment-4507472913

Always appreciate #Python package developers being responsible about API stability, and… [checks notes]… raising the major version number over a "minor API tweak", then delaying the release until a security fix demanded one.
#packaging

Does anyone happen to know if #PSF is processing contributing membership applications? Mine is stuck with no reply for almost 2 months now, and I'm wondering if it's just normal delay or something went wrong.
#Python

Yes, please reinvent more wheels by rewriting #Python logic in #RustLang. What could possibly go wrong?!
https://github.com/awolverp/cachebox/issues/51

Are you really expected to run five type-checkers now?
#python

0 days since provenance checks protected us from [checks notes] another project starting to upload distributions via #uv.
#Python #security

The state of #Python ecosystem right now: almost everything is slop. Some projects are complete vibe-coded slop (autobahn, chardet, cryptography). Some projects are disguised slop ("Coding agents shouldn't co-author themselves.")
There is only a handful of human projects left (Flask being one bright example). And they're being killed. They're being killed by the neverending slew of slop pull requests. They're being killed by all their dependencies becoming slop. They're being killed because this whole ecosystem has became such a complete cesspit that you have zero motivation to do anything.
EDIT: and honestly, this is only going to get worse. When you kill the incentive to work on projects, you only get more slop. Maintainers give in, and more projects become slop. Or they give up, and projects get forked unto slop.
#NoAI #NoLLM

One of my strong suites in all the packaging work is the knowledge in my head.
"Why don't you write it down for others to benefit from, then?", you'd ask.
The thing is, this knowledge is basically "hot cache". I'm bumping hundreds of #Python packages in #Gentoo, so I remember stuff. And because of that, I can quickly notice some things or answer some questions.
If that were written down, the effort needed to find it would diminish all the gain. I mean, technically *it is* already written down, and the whole point is that I have it "cached".

Anything great morning.
So now #Typer, the NIH #Python CLI library, decided to start bundling #Click. Why? Of course there's a lot of marketing bullshit behind it. Which ofc means they just don't want to be bothered about following the API, and take the easy way out.
Honestly, there is not a single week when I learn to hate Python even more. Slop-driven development.
EDIT: and ofc they immediately broke compatibility with vanilla click.
#Gentoo

#Python Hypothesis package now requires #RustLang. This is a scale of reverse dependencies I can't handle. I guess this means it's the end of WD40 profiles on #Gentoo, and therefore the end of support for Alpha, ARM<v6, HPPA, M68k, i486 and some other random subsets of architectures and profiles. Thanks for all the fish, etc.
https://github.com/HypothesisWorks/hypothesis/issues/4740

And the next big blocker for #Python 3.15 in #Gentoo is time-machine. Which is obviously broken. There's a patch but it's #slop and complex, and it's sitting for 3 months already with no reply. Because obviously patching CPython internals is so much a better idea than freezegun ever were. All these time-based tests need all the ricing you can get; portability doesn't matter.
https://github.com/adamchainz/time-machine/pull/618

Zero days since #pip added a random new functionality that depends on pip being entirely standalone and breaks when you unbundle the dependencies. And I'm unable to figure out why a bunch of tests are still failing.
EDIT: I'd appreciate some help with that. My WIP is at #Gentoo #Python

Zero days since the #Python feedparser library switched to yet another #SGMLlib fork.
Yes, #Gentoo has only packaged the previous SGMLlib fork because of them.

In the meantime, #GitPython, the package that used to be dead (because the author is busily working on their next great thing) is now slopping out 4 "security" releases a week, as their #slop machine is busily fixing unintended variable expansion in every single URL they call. Unfortunately, they probably don't have enough tokens to fix them all at once, so instead all downstreams have to deal with the churn of endless security releases. Or the brain to figure out that maybe they could just disable variable expansion by default and solve them all at once.
It's truly a great time to be a #Python packager.
#NoAI #NoLLM

Always appreciate how people release RCs to give others opportunity to test their changes early, then release final versions before the fixes for "breaks #Portage" kind of regressions introduced in the RCs are merged.
#Gentoo #Python #CPython

So I wanted to unbundle #uChardet from #cChardet #Python package.
It didn't build against system uchardet 0.0.8. So I've checked, and it turns out cchardet is using some old patched fork of uchardet. Ugh.
Fortunately, upstream added the "missing" function too, with a different API (that's not really a problem), but they didn't make a release in 4 years. Ugh.
I could at least replace the old patched uchardet with upstream uchardet, right? Except now I'm getting test failures over misdetected encodings. 0.0.8 works fine there. Though the particular test doesn't look very realistic (note all the repetitions):
#Gentoo

#PSA to #Gentoo users: Please don't upgrade to #CPython 3.14.0b4, that release is borked and causes segfaults in random packages. I've just pushed a mask but warning in case you hit the upgrade before it reaches you. We'll investigate when we have more time.
#Python

#Python #cryptography library (yes, the one that criticizes everything and everyone) is now vibecoded. Our future is truly bright!
Noticed because apparently "Claude" wrote a test that OOM-ed my system. But hey, #RustLang protects against memory errors, so it's fine to vibecode your security critical components.
#security #AI #LLM #NoAI #NoLLM