Tootfinder

PEP 832 – Virtual environment discovery
#python

Also, zero days (well, minus a lot of days because I've been slacking) since a random #Python package got a new #NIH dependency on another Python package which is actually a "fastest" #RustLang package which cannot be built because the author thinks it a great idea to require a nightly Rust compiler.
…and of course it's full of "unsafe" calls. Because Rust is obviously such a great language for making secure code.
https://github.com/awolverp/cachebox/issues/62

On my way to Cologne for the next workshop on test-driven development with Python.
#TDD #Python #Testing

I don't often write #python but when I do I can apparently write python inefficient enough to start the fans spinning on my workstation for half an hour. It looks like Path's match involves a glob compile for every invocation and I have a lot of files (14k) to check against a lot of patterns (2314).

EVE Online startet die Migrierung von Python 2 auf 3. Das kommt mir etwas verfrüht vor, ist das schon stable?
#eveonline #python

#Python 3.15 #Lazy #Imports: Faster Startup Times and the Design Behind PEP 810

Zero days since I've discovered a random #CPython bug that triggers in very specific circumstances and I don't really have time to report it, nor can expect anyone to do it for me.
This time it's a test failure and refcounts being broken while running fastjsonschema's test suite on #Python 3.15 freethreading with pytest's --junit-xml option enabled 😱. And of course removing --junit-xml makes all tests pass.
EDIT: and of course I cannot reproduce outside Portage. Yet inside, it reliably crashes every single time.

#Steady #Klimacrew
#BahnMonitor-Projekt: 7. Zufall ist nicht gleich Zufall. 🤭
Nach der Verspätungsmeldung kommt ein Wissenshäppchen. Der

Python-Projekt mit Bahn-API: 7. JSON-Wissenshäppchen: Zufall clever gemacht
So ergänzt dein Python-Bot Mastodon-Posts mit JSON-Wissenshäppchen – zufällig ausgewählt und fair rotiert.

speaking of slophub, here's environ-config 26.1.0 (my #Python take on loading config from env variables and secrets from safe places) a minor modernization update. thanks so much to every single name in the thanking section and to github who made it possible:

Release 26.1.0 · hynek/environ-config
Highlights Mostly packaging, small bugs, and docs updates. Only heads-up is that the created classes are now using attrs's NG-style ones with subtly different defaults. Full changelog below! Specia...

📊 Requires #NodeJS 20 , #Python 3.11 with PyYAML and Bash 4.3 . Expected trade-off is about 3x the time and 2x the tokens. MIT licensed
🌐 https://

A cool recent #Python change is PEP 783 <#pyodide

Taking Measure spoke to Guido van Rossum to find out more about #Python, what he gets up to in his spare time, and his brief spell at #nist

The Programming Language Named for Monty Python Evolved at NIST
The creator of the popular programming language Python worked at NIST while developing it.

#Steady #Klimacrew
#BahnMonitor-Projekt: 5. Automatisierte Skripte brauchen Kontrolle – besonders bei API-Aufrufen.
Jetzt bekommt das

Python-Projekt mit Bahn-API: 5. Fehlerprotokollierung und Logfile
So richtest du Logging in deinem Python-Projekt ein: UTF-8-Logfile, CSV-Struktur, automatische Dateierstellung inklusive.

It's 2026 and :python: #Python's standard library *still* does not have a flatten function? 🤨
(Yes, more-itertools, that's not the point)

TIL " #Python, for example, is a popular programming language that is famously smooth at handling integers of any size. If you peek into Python's underlying source code (search “Karatsuba” here)"

Mathematicians still don’t know the fastest way to multiply numbers
A 23-year-old student overturned an ancient conjecture about one of math’s simplest operations

My bike riding has been poor this year, due to spinal stenosis and then spinal surgery in June... but hopefully the numbers will go up for the rest of the year.
(And who knows? Maybe I'll update some of the Python code that generates these.)
#bikeTooter #python

What are we using to package up Python application & dependencies into a single distributable file now?
I'm thinking of bundlers like RollupJS.
PEX? Zipapp? Docker image? Trying really dang hard to only use stdlib and shipping a boring wheel?
#python #packaging #askfedi

Happy/nervous to announce argon2-cffi-bindings, the low-level C binding wheels used by argon2-cffi the best package for hashing passwords in #Python.
It's a big release with wheels for new platforms, but the biggest item is the liberation from setuptools with great help by Nathan Goldbaum & @…

Release 26.1.0 · hynek/argon2-cffi-bindings
Highlights Big and scary release! We've switched from setuptools to scikit-build-core and added wheels for pyemscripten and (provisionally) RISC-V. Full changelog below! Special Thanks This release...

🎯 #Caddy on the VPS handles HTTPS with on-demand TLS. Certificates are auto-provisioned per subdomain, with a #ZeroSSL fallback when Let's Encrypt hits its 50-certs-per-week rate limit.
🔧 A small #Python

#Python #uv users on #Debian: I've been using this setup:
apt install extrepo
extrepo enable uv
apt install uv
That worked perfectly for all local users using standard Debian package management …

Holy cow, remember to clean your #uv cache from time to time, folks 😅
UPDATE: Seems to contain some links, deleting the cache only freed like 9GiB, but still...
#Python

for no particular reason whatsoever, I've updated my guide on how to measure #Python coverage across GitHub Action containers without an external service (*cough* Codecov *cough*)
https://hynek.me/articles/ditch-codeco

How to Ditch Codecov for Python Projects
Codecov’s unreliability breaking CI on my open source projects has been a constant source of frustration for me for years. I have found a way to enforce coverage over a whole GitHub Actions build matrix that doesn’t rely on third-party services.

The BBQ for all the Python user groups in Berlin is in a week’s time. I’m already looking forward to meeting lots of Pythonistas: https://www.meetup.com/python-users-berlin-pub/events/314905083/

Python in Berlin BBQ @ c-base, Thu, Aug 13, 2026, 7:00 PM | Meetup
Normally we announce our talks here, but this time we are taking a short summer break and therefore invite you to a barbecue at the Spree. The BBQ is for all Berlin Python

I wish #mypy would slow down with adding new features to mypyc, and instead focused on fixing the train wreck that mypyc is right now (since 2023 at least). Like, if your code crashes hard with assertions enabled, then it's broken, period. Ignoring proper testing and shoving the issue under the carpet doesn't make it right.
#Python

So virtualenv solves the issue of brutal incompatibilities between python stuff (at the cost of huge amounts of diskspace), but the minute uwsgi comes into play, it is overboard and there is hardly any way to activate plugins for old python interpreters. #pythonwoes

📆 On 13 August, all #Berlin #Python user groups – @…, @…

Python in Berlin BBQ @ c-base, Thu, Aug 13, 2026, 7:00 PM | Meetup
Normally we announce our talks here, but this time we are taking a short summer break and therefore invite you to a barbecue at the Spree. The BBQ is for all Berlin Python

In the meantime, #GitPython, the package that used to be dead (because the author is busily working on their next great thing) is now slopping out 4 "security" releases a week, as their #slop machine is busily fixing unintended variable expansion in every single URL they call. Unfortunately, they probably don't have enough tokens to fix them all at once, so instead all downstreams have to deal with the churn of endless security releases. Or the brain to figure out that maybe they could just disable variable expansion by default and solve them all at once.
It's truly a great time to be a #Python packager.
#NoAI #NoLLM

Vulnerability and malware checks in #uv
#python

Who thought it was a good idea to put spinners in a shell script?
`pip install` has been running for a few minutes now at 100% CPU and all progress I see is an effing spinner on the last line.
Had to look at process list to see it's not stuck.
#python #pip

🔧 The backend is #Python-based on top of #pipecat, the UI is #TypeScript. The architecture is modular so components can be swapped, and

I’m somewhat embarrassed to finally announce svcs 26.1.0 – my solution to #Python service location and dependency injection.
It’s been a minute, and the changelog is chuck-full, but the main features are autowiring, which looked like a simple add-on that grew to a four-digit monster diff, and of course, TypeForms that allow registering/getting abstract types!

Release 26.1.0 · hynek/svcs
Highlights In the spirit of "we do these things not because they are easy, but because we thought they were going to be easy" this release brings a great new feature: autowiring! It resolves depend...

0 days since provenance checks protected us from [checks notes] another project starting to upload distributions via #uv.
#Python #security

Does anyone happen to know if #PSF is processing contributing membership applications? Mine is stuck with no reply for almost 2 months now, and I'm wondering if it's just normal delay or something went wrong.
#Python

The state of #Python ecosystem right now: almost everything is slop. Some projects are complete vibe-coded slop (autobahn, chardet, cryptography). Some projects are disguised slop ("Coding agents shouldn't co-author themselves.")
There is only a handful of human projects left (Flask being one bright example). And they're being killed. They're being killed by the neverending slew of slop pull requests. They're being killed by all their dependencies becoming slop. They're being killed because this whole ecosystem has became such a complete cesspit that you have zero motivation to do anything.
EDIT: and honestly, this is only going to get worse. When you kill the incentive to work on projects, you only get more slop. Maintainers give in, and more projects become slop. Or they give up, and projects get forked unto slop.
#NoAI #NoLLM

Are you really expected to run five type-checkers now?
#python

Zero days since I've named my variable `os`, in #Python.

I’d like to announce the most unlikely #Python package release:
service-identity 26.1.0, the best way to verify if a certificate is valid for a hostname, IP, or URI is out!
The main change is that we were able to switch from pyasn1 (thank you for more than a decade of great service! 🫡💛) to do everything within PyCA's cryptography.

Release 26.1.0 · pyca/service-identity
Highlights The true highlight is that thanks to cryptography 47, we can drop two dependencies (that have served use very well for more than a decade; thank you so much pyasn1 maintainers!). Full c...

🧩 Rich plugin ecosystem: hundreds of plugins run tasks anywhere — local, SSH, #Docker, #Kubernetes or serverless task runners — and code in any language including #Python, Node.js, R, Go and S…

The conclusion from a big #Python 3.15 #Gentoo porting run today: the most common kind of #NIH Python package is one providing colorful output on the terminal…

I have a #Python favor to ask. Could someone look at Python 3.15 test failures in itsdangerous? It's blocking quite a large part of package dependency graph in #Gentoo, and the failure looks, errr, dangerous.
https://github.com/pallets/itsdangerous/issues/420

It's always important to have a consistent #security policy.
For example, a policy of "If somebody filed a CVE, it's an important security issue, and we will fix it as such, no matter how meaningless the fix is. If nobody did, it's just a glorified bug fix, no matter how serious the bug was."
So we've just seen a #pip security release over "installing random packages can overwrite pip's files and pip can lazy-import some of them immediately afterwards", with a fix of "pip will no longer load them until you run it again" (leaving the underlying security issue of "any #Python package can override files installed by any other Python package" as intended behavior). As Eli Schwartz beautifully put it, you are not expected to be using the virtual environment; you should create it, install packages into it (at most once!), and then frame it and put it on the wall to admire.
Now we're seeing a "bug fix" for "malicious entry point names can write outside of virtual environment". If nobody filed a CVE, it's obviously not a security issue at all. At least upstream graced us with fixing it without correcting the spec to forbid that first.
https://github.com/pypa/pip/issues/14000

Are you really expected to run five type-checkers now?
#python

#Python Hypothesis package now requires #RustLang. This is a scale of reverse dependencies I can't handle. I guess this means it's the end of WD40 profiles on #Gentoo, and therefore the end of support for Alpha, ARM<v6, HPPA, M68k, i486 and some other random subsets of architectures and profiles. Thanks for all the fish, etc.
https://github.com/HypothesisWorks/hypothesis/issues/4740

And the next big blocker for #Python 3.15 in #Gentoo is time-machine. Which is obviously broken. There's a patch but it's #slop and complex, and it's sitting for 3 months already with no reply. Because obviously patching CPython internals is so much a better idea than freezegun ever were. All these time-based tests need all the ricing you can get; portability doesn't matter.
https://github.com/adamchainz/time-machine/pull/618

Source distributions that are significantly different than the git repository shouldn't surprise anyone anymore either.
#Python #packaging

The #Gentoo #Python 3.14 switch / 3.11 3.13t removal PR is green. Doing some final testing locally before merging it (one that involves 350 "merge wait" packages, what could possibly go wrong…).
https://codeberg.org/gentoo/gentoo/pulls/1031

> No significant changes.
Looks inside.
> Significant changes.
#Python

0 days since we went from "we should replace `setup.py` with a bunch of standardized #PEP517 backends" to "every package must have its own local PEP517 backend".
#Python

#PSA to #Gentoo users: Please don't upgrade to #CPython 3.14.0b4, that release is borked and causes segfaults in random packages. I've just pushed a mask but warning in case you hit the upgrade before it reaches you. We'll investigate when we have more time.
#Python

So I wanted to unbundle #uChardet from #cChardet #Python package.
It didn't build against system uchardet 0.0.8. So I've checked, and it turns out cchardet is using some old patched fork of uchardet. Ugh.
Fortunately, upstream added the "missing" function too, with a different API (that's not really a problem), but they didn't make a release in 4 years. Ugh.
I could at least replace the old patched uchardet with upstream uchardet, right? Except now I'm getting test failures over misdetected encodings. 0.0.8 works fine there. Though the particular test doesn't look very realistic (note all the repetitions):
#Gentoo

Remember `build-details.json` (PEP 739)? The file added to #CPython to support cross-compiling extensions?
Well, turns out it gets generated incorrectly when cross-compiling CPython itself 🤦. Let's see if I can fix that…
#Python

So if you're wondering how great #RustLang is, let's talk about #mypy. Mypy introduced its own Rust - #Python package, ast-serialize. This package had a deep crate dependency that was broken on PowerPC. The issue was fixed a month ago but everything is still blocked on a deep chain of dependencies being updated and released.
https://github.com/mypyc/ast_serialize/issues/68
EDIT: yes, I know, it's not Rust, it's Cargo. Because obviously Rust without Cargo makes so much sense for that one project using it.

Well, we've finally packaged #Valkey (another #Redis fork) in #Gentoo, along with its #Python bindings.
Not that we wanted to, but #FakeRedis now started requiring it for tests so heavily that it was too much effort to patch it out. Just to be clear, it just requires the Python bindings, because its test suite happily runs against either Redis or Valkey, and literally doesn't support testing against both simultaneously. But to add the bindings, we needed the database to test them against. And since I've added the package too, I've put a lot of effort (and swearing) to test FakeRedis against both servers.
Should you be using Valkey? Well, let's put it like this. You shouldn't be using Redis, because it's enterprise quality shit. Valkey is roughly what happens when you fork enterprise quality shit and have no clue what you're doing. Though you are able to mostly get renaming right (one valkey-py test failed over the server calling itself "Valkey" rather than "Redis").
Disclaimer: I've only looked at the Python bindings. Maybe the maintainers are more knowledgeable with the server itself.

Me after laboriously backporting #Python 3.15 fixes to #Django 6.0.x in #Gentoo: "oh, nice, the patchset applies cleanly to 5.2.x as well."
And today, I have to laboriously backport another patch to 6.0.x, and it turns out the backport doesn't apply cleanly to 5.2.x, so I have to laboriously backport it there as well.
I honestly *hate* Django Python version support policy. Shifting all the burden downstream.

Anything great morning.
So now #Typer, the NIH #Python CLI library, decided to start bundling #Click. Why? Of course there's a lot of marketing bullshit behind it. Which ofc means they just don't want to be bothered about following the API, and take the easy way out.
Honestly, there is not a single week when I learn to hate Python even more. Slop-driven development.
EDIT: and ofc they immediately broke compatibility with vanilla click.
#Gentoo

Today in things that couldn't have aged well:
"Unpin flit-core dependency" 2 years ago without actually updating the metadata to use the newer pyproject.toml format.
#Python #flit

Fun fact: #Azure Pipelines don't support #YAML files with anchors/aliases.
Also fun fact: both #PyYAML and #RuamelYAML *insist* on emitting anchors/aliases, and at least the PyYAML authors seem pretty, errr, opinionated on emitting them.
#Python

Zero days since the #Python feedparser library switched to yet another #SGMLlib fork.
Yes, #Gentoo has only packaged the previous SGMLlib fork because of them.

#Python #pip: so, we have a bunch of `--no-*` options. You can also enable them via a configuration file. Some of them need to be assigned `true` to be enabled, while others need to be assigned `false` instead 🤡.
#UX

Zero days since #pip added a random new functionality that depends on pip being entirely standalone and breaks when you unbundle the dependencies. And I'm unable to figure out why a bunch of tests are still failing.
EDIT: I'd appreciate some help with that. My WIP is at #Gentoo #Python

Zero days since someone added a custom #PEP517 backend on top of #setuptools, and screwed up.
#Python #packaging