Page de couverture de Python Bytes

Python Bytes

Python Bytes

Auteur(s): Michael Kennedy and Calvin Hendryx-Parker
Écouter gratuitement

À propos de cet audio
 Python Bytes is a weekly podcast hosted by Michael Kennedy and Calvin Hendryx-Parker. The show is a short discussion on the headlines and noteworthy news in the Python, developer, and data science space.Copyright 2016-2026 Politique
Épisodes
  • #504 Who turned the GIL back on?

    #504 Who turned the GIL back on?
    Nov 10 2026
    Topics covered in this episode: PyPI's redesigned project pages now warn when provenance changesgilguard catches the import that turns the GIL back onpip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safeAll developer toolsExtrasJokeWatch on YouTube About the show Sponsored by LongLink: Open-source platform for building and running custom business applications with Python and FastAPI Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: PyPI's redesigned project pages now warn when provenance changes Live now on pypi.org (Nov 6). Announced in July, shaped by user research, funded by OpenSSF and built by Kabu Creative.New Security tab on every project page shows each release's provenance state and per-file attestations, with a link to the transparency log.Two attestation types: PyPI Publish (uploaded by a Trusted Publisher) and SLSA Build Provenance (ties a file to its source commit, build platform and instructions)."No provenance" isn't a malware flag; it means the file's origin can't be cryptographically verified. That's typical for older releases or projects without Trusted Publishing.Four new provenance warnings: Incomplete (e.g. wheels via Trusted Publishing but sdist via API token), Inconsistent (mixed build systems or repos), Change (different repo or workflow than last release), Loss (stopped publishing attestations).Warnings are meant to catch files that may not have come from the maintainers, such as after an account or publishing-workflow takeover. PyPI says a Change of Provenance "can also indicate a compromised pipeline or account takeover," and an unexpected Loss of Provenance should be treated "with skepticism until verified.”Warnings now sit at the top of the page with yanked, archived and pre-release banners. A quarantine banner overrides all of them. Sidebar metadata is labeled "PyPI data" or "Data verified by PyPI."Release files tab gets search, filters, a per-file provenance column and orange icons for "late" files (uploaded more than 14 days after release). Those only appear on releases from before July 2026, when PyPI started rejecting new files after 14 days. Michael #2: gilguard catches the import that turns the GIL back on gilguard catches a nasty free-threading surprise: importing a C extension without declared free-threading support can turn the GIL back on for the rest of the process. Import gilguard first and it raises a detailed error naming the extension, distribution/version, import chain, and the line of your code responsible. A transitive dependency can undo your move to free-threaded Python. Fail at the offending import instead of discovering lost parallelism in a benchmark.Uses import hooks plus CPython's warning path to catch GIL activation; GILEnabledError inherits BaseException, so even except Exception won't swallow it.python -m gilguard audits installed top-level packages in fresh interpreters. Supports targeted modules and JSON output; exits 1 when it finds an offender for CI.The audit misses extensions loaded lazily on first use. Exercise those paths in tests with gilguard installed early; one process can identify only its first GIL-flipping import.GILGUARD_ACTION=warn reports without stopping; off permits standard builds. Default mode raises on standard Python or an already-enabled GIL. PYTHON_GIL=0 prevents activation, so the guard cannot detect offenders there.Published on PyPI as 0.1.0. Install with uv pip install gilguard. Python 3.13+, MIT; no runtime dependencies. Calvin #3: pip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safe pip 26.3 released Nov 2. Its security policy now says pip "has never considered installing untrusted wheels safe," because Python's import system is dynamic, so pip can't guarantee installing a wheel won't execute third-party code (#14412).The change: pip blocks unexpected imports during wheel installation "to avoid loading code from packages being replaced." It loads what it needs for installing and error reporting up front (PR #14247, merged Nov 2: https://github.com/pypa/pip/pull/14247).CLI vs. library use: from the command line, imports stay blocked until pip exits. Code that calls pip programmatically gets warnings after control returns.Rolled out in steps: pip 26.1 started warning ("Unexpected import of '...' after pip install started. pip 26.3 will enforce this behavior change"), and 26.3 turns it into an error. Tracking issue #13842 collected reports before enforcement: https://github.com/pypa/pip/issues/13842What tripped it in the wild: a .pth startup hook at ...
    Voir plus Voir moins
    30 min
  • #503 It’s not 85% HTML

    #503 It’s not 85% HTML
    Nov 3 2026
    Topics covered in this episode: Your GitHub language bar is lying (how to fix it)Python Typing Survey 2026: developers mix type checkers, and AI is writing the hintsFlask Vibe - Build Apps You Can UnderstandPython on my wrist: MicroPython on a PineTimeExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hostsMichael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Your GitHub language bar is lying (how to fix it) GitHub's language bar comes from Linguist, which counts every tracked byte in the repo. Michael's chameleon-rs project read as 75.5% HTML because committed docs-site output and test suites outweighed the Rust engine. Three .gitattributes attributes changed the story: linguist-generated for build output, linguist-vendored for an upstream test suite, and linguist-detectable=false for tests and benchmarks on both sides. The bar now shows the real mix, roughly 62% Rust and 38% Python. That bar is one of the first things people see on your repo; if generated files skew it, a few lines of .gitattributes tell the truth.The bar is byte-proportional, so a 9 MB committed docs build can make a Rust project read as mostly HTMLlinguist-generated hides build output and collapses those diffs in pull requests toolinguist-vendored covers copied-in code; linguist-detectable=false drops anything from the statschameleon-rs went from 75.5% HTML to roughly 62% Rust and 38% Python after a few lines of configTests and benchmarks were excluded symmetrically, on both the Rust and Python sides, so neither skews the ratioCheck patterns before pushing with git check-attr; GitHub recalculates a few minutes after the push Calvin #2: Python Typing Survey 2026: developers mix type checkers, and AI is writing the hints Meta's 2026 Python Typing Survey results: 1,794 responses, Aug 5 - Sep 2. Pyrefly (Meta), JetBrains, Microsoft and Astral's ty team helped write it.Typing is stable: 85.5% use hints often or always (88.0% in 2024). Which checker people use is not stable.49.9% run two or more checkers (46.0% in 2025), and 83.3% of Pyrefly users also run another one. Speed is the top reason for picking a checker (56.5%).Checkers disagree: 33.3% report inconsistencies between them, rising to 42.7% among multi-checker users.AI is writing the types: 42.5% had AI write hints, and 38.4% say types make AI code more reliable (18.5% last year).29.8% are "not sure" whether types help AI-assisted coding, about 4x the uncertainty on any other benefit.Help sources flipped: Stack Overflow 46.4% to 22.9% and LLM chat 26.0% to 41.7%, 2024 to 2026.Top pain is still missing library types (65.1%; Django, SQLAlchemy, pandas, NumPy). The most-wanted feature is better Callable syntax (45.7%). Raw data zip is linked. Michael #3: Flask Vibe - Build Apps You Can Understand Flask Vibe is a new tutorial site from Frederick Tubiermont, a developer who started coding at 47 and builds with Flask, PostgreSQL, raw SQL, and vanilla JS. The pitch: AI assistants generate more reliable, easier-to-verify code when the stack has no build step, no ORM, and no hydration. It ships a manifesto, tutorials on modular vanilla JS and AI-friendly coding patterns, and a Flask plus psycopg2 CRUD walkthrough. For vibe coders burned by Next.js defaults on Lovable or Replit, this is a concrete, opinionated case that simpler Python stacks pair better with AI-generated code.Claims a structural 1.8x LCP win over Next.js on the same dashboard app: 905ms vs 1.66s, both scoring Lighthouse 100Tutorials cover modular vanilla JS, AI-friendly coding patterns, and Flask CRUD with raw psycopg2 SQL and no ORMCreator started Python at 47 in 2022 and runs the site on the stack it teaches; the homepage is 42 KB with Lighthouse 100Solo London-based project (adsyme Ltd), launched via an r/flask self-post in February 2026; early, opinionated, and the benchmark leans on one self-run comparison with its methodology published on site Calvin #4: Python on my wrist: MicroPython on a PineTime Michiel (Python Leiden user group) runs MicroPython on a PineTime, Pine64's ~$26 open smartwatch: 64 MHz Cortex-M4, 64 KB RAM, 512 KB flash.He revived wasp-os, a dormant MicroPython watch OS stuck on a 2019 MicroPython fork whose maintainer is asking for new maintainers (issue #536).The build is now one command with uv. Bluetooth flashing uses bleak instead of the deprecated gatttool, cutting update time from over 8 minutes to about 3.5.Free RAM at boot went from 7.1 KB to 12.4 KB by using the flash chip's real 4 KB blocks. He also ...
    Voir plus Voir moins
    30 min
  • #502 Introducing chameleon-rs

    #502 Introducing chameleon-rs
    Oct 27 2026
    Topics covered in this episode: PHP wasn’t the only problem last weekchameleon-rsBringing uv and ty togetherStlite runs Streamlit apps entirely in the browserExtrasJokeWatch on YouTube About the show Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: PHP wasn’t the only problem last week Three security incidents in one week, each at a different layer: CA trust (eMudhra), the release pipeline (LiteLLM) and a C decoder (Brotli). All three have fixes released.eMudhra CA: the keys of a compromised eMudhra intermediate CA are now distrusted by CPython. 3.15.1, 3.14.9 and 3.13.17 shipped Oct 21. 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 followed Oct 26 (CVE-2026-115557) and also fix a tarfile filter bypass. Python's post says pip operations are safe even before pip is upgraded.eMudhra, tooling: pip 26.2.2 bundles certifi 2026.10.19, which removes the root. uv 0.13.4 (GHSA-hq85-5cpj-mr62) and 0.13.5 (rustls-webpki 0.103.16) are the uv fixes. After upgrading uv, run uv python upgrade. Existing venvs need pip upgraded by hand, and the 3.9 and 3.10 builds still bundle a pip that trusts the root. Anyone holding those intermediate keys can mint certificates for any domain that an unpatched client will accept as valid.That enables man-in-the-middle attacks: reading or altering HTTPS traffic without a certificate warning.The risk is highest where the attacker can sit on the network path, such as hostile Wi-Fi, a compromised router or ISP, or a cloud network position.For Python specifically, the exposed traffic would be package downloads from PyPI, API calls with credentials or tokens, and webhooks. A tampered package download is the worst case.Containers and old venvs that nobody rebuilds are where this lingers. uv says its Python 3.9 and 3.10 builds still bundle a pip that trusts the root, and existing venvs don't pick up the fix automatically.LiteLLM 1.107.0: malicious wheels hit PyPI on Oct 21. All seven wheels were live from about 11:40 to 13:23 UTC, with roughly 49k downloads. The Docker images were also infected. It's the second LiteLLM compromise this year, after 1.82.7 and 1.82.8 in March.LiteLLM payload: cook.pth runs on every Python start, so nothing has to import litellm. It steals SSH, cloud, browser, CI and AI-tool credentials, and an hourly loader runs remote code. The clean pin is litellm==1.106.4. Kill the loader first, rebuild rather than repair, then rotate everything the host could reach.LiteLLM root cause: a master key committed to a public repo on May 27 was never revoked. On Oct 10 it yielded an org owner's GitHub CLI token. The attacker then changed the trusted release workflow to build from a lookalike Berri-AI/litellm repo. BerriAI's first explanation (tokens in logs) was wrong, and the Oct 23 report supersedes it.Broccoli2Shell: CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder. It affects the Python Brotli and brotlicffi packages 1.0.3 through 1.2.0(.x). Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0. The CVE was published Oct 22 and rated 9.2 Critical by GitHub.Broccoli2Shell workaround: if you can't upgrade, uninstall both packages. urllib3, requests and aiohttp then fall back to gzip and deflate. Also reject Content-Encoding: br request bodies at the proxy or WAF. Sourceshttps://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealerhttps://broccoli2shell.com/ Michael #2: chameleon-rs Chameleon templates, much faster than before (up to 70x faster on start)Modernized: A Rust engine that runs your Chameleon templates unchanged with async rendering, partials (think HTMX), MarkdownBuilt-in framework support: Flask, Quart, FastAPI, Starlette, Pyramid, Robyn and Litestar integrations.A compatibility shim for testing out quickly: chameleon_rs.compat.install()AI agent support via docs (every doc page has a .md extension variant, eg FastAPI docs) and the skill is installable or downloadable.Byte-for-byte identical on every page for talkpython.fm and training.talkpython.fmPasses 100% of the unit tests of the original chameleon project. See compatibility page.Natively supports my chameleon-flask, fastapi-chameleon, and chameleon-partials libraries.Swapping Talk Python Training to chameleon-rs made it 20% fast (end-to-end, not just template rendering)! Calvin #3: Bringing uv and ty together Status: Astral (Sara Sklenka, Oct 13) announced "an experimental integration between uv and ty, available in preview." They ask for feedback, and say "in parallel, we're ...
    Voir plus Voir moins
    34 min
adbl_web_anon_alc_button_suppression_t1
Pas encore de commentaire