Topics covered in this episode:
The Basics of Python Packaging in Early 2023
vecs
Introducing Grasshopper - An Open Source Python Library for Load Testing
memocast
Extras
Joke
See the full show notes for this episode on the website at pythonbytes.fm/338
Topics covered in this episode:
PyPI's redesigned project pages now warn when provenance changes
gilguard catches the import that turns the GIL back on
pip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safe
All developer tools
Extras
Joke
Watch on YouTube
About the show
Sponsored by LongLink: Open-source platform for building and running custom business applications with Python and FastAPI
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Calvin #1: PyPI's redesigned project pages now warn when provenance changes
Live now on pypi.org (Nov 6). Announced in July, shaped by user research, funded by OpenSSF and built by Kabu Creative.
New Security tab on every project page shows each release's provenance state and per-file attestations, with a link to the transparency log.
Two attestation types: PyPI Publish (uploaded by a Trusted Publisher) and SLSA Build Provenance (ties a file to its source commit, build platform and instructions).
"No provenance" isn't a malware flag; it means the file's origin can't be cryptographically verified. That's typical for older releases or projects without Trusted Publishing.
Four new provenance warnings: Incomplete (e.g. wheels via Trusted Publishing but sdist via API token), Inconsistent (mixed build systems or repos), Change (different repo or workflow than last release), Loss (stopped publishing attestations).
Warnings are meant to catch files that may not have come from the maintainers, such as after an account or publishing-workflow takeover. PyPI says a Change of Provenance "can also indicate a compr...
Topics covered in this episode:
Your GitHub language bar is lying (how to fix it)
Python Typing Survey 2026: developers mix type checkers, and AI is writing the hints
Flask Vibe - Build Apps You Can Understand
Python on my wrist: MicroPython on a PineTime
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: Your GitHub language bar is lying (how to fix it)
GitHub's language bar comes from Linguist, which counts every tracked byte in the repo. Michael's chameleon-rs project read as 75.5% HTML because committed docs-site output and test suites outweighed the Rust engine. Three .gitattributes attributes changed the story: linguist-generated for build output, linguist-vendored for an upstream test suite, and linguist-detectable=false for tests and benchmarks on both sides. The bar now shows the real mix, roughly 62% Rust and 38% Python.
That bar is one of the first things people see on your repo; if generated files skew it, a few lines of .gitattributes tell the truth.
The bar is byte-proportional, so a 9 MB committed docs build can make a Rust project read as mostly HTML
linguist-generated hides build output and collapses those diffs in pull requests too
linguist-vendored covers copied-in code; linguist-detectable=false drops anything from the stats
chameleon-rs went from 75.5% HTML to roughly 62% Rust and 38% Python after a few lines of config
Tests and benchmarks were excluded symmetrically, on both the Rust an...
Topics covered in this episode:
PHP wasn’t the only problem last week
chameleon-rs
Bringing uv and ty together
Stlite runs Streamlit apps entirely in the browser
Extras
Joke
Watch on YouTube
About the show
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Calvin #1: PHP wasn’t the only problem last week
Three security incidents in one week, each at a different layer: CA trust (eMudhra), the release pipeline (LiteLLM) and a C decoder (Brotli). All three have fixes released.
eMudhra CA: the keys of a compromised eMudhra intermediate CA are now distrusted by CPython. 3.15.1, 3.14.9 and 3.13.17 shipped Oct 21. 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 followed Oct 26 (CVE-2026-115557) and also fix a tarfile filter bypass. Python's post says pip operations are safe even before pip is upgraded.
eMudhra, tooling: pip 26.2.2 bundles certifi 2026.10.19, which removes the root. uv 0.13.4 (GHSA-hq85-5cpj-mr62) and 0.13.5 (rustls-webpki 0.103.16) are the uv fixes. After upgrading uv, run uv python upgrade. Existing venvs need pip upgraded by hand, and the 3.9 and 3.10 builds still bundle a pip that trusts the root.
Anyone holding those intermediate keys can mint certificates for any domain that an unpatched client will accept as valid.
That enables man-in-the-middle attacks: reading or altering HTTPS traffic without a certificate warning.
The risk is highest where the attacker can sit on the network path, such as hostile Wi-Fi, a compromised router or ISP, or a cloud network position.
For Python specifically, the exposed traffic would be package downloads from PyPI,...
Topics covered in this episode:
Nod: pause your Python program and open a notebook at any line
Polars 2.0 ships: streaming engine by default, spill-to-disk, and a row-order gotcha
django-cachalot caches your ORM queries and invalidates them for you
Towards async transactions in Django
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: Nod: pause your Python program and open a notebook at any line
Nod (Notebooks-on-Demand) is a JupyterLab extension by Eric Rawn that drops a notebook into a running Python program. Add a notebook() call anywhere, run the program with nod, and execution pauses there with a notebook containing all variables at that point in the call stack. Edits go back to the source file with a button, with cells converted to code and markdown to comments via Jupytext.
It answers the classic 'this would be easier in a notebook' debugging moment without copying snippets out to files.
Like a breakpoint with a notebook inside: the left panel walks the call stack and notebook state switches with it
Install is pip install nodpy plus nod --install-kernel, then run with nod python -m myfile
The round trip back to source is the differentiator; markdown cells become comments, cells become newlines, and notebooks are disposable since the source file recreates them
nodLog() stashes variable values across calls to explore later; the article also pitches notebook() for stepping through AI-generated code line...
Topics covered in this episode:
A quick chat with Brian looking back
Extras
Joke
Watch on YouTube
About the show
Brian #1: A quick chat with Brian looking back
Nick #2: Jev and the Case for Boring ML
Vincent Warmerdam from marimo benchmarked Jev, a new "System 1" decision model from TypeSafe AI. In his video It handles classification without the latency or token cost of generative LLMs, which raises a practical question for data teams: where does this fit alongside traditional machine learning?
He tested Jev against classical machine learning models to see if its speed and accuracy hold up on real-world datasets.
General LLMs work well for reasoning, but generating full token streams just to assign a category adds unnecessary latency and cloud cost.
Jev avoids generation entirely by evaluating the input and returning only the decision, which makes it much faster and cheaper than standard chat APIs.
It consistently outperformed eight-shot sentence transformer setups like SetFit out of the box, especially on datasets with dozens of target categories.
Traditional models like logistic regression still matter because they run in single-digit milliseconds on basic CPUs, cost nothing per inference, and keep private data within your own network.
You cannot fine-tune Jev directly, so standard models remain the better choice when your data contains internal company acronyms, product names, or domain slang.
The most practical approach is using Jev to bootstrap initial labels or audit bad training data, then training a small model you can own and run locally.
Brett #3: Announcing the 2026 Python Packaging Council Election Results!
The inaugural Python packaging council (PPC) has been elected and started meeting!
Introduced via PEP 772
5 members elected
Top 2 vote-getters get two-year terms
Other 3 get one-year terms
All members will get two-year terms going forward, staggering the elections
There have been 4 meetings far as well as a meeting with the SC...
This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.
