Engineering notes from Bernát Gábor — PyPA maintainer of tox, virtualenv, pipx, filelock, and platformdirs. Python packaging, type hints, and supply chain security.
<p>A <a href='https://nownownow.com/about' target='_blank' rel='noopener noreferrer'>now page</a> : what has my attention this month. Last updated 2026-07-10.</p> <h2 id='building'> Building <a class='heading-link' href='#building'> <i class='fa-solid fa-link' aria-hidden='true' title='Link to heading'></i> <span class='sr-only'>Link to heading</span> </a> </h2> <ul> <li><a…
<p>Python’s <code>html.escape</code> can scan one string five times. Moving those loops into C removes the interpreter from the hot path, which explains part of a 22x result on prose. Most prose contains nothing to escape. turbohtml gets the rest of the speedup by proving that sixteen bytes need no work, then moving past them in one step.</p> <p>I began with a small accelerator for <a…
<div class='alert alert-info'> <p class='alert-title'><i class='fa-solid fa-circle-info' aria-hidden='true'></i> TLDR:</p> <ul> <li><a href='#why-multithreaded-python-tests-are-flaky'><strong>The problem</strong></a> : testing multithreaded code is hard because the OS scheduler decides which thread runs when, making race conditions all but impossible to reproduce in a test suite.</li> <li><a…
<p>The <a href='https://us.pycon.org/2026/events/packaging-summit/' target='_blank' rel='noopener noreferrer'>PyCon US 2026 Packaging Summit</a> ran Friday May 15, 2026, from 1:45 PM to 5:45 PM in Room 201A of the Long Beach Convention Center. Three talks, nine lightning talks, six roundtable discussions. Organized by <a href='https://pradyunsg.me/' target='_blank' rel='noopener…
<p>The <a href='https://us.pycon.org/2026/events/typing-summit/' target='_blank' rel='noopener noreferrer'>PyCon US 2026 Typing Summit</a> ran Thursday May 14, 2026, from 1 PM to 5 PM in Room 201A of the Long Beach Convention Center, the day before the main conference started. Eight talks plus a Typing Council Q&A, single track. This recap is for anyone who could not be in the room.</p> <div…
<p><a href='https://www.pytexas.org/' target='_blank' rel='noopener noreferrer'>PyTexas</a> is the annual Python conference held in Austin, Texas. The 2026 edition ran April 17–19 at the <a href='https://library.austintexas.gov/central-library' target='_blank' rel='noopener noreferrer'>Austin Central Library</a> in downtown Austin.</p> <div class='alert alert-info'> <p class='alert-title'><i…
<div class='alert alert-info'> <p class='alert-title'><i class='fa-solid fa-circle-info' aria-hidden='true'></i> TLDR:</p> <p>Layer your defenses and do not trust any single control. Use Ruff with security rules to catch bugs in your code before they ship. Pin all your dependencies with cryptographic hashes using <code>uv lock</code> or <code>uv pip compile --generate-hashes</code> so nobody can…
<p>The <a href='https://en.wikipedia.org/wiki/Don%27t_repeat_yourself' target='_blank' rel='noopener noreferrer'>DRY principle</a> (an acronym for don’t repeat yourself) encourages software engineers to abstract code into a separate component and reuse it rather than write it over and over again. If this happens across the system, the best practice is to put it inside a package that lives on…
<p>In my previous two posts, I’ve gone over [what package types python has](https://bernat.tech/posts/pep-517-and-python-packaging/), and [how the package building works](https://bernat.tech/posts/pep-517-518/), especially with the introduction of the PEP-517/518. Although the changes were meant to make things more robust, we did run into a few issues while implementing and releasing them.…
<p>Have you ever wondered what happens when you run pip install? This post gives a detailed overview of the steps involved in the past, and how it all changes with the adoption of PEP-517 and PEP-518.</p> <p>[In my previous post](https://bernat.tech/posts/pep-517-and-python-packaging/) I’ve described how it’s possible to install three types of content: source tree, source distribution,…
<p>pip 19.0 has been released on 22nd January 2019. On the feature list, most notably, it now supports PEP-517, which by default is turned <strong>on</strong> when that the project has a <code>pyproject.toml</code> at the root folder. The PEP in question has been created in 2015 and accepted in 2017. Even though it took a while until pip implemented it, the release and the issues that followed…
<p>One of the main selling points for Python is that it is dynamically-typed. There is no plan to change this. Nevertheless, in September 2014 <a href='https://twitter.com/gvanrossum' target='_blank' rel='noopener noreferrer'>Guido van Rossum</a> (Python <a href='https://en.wikipedia.org/wiki/Benevolent_dictator_for_life' target='_blank' rel='noopener noreferrer'>BDFL</a> ) created a python…
<p>The <a href='https://en.wikipedia.org/wiki/Open_source' target='_blank' rel='noopener noreferrer'>open-source</a> projects I maintain and, in most cases, authored. A little more <a href='/'>about me</a> is on the home page.</p> <button class='ci-toggle' id='ci-toggle-btn'>Toggle CI view</button> <script defer…
<p>I’m a regular speaker at (Python) conferences. Here you’ll find a list of my recorded talks. You can also find a <a href='https://www.youtube.com/playlist?list=PLYWe9Aw9Owsod3Orf-pDqABD--r7mlho7' target='_blank' rel='noopener noreferrer'>YouTube playlist</a> with all of them.</p> <nav class='toc'> <ul> <li><a href='#year-2025'>2025</a> <ul> <li><a…