Recent content on Hugo van Kemenade
Like many other projects, CPython is experiencing a huge increase in security reports. CVEs per year # Last month, PSF Security Developer-in-Residence Seth Larson posted a chart of CVEs per year , showing a large increase in 2026: But this only represents the output of security work, and doesn’t show all the work dealing with incoming reports. Many are closed and dealt with as non-security…
Yes, but not the dict kind of dictionary. When working on CPython, we often find obscure bugs elsewhere, in compilers, operating systems and elsewhere: Rust/LLVM , clang-19 , clang 21 and BOLT GCC 13 , GCC 15 , glibc , readline and curses musl fma Since Python 3.8, the release notes have a section called “And now for something completely different”. These have included Monty Python…
I’m happy to rejoin the Sovereign Tech Fellowship ! I was one of six participants in the 2025 pilot to pay maintainers of critical open source technologies in the public interest. By all accounts this first cohort was a resounding success, and I’m glad to see the programme continue. It was wonderful to be part of the inaugural Sovereign Tech Fellowship, and incredibly beneficial to my…
gh triage spam # We get a lot of spam in the CPython project . A lot of it isn’t even slop , but mostly worthless “nothing” issues and PRs that barely fill in the issue template, or add a line of nonsense to some arbitrary file. They’re often from new accounts with usernames like: za9066559-wq quanghuynh10111-png riffocristobal579-cmd sajjad5giot satyamchoudhary1430-boop…
Tachyon # I tried out Tachyon , the new “high-frequency statistical sampling profiler” coming in Python 3.15 , to see if we can speed up the Pillow imaging library. I started with a simple script to open an image: import sys from PIL import Image im = Image . open ( f 'Tests/images/hopper. { sys . argv [ 1 ] } ' ) Then ran: $ python3.15 -m profiling.sampling run --flamegraph /tmp/1.py…
I gave a lightning talk at a bunch of conferences in 2025 about some of the exciting new things coming in Python 3.14 , including template strings . One thing we can use t-strings for is to prevent SQL injection. The user gives you an untrusted t-string, and you can sanitise it, before using it in a safer way. I illustrated this with xkcd 327 , titled “Exploits of a Mom”, but commonly…
The dateutil library is a popular and powerful Python library for dealing with dates and times. However, it still supports Python 2.7 by depending on the six compatibility shim , and I’d prefer not to install for Python 3.10 and higher. Here’s how I replaced three uses of its relativedelta in a couple of CLIs that didn’t really need to use it. One # norwegianblue was using it to…
Starting in 2019, Python 3.8 and 3.9 release manager Łukasz Langa added a new section to the release notes called “And now for something completely different” with a sketch transcript from Monty Python. For Python 3.10 and 3.11 , the next release manager Pablo Galindo Salgado continued the section but included astrophysics facts. For Python 3.12 , the next RM Thomas Wouters shared…
The Python Steering Council 2026 election results are in and congratulations to the new Python Steering Council! Barry Warsaw Donghee Na Pablo Galindo Salgado Savannah Ostrowski Thomas Wouters Welcome Savannah for the first time, and thank you to Greg Smith and Emily Morehouse for four and three years’ service each. Three are starting their sixth terms, and four members have been or are…
🗳️ Update: See the results ! The Python Steering Council election is on! This year six candidates are running for the five seats. See PEP 8107 for links to their nomination statements and PEP 13 for more on Python language governance. I made a chart to show when the nominations arrived during the nomination period: six is fewer than in previous years, but they didn’t all wait until the last…
Sometimes you need to set environment variables with secrets, API keys or tokens, but they can be susceptible to exfiltration by malware, as seen during the recent Shai-Hulud attack . For publishing to PyPI, it’s strongly recommended to use Trusted Publishing rather than managing long-lived tokens on your machine. For other credentials, here’s how you can set them as env vars with…
🐍🏃In September, the annual Python Core Sprint was hosted by Arm in Cambridge, UK! The plan: put 35 core developers and 13 special guests in a room for a week, and see what they cook up. Monday highlights # We kicked off the first day with a round of five-word intros (mine: “three”, “dot”, “fourteen”, “release”, “manager”), lots of…
PEP 810 proposes “explicit lazy imports” for Python 3.15: Lazy imports defer the loading and execution of a module until the first time the imported name is used, in contrast to ‘normal’ imports, which eagerly load and execute a module at the point of the import statement. By allowing developers to mark individual imports as lazy with explicit syntax, Python programs can reduce startup…
Prologue # I livetooted the release of Python 3.14.0. Here it is in blogpost form! One week # Only one week left until the release of Python 3.14.0 final ! What are you looking forward to? #Python #Python314 Tue, Sep 30, 2025, 15:19 EEST Three days # Three days until release and a bug in the Linux kernel has turned a dozen buildbots red… It’s already been fixed in the kernel, but will…
I’ve been using prek recently as a drop-in replacement for pre-commit . It uses uv for managing Python virtual environments and dependencies, is rewritten in Rust (because of course) and uses the same .pre-commit-config.yaml as pre-commit. Its homepage says it’s not yet production ready, but several projects like Apache Airflow and PDM are already using it. I’ve been using it for…
Some out-of-context quotes: “We can just bump the version and move on.” – Dr. Brett Cannon “You just show up. That’s it.” – Rodrigo Girão Serrão “If it kwargs like a dorg, it’s a dorg.” – Sebastián Ramírez “Our job will be to put the human in.” – Paul Everitt 20 July 2025 Is AI Leaving the Python Community Behind? by…
I recommend running coverage on your tests . Here’s a couple of reasons why, from the past couple of months. Example one # When writing tests, it’s common to copy and paste test functions, but sometimes you forget to rename the new one (see also: the Last Line Effect ). For example: def test_get_install_to_run_with_platform ( patched_installs ): i = installs . get_install_to_run (…
PEPs # Here’s Barry Warsaw on the origin of PEPs , or Python Enhancement Proposals (edited from PyBay 2017 ): I like backronyms. For those who don’t know: a backronym is where you come up with the acronym first and then you come up with the thing that the acronym stands for. And I like funny sounding words, like FLUFL was one of those. When we were working for CNRI, they also ran the…
Following Jeff Triplett’s lead , here’s a list of my most used terminal commands. No. Total Command Info 1. 1239 rg ripgrep 2. 1038 c aliased to pycharm 3. 847 gc aliased to git commit --verbose via Oh My Zsh Git plugin 4. 559 gco aliased to git checkout 5. 518 git 6. 384 ./python.exe Python built from source on macOS 7. 365 cd 8. 359 cat aliased to bat -p 9. 336 gs aliased to…
GitHub Actions now supports experimental free-threaded CPython! There are three ways to add it to your test matrix: actions/setup-python: t suffix actions/setup-uv: t suffix actions/setup-python: freethreaded variable actions/setup-python: t suffix # Using actions/setup-python , you can add the t suffix for Python versions 3.13 and higher: 3.13t and 3.14t . This is my preferred method, we can…
What? # PEP 639 defines a spec on how to document licences used in Python projects. Instead of using a Trove classifier such as “License :: OSI Approved :: BSD License”, which is imprecise (for example, which BSD licence ?), the SPDX licence expression syntax is used. How? # pyproject.toml # Change pyproject.toml as follows. I usually use Hatchling as a build backend, and support was…
For the duration of 2025, I’m thrilled to join the Sovereign Tech Fellowship for Maintainers ! This is a pilot programme from the Sovereign Tech Agency to pay maintainers of critical open source technologies in the public interest. I’m one of six participants in this first cohort and I’ll be working on Python, with a focus on CPython , including as release manager for Python 3.14…
Prologue # This was a Twitter thread from 15th January 2022 about my first CPython bug. Eight days from report to fix to merge, not bad! Delay # I helped delay the release of Python 3.11.0a4 ! But in a good way! 😇 Python 3.11 is due out in October, but they make early alpha, beta and release candidates available for people to help test Python itself and their own code before the big release. So I…
You can get download numbers for PyPI packages (or projects) from a Google BigQuery dataset . You need a Google account and credentials, and Google gives 1 TiB of free quota per month. Each month, I have automation to fetch the download numbers for the 8,000 most popular packages over the past 30 days, and make it available as more accessible JSON and CSV files at Top PyPI Packages . This data is…
We can use uv to make linting and testing on GitHub Actions around 1.5 times as fast. Linting # When using pre-commit for linting: name : Lint on : [ push, pull_request, workflow_dispatch] env : FORCE_COLOR : 1 permissions : contents : read jobs : lint : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 with : persist-credentials : false - uses : actions/setup-python@v5 with :…
🐍🏃The week before last was the annual Python Core Dev Sprint, graciously hosted by Meta in Bellevue, WA! The idea: bring a bunch of Python core team members, triagers, and special guests to the same room for a week. It’s hugely beneficial and productive, we held many in-depth discussions that just don’t happen when we’re all remote and async, and got to work on many different…
If you read just one, check Kati’s thorough recap ! 22nd May 2024 Echos of the People API user guide by Ned Batchelder 24th May 2024 Wagtailers spread their wings at PyCon 2024 by Meagen Voss (@vossisboss) Flet at PyCon US 2024 by Feodor Fitsner 27th May 2024 PyCon US 2024: My First PyCon in US 🫶🏻 by Tomy Hsieh 28th May 2024 PyCon 2024 Reflection by Trey Hunner Weeknotes: PyCon US 2024 by…
Calling all Python library maintainers! 🐍 The Python 3.13 beta is out! 🎉 PEP 719 defines the release schedule for Python 3.13.0: The first beta candidate came out on 8th May 2024 The first release candidate is set for 30th July 2024 And the full release is set for 1st October 2024 In his announcement , Thomas Wouters, release manager for Python 3.12 and 3.13, said: We strongly encourage…
Want to print out the PyCon US schedule? Paper doesn’t run out of batteries, is easy to scribble on, and stuff into a pocket (technical term: the affordances of paper ). Here’s some custom CSS and JavaScript to make it nicely printable. Install the Styler browser extension View a PyCon schedule page such as https://us.pycon.org/2024/schedule/talks/ and click the Styler…
Python 3.13 is due out in October 2024 and work is underway to implement experimental support for PEP 703 - Making the Global Interpreter Lock Optional in CPython . See also Free-threaded CPython in “What’s New in Python 3.13?” As the Steering Council noted in their acceptance of the PEP , to succeed it’s important to have community support. Projects will need to test their…
On the Python Developer’s Guide and Pillow documentation we have some pages with tabs for different operating systems: It’s possible to add some JavaScript so that the matching tab is activated based on the visitor’s operating system. Here’s how! Sphinx Inline Tabs # First add the Sphinx Inline Tabs extension to your docs' requirements.txt : # requirements.txt…
Here’s some tech style guides: Google developer documentation style guide Word list Microsoft Writing Style Guide Red Hat Technical Writing Style Guide Red Hat supplementary style guide for product documentation Bishop Fox Cybersecurity Style Guide PDF Apple Style Guide Python docs style guide Canonical Documentation Style Guide Canonical reStructuredText style guide And some other style…
Sometimes you have code you want to exclude from the test coverage report, because it doesn’t really make sense to test it. For example, maybe you want to exclude: if __name__ == '__main__' : main () The old advice was to add something like this to .coveragerc : [report] # Regexes for lines to exclude from consideration exclude_lines = # Have to re-enable the standard pragma: pragma: no…
Python 3.7 was first released on 2018-06-27 and recently reached end-of-life on 2023-06-27 ( PEP 537 ). This means it is no longer receiving security updates and you should upgrade to a newer version (at least 3.8, but preferably 3.11): Source: Python Developer's Guide However, if you look at download numbers from PyPI, 3.7 still accounts for a large share. 3.7 accounted for 25% of all downloads…
Calling all Python library maintainers! 🐍 The third and final Python 3.12 release candidate is out! 🎉 PEP 693 defines the release schedule for Python 3.12.0: The first release candidate came out on 6th August 2023 The second and final release candidate came out on 6th September 2023 The third and final release candidate came out on 19th September 2023 And the full release is set for 2nd October…
GitHub Actions has a useful feature to trigger workflows on a cron schedule. For example: name : Test on : push : pull_request : schedule : - cron : '0 6 * * *' # daily at 6am jobs : test : runs-on : ubuntu-latest steps : - uses : actions/checkout@v3 But if a contributor has enabled GitHub Actions on their fork (which I recommend: test your contributions before opening a PR), it also runs the cron…
Want to print out the PyCon US 2023 schedule? Paper doesn’t run out of batteries, is easy to scribble on, and stuff into a pocket. Here’s some custom CSS and JavaScript to make it nicely printable. Install the Styler browser extension View a PyCon schedule page such as https://us.pycon.org/2023/schedule/talks/ and click the Styler extension’s S icon Paste this CSS into the upper…
What I built # I built a Mastodon bot that posts a different bit of Pluto every six hours. Category Submission # Wacky Wildcard App Link # https://botsin.space/@bitsofpluto Screenshots # https://botsin.space/@bitsofpluto/109854013035140138 https://botsin.space/@bitsofpluto/109878078918934666 https://botsin.space/@bitsofpluto/109882325572738354 https://botsin.space/@bitsofpluto/109872416513104327…
Why? # Often Python core developers think about deprecating and removing old bits of the language. But first it’s a good idea to get an idea of how much the old bits are used. Searching the 5,000 most-popular projects on PyPI is a helpful proxy to gauge community use. How? # Core developer Victor Stinner has written a couple of useful scripts that live in his misc repo. Setup # First, clone…
Calling all Python library maintainers! 🐍 Python 3.11 is in beta! 🎉 PEP 664 defines the release schedule for Python 3.11.0: The second beta came out on 31st May 2022 The first release candidate is set for 1st August 2022 And the full release is set for 3rd October 2022 In his announcement , Pablo Galindo Salgado, release manager for Python 3.10 and 3.11, said: We strongly encourage maintainers…
Top PyPI Packages is a website that creates a monthly dump of the 5,000 most-downloaded packages from the Python Package Index (PyPI) . It provides a human-readable list and a machine-readable JSON file for programmatic use. How it’s used # The generated data is important for the Python community: it has been cited by many academic papers, covering research on topics such as software…
Or, a variation on the Norway problem # Short version: put quotes around version numbers in YAML. The Norway problem # The Norway problem is when you put this in YAML: countries : - GB - IE - FR - DE - NO But get this out: >>> import yaml >>> with open ( 'countries.yml' ) as f : ... yaml . safe_load ( f ) ... { 'countries' : [ 'GB' , 'IE' , 'FR' , 'DE' , False ]} :scream: The Norway fix # Use…
January 2016 — December 2019 # To celebrate the end of life of Python 2 on 1st January 2020 , here’s some statistics showing how much different Python versions have been used over four years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and December 2019: pip # The package installer six # Python 2 and 3 compatibility library NumPy #…
January 2016 — October 2019 # To celebrate the release of Python 3.8.0 on 14th October 2019 , and with less than two months left for Python 2 , here’s some statistics showing how much different Python versions have been used over nearly four years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and October 2019: pip # The package installer six…
January 2016 — March 2019 # To celebrate the release of Python 3.7.3 on 25th March 2019 , and with under nine months left for Python 2 , here’s some statistics showing how much different Python versions have been used over the past three years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and March 2019: pip # The package installer six #…
January 2016 — December 2018 # To celebrate the release of Python 3.7.2 on Christmas Eve 2018 , and with u nder a year left for Python 2 , here’s some statistics showing how much different Python versions have been used over the past three years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and December 2018: For the NumPy…
Three bots have been collecting words from Twitter for the past year. Short version: In 2018, people on Twitter talked about the words stan, toxic, peoplekind, councel, beclowned, caucasity, kakistocracy, catastrofuck, shithole, bombogenesis, chucklefuck, trumpfuckery, clackwanker, wankpuffin, dipshittery, fucksicle, and fuckwangled. Long version: They've looked for certain sentences and extracted…
January 2016 — October 2018 # To celebrate the release of Python 3.7.1 on 20th October 2018 , here’s some statistics showing how much different Python versions have been used over the past two and five-sixths years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and October 2018: pip installs from PyPI over time, by Python version For the…
January 2016 — June 2018 # To celebrate the release of Python 3.7 on 27th June 2018 , here’s some statistics showing how much different Python versions have been used over the past two and a half years. Here’s the pip installs for all packages from the Python Package Index (PyPI) , between January 2016 and June 2018: pip installs from PyPI over time, by Python version And for the Pillow…
Three bots have been collecting words from Twitter for the past year. Short version: In 2017, people on Twitter talked about the words broflake, caucacity, cockwomble, covfefe, dotard, douchecanoe, dracarys, shitgibbon, shooketh, twatwaffle, and woke. Long version: They've looked for certain sentences and extracted the X. @lovihatibot -- "I love/hate the word X" @nixibot -- "X is not/isn't/ain't a…