Python core developer. Tall, snarky Canadian.
While writing the section of my 2026 Python Packaging Council (PPC) nomination on secure supply chain, I realized that one thing related to having a secure supply chain that we lack is a defined way to perform reproducible builds . The reason I like the idea of making reproducible builds work
I have decided to run for the inaugural/2026 Python packaging council (PPC). I will say I have the support of my employer (Microsoft) to do this, but they didn't ask me to and my usual thing that I would quit before I let any employer pressure me
There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say " GitHub Actions is the weakest link " in publishing and to GitHub publishing a GitHub Actions security roadmap update . But saying it's an issue and acknowledging the fact
While I decide what to do with PEP 832 after polling folks on their opinion , I thought I would write out why I'm even bothering with any of this. I'm going to talk from the perspective of VS Code and its Python extensions , but you could
A Python project got hacked where malicious releases were directly uploaded to PyPI . I said on Mastodon that had the project used trusted publishing with digital attestations , then people using a pylock.toml file would have noticed something odd was going on thanks to the lock file including attestation data
It's been a while since I posted about WASI support in CPython ! 😅 Up until now, most of the work I have been doing around WASI has been making its maintenance easier for me and other core developers. For instance, the cpython-devcontainer repo now provides a WASI
In case you didn't hear, PEP 810 got accepted which means Python 3.15 is going to support lazy imports! One of the selling points of lazy imports is with code that has a CLI so that you only import code as necessary, making the app a bit
I want to be upfront that this blog post is for me to write down some thoughts that I have on the idea of rewriting the Python Launcher for Unix from Rust to pure Python. This blog post is not meant to explicitly be educational or enlightening for others, but
I was writing some code where I was using httpx.get() and its params parameter . I decided to use a TypedDict for the dictionary I was passing as the argument since it was for a REST API, where the potential keys were fully known. I then ran Pyrefly over my
(This is the blog post version of my keynote from EuroPython 2025 in Prague, Czechia.) We now have a lock file format specification . That might not sound like a big deal, but for me it took 4 years of active work to get us that specification. Part education, part therapy,
PEP 750 introduced t-strings for Python 3.14. In fact, they are so new that as of Python 3.14.0b1 there still isn't any documentation yet for t-strings. 😅 As such, this blog post will hopefully help explain what exactly t-strings are and what
I normally don't talk about politics here, but as I write this the US has started a trade war with Canada (which is partially paused for a month, but that doesn't remove the threat). It is so infuriating and upsetting that I will be skipping PyCon
When I was about to go on paternity leave, the Gleam programming language reached 1.0 . It's such a small language that I was able to learn it over the span of two days. I tried to use it to convert a GitHub Action from JavaScript to Gleam,
In the past week I had two people separately tell me what they thought the Python Software Foundation Conduct WG did and both were wrong (and incidentally in the same way). As such, I wanted to clarify what exactly the WG does for people in case others also misunderstand what
In my opinion, you should only introduce a named tuple to your code when you're updating a preexisting API that was already returning a tuple or you are wrapping a tuple return value from another API. Let's start with when you should use named tuples. Usually