Python Bytes

Topics covered in this episode: CVE-2026-48710: A Maintainer's Perspective daily-stars-explorer Markdown to pdf with pandoc and typst postman2pytest Extras Joke Watch on YouTube About the show Brian #1: CVE-2026-48710: A Maintainer's Perspective Marcelo Trylesinski suggested by Lee Luocks Short version: users of Starlette: upgrade to Starlette 1.0.1 security professionals: we can’t treat open source projects like corporations This top link is a Starlette security advisory with the title Missing Host header validation poisons request.url.path, bypassing path-based security checks The CVE apparently caused some negative press targeting starlette. However, “the vulnerability came from the application pattern and the deployment, never from something Starlette intended.” A quote from an OSTIF article: “This bug is a classic “responsibility gap” where if this maintainer didn’t patch, thousands of exposed projects would have to individually secure their projects. In doing this work, they’ve voluntarily taken on the responsibility to protect the ecosystem from long-term systemic harm. As with all open source projects, they owed us nothing and could have left this to be everyone else’s problem and took the extraordinary steps of helping the ecosystem.” Both X40 D-Sec and Ars Technica expected immediate fixes and responses from Starlette. That’s not good. We can do better. Michael #2: daily-stars-explorer Explore the full history of any GitHub repository. 📈 Full Star History - Complete daily star counts for any repo ⏰ Hourly Stars - Hour-by-hour activity with timezone support 🔀 Compare Repos - Side-by-side comparison of any two repositories 📊 Activity Timelines - Commits, PRs, Issues, Forks, Contributors over time 📌 Pin Favorites - Bookmark repos for quick access without ret

Topics covered in this episode: Dumb Ways for an Open Source Project to Die How to create a pylock.toml lockfile https://github.com/facebook/Lifeguard Choosing a Python Logging Library in 2026 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Dumb Ways for an Open Source Project to Die Core categories The maintainer left The maintainer is still there Sabotage and capture The release pipeline broke Force majeure The world moved on The project s

Topics covered in this episode: Using Django Tasks in production Co-authored with Claude? PyPI packages are increasing rapidly httpx2 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Using Django Tasks in production Tim Schilling shares how the Djangonaut Space website has been using Django’s new tasks framework and some of the info missing from the official Django docs. Tasks require a third party package, django-tasks-db to actually run the tasks. Article walks through all changes necessary to get an email process running to notify admins of new testimonials. Cool simple

Topics covered in this episode: httpxyz one month in Learn concurrency - a deep dive into multithreading with Python pip 26.1 - lockfiles and dependency cooldowns Python 3.15 sentinal values from PEP 661 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: httpxyz one month in First version of httpxyz contained just the fixes to get zstd working, and the fixes to get the test suite running on python 3.14, some ‘housekeeping’ changes related to the renaming End of March: a compatibility shim that allows you to use httpxyz even with third-party packages that import httpx themselves,

Topics covered in this episode: profiling-explorer Reverting the incremental GC in Python 3.14 and 3.15 VSCode AI Co-author defaults to on, then off django freeze Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: profiling-explorer Adam Johnson And intro post Python: introducing profiling-explorer “profiling-explorer is a tool for exploring profiling data from Python’s built-in profilers, which are stored in pstats files. ” Features Dark mode</l

Topics covered in this episode: Django Modern Rest Already playing with Python 3.15 Cutting Python Web App Memory Over 31% tryke - A Rust-based Ptyhon test runner with a Jest-style API Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Django Modern Rest Modern REST framework for Django with types and async support Supports Pydantic, Attrs, and msgspec Has ai coding support with llms.txt See an example at the “showcase” section Brian #2: Already playing with Python 3.15 3.

Topics covered in this episode: Migrating from mypy to ty: Lessons from FastAPI Oxyde ORM Typeshedded CPython docs Raw+DC Database Pattern: A Retrospective Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Migrating from mypy to ty: Lessons from FastAPI Tim Hopper I saw this post by Sebastián Ramírez about all of his projects switching to ty FastAPI, Typer, SQLModel, Asyncer, FastAPI CLI SqlModel is already ty only - mypy re

Topics covered in this episode: Lock the Ghost Fence for Sandboxing MALUS: Liberate Open Source Harden your GitHub Actions Workflows with zizmor, dependency pinning, and dependency cooldowns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course **Patreon SupportersConnect with the hosts** Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Lock the Ghost The five core takeaways: PyPI "removal" doesn't delete distribution files. When a package is removed from PyPI, it disappears from the index and project page, but the actual distribution files remain accessible if you have a direct URL to them. uv.lock uniquely preserves access to ghost packages. Because uv.lock stores direct URLs to dis

Topics covered in this episode: Starlette 1.0.0 Astral to join OpenAI uv audit Fire and forget (or never) with Python’s asyncio Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Starlette 1.0.0 As a reminder, Starlette is the foundation for FastAPI Starlette 1.0 is here! - fun blog post from Marcello Trylesinski “The changes in 1.0 were limited to removing old deprecated code that had been on the way out for years, along with a few bug fixes. From now on we'll follow SemVer strictly.” Fun comment in the “What’s next?” section: “Oh, and Sebastián, Starlette is now out of your way to release FastAPI 1.0. 😉” </

Topics covered in this episode: chardet ,AI, and licensing refined-github pgdog: PostgreSQL connection pooler, load balancer and database sharder Agentic Engineering Patterns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: chardet ,AI, and licensing Thanks Ian Lessing Wow, where to start? A bit of legal precedence research. Chardet dispute shows how AI will kill software licensing, argues Bruce Perens on the Register Also see this GitHub issue. Dan Blanchard, maintainer of a Python character encoding detection library called chardet, released a new version

Topics covered in this episode: chardet ,AI, and licensing refined-github pgdog: PostgreSQL connection pooler, load balancer and database sharder Agentic Engineering Patterns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: chardet ,AI, and licensing Thanks Ian Lessing Wow, where to start? A bit of legal precedence research. Chardet dispute shows how AI will kill software licensing, argues Bruce Perens on the Register Also see this GitHub issue. Dan Blanchard, maintainer of a Python character encoding detection library called

Topics covered in this episode: Setting up a Python monorepo with uv workspaces cattrs: Flexible Object Serialization and Validation Learning to program in the AI age VS Code extension for FastAPI and friends Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @[email protected] / @mkennedy.codes (bsky) Brian: @[email protected] / @brianokken.bsky.social Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Setting up a Python monorepo with uv workspaces Dennis Traub The 3 things Give the Root a Distinct Name Use workspace = true for Inter-Package Deps Use importlib Mode for pytest Michael #2: <a href

Topics covered in this episode: Raw+DC: The ORM pattern of 2026? pytest-check releases Dataclass Wizard SQLiteo - “native macOS SQLite browser built for normal people” Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/471

Topics covered in this episode: Better Python tests with inline-snapshot jolt Battery intelligence for your laptop Markdown code formatting with ruff act - run your GitHub actions locally Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/470

Topics covered in this episode: Command Book App uvx.sh: Install Python tools without uv or Python Ending 15 years of subprocess polling monty: A minimal, secure Python interpreter written in Rust for use by AI Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/469

Topics covered in this episode: django-bolt: Faster than FastAPI, but with Django ORM, Django Admin, and Django packages pyleak More Django (three articles) Datastar Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/468

Topics covered in this episode: GreyNoise IP Check tprof: a targeting profiler TOAD is out Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/467

Topics covered in this episode: Better Django management commands with django-click and django-typer PSF Lands a $1.5 million sponsorship from Anthropic How uv got so fast PyView Web Framework Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/466

Topics covered in this episode: port-killer How we made Python's packaging library 3x faster CodSpeed Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/465

Topics covered in this episode: ty: An extremely fast Python type checker and LSP Python Supply Chain Security Made Easy typing_extensions MI6 chief: We'll be as fluent in Python as we are in Russian Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/464

Topics covered in this episode: Has the cost of building software just dropped 90%? More on Deprecation Warnings How FOSS Won and Why It Matters Should I be looking for a GitHub alternative? Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/463

Topics covered in this episode: Deprecations via warnings docs PyAtlas: interactive map of the top 10,000 Python packages on PyPI. Buckaroo Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/462

Topics covered in this episode: PEP 798: Unpacking in Comprehensions Pandas 3.0.0rc0 typos A couple testing topics Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/461

Topics covered in this episode: Advent of Code starts today Django 6 is coming Advanced, Overlooked Python Typing codespell Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/460

Topics covered in this episode: PEP 814 – Add frozendict built-in type From Material for MkDocs to Zensical Tach Some Python Speedups in 3.15 and 3.16 Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/459

Topics covered in this episode: Possibility of a new website for Django aiosqlitepool deptry browsr Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/458

Topics covered in this episode: httptap 10 Smart Performance Hacks For Faster Python Code FastRTC Explore Python dependencies with pipdeptree and uv pip tree Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/457

Topics covered in this episode: The PSF has withdrawn a $1.5 million proposal to US government grant program A Binary Serializer for Pydantic Models T-strings: Python's Fifth String Formatting Technique? Cronboard Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/456

Topics covered in this episode: Cyclopts: A CLI library The future of Python web services looks GIL-free Free-threaded GC Polite lazy imports for Python package maintainers Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/455

Topics covered in this episode: djrest2 - A small and simple REST library for Django based on class-based views. Github CLI caniscrape - Know before you scrape. Analyze any website's anti-bot protections in seconds. 🐴 GittyUp Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/454

Topics covered in this episode: PyPI+ uv-ship - a CLI-tool for shipping with uv How fast is 3.14? air - a new web framework built with FastAPI, Starlette, and Pydantic. Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/453

Topics covered in this episode: Python 3.14 Free-threaded Python Library Compatibility Checker Claude Sonnet 4.5 Python 3.15 will get Explicit lazy imports Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/452

Topics covered in this episode: PostgreSQL 18 Released Testing is better than DSA (Data Structures and Algorithms) Pyrefly in Cursor/PyCharm/VSCode/etc Playwright & pytest techniques that bring me joy Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/451

Topics covered in this episode: pandas is getting pd.col expressions Cline, At-Cost Agentic IDE Tooling uv cheatsheet Ducky Network UI Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/450

Topics covered in this episode: Mozilla’s Lifeline is Safe After Judge’s Google Antitrust Ruling troml - suggests or fills in trove classifiers for your projects pqrs: Command line tool for inspecting Parquet files Testing for Python 3.14 Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/449

Topics covered in this episode: prek tinyio The power of Python’s print function Vibe Coding Fiasco: AI Agent Goes Rogue, Deletes Company's Entire Database Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/448

Topics covered in this episode: rathole pre-commit: install with uv A good example of what functools.Placeholder from Python 3.14 allows Converted 160 old blog posts with AI Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/447

Topics covered in this episode: pypistats.org was down, is now back, and there’s a CLI State of Python 2025 wrapt: A Python module for decorators, wrappers and monkey patching. pysentry Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/446

Topics covered in this episode: pyx - optimized backend for uv Litestar is worth a look Django remake migrations django-chronos Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/445

Topics covered in this episode: Coverage.py regex pragmas Python of Yore nox-uv A couple Django items Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/444

Topics covered in this episode: rumdl - A Markdown Linter written in Rust Coverage 7.10.0: patch aioboto3 You might not need a Python class Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/443

Topics covered in this episode: Open Source Security work isn't “Special” uv v0.8 Extra, Extra, Extra Announcing Toad - a universal UI for agentic coding in the terminal Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/442

Topics covered in this episode: Distributed sqlite follow up: Turso and Litestream PEP 792 – Project status markers in the simple index Run coverage on tests docker2exe: Convert a Docker image to an executable Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/441

Topics covered in this episode: Switching to direnv, Starship, and uv rqlite - Distributed SQLite DB Some Markdown Stuff Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/440

Topics covered in this episode: ty documentation site and uv migration guide uv build backend is now stable + other Astral news Refactoring long boolean expressions fastapi-ml-skeleton Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/439

Topics covered in this episode: Python Cheat Sheets from Trey Hunner Automatisch mureq-typed My CLI World Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/438

Topics covered in this episode: The Python Language Summit 2025 Fixing Python Properties complexipy juvio Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/437

Topics covered in this episode: Free-threaded Python no longer “experimental” as of Python 3.14 typed-ffmpeg pyleak Optimizing Test Execution: Running live_server Tests Last with pytest Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/436

Topics covered in this episode: platformdirs poethepoet - “ Poe the Poet is a batteries included task runner that works well with poetry or with uv.” Python Pandas Ditches NumPy for Speedier PyArrow pointblank: Data validation made beautiful and powerful Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/435

Topics covered in this episode: Making PyPI’s test suite 81% faster People aren’t talking enough about how most of OpenAI’s tech stack runs on Python PyCon Talks on YouTube Optimizing Python Import Performance Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/434