Podcasts about PyCharm

Topics covered in this episode: Some more things about Django I've been enjoying Who cleans up after the vibe-coding party? Where Did All Your AI Tokens Go? AgentsView to the rescue! Careful with phishing all Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Some more things about Django I've been enjoying Julia Evans is learning "2010-style" web dev (Django + SQL + server-rendered HTML) after years of Go backends and JS-heavy frontends Query builders: likes defining custom QuerySet classes with chainable filter methods (.approved().future().with_tags()) — more readable than raw SQL Template filters: highlights urlize, linebreaksbr, json_script, and especially querystring for building/modifying query-string links in templates Migrations: still loves Django's auto-generated migrations — 19 and counting on her project Skips inheritance for class-based views; prefers function-based views for sharing code, though fine using Django's own mixins/interfaces Performance surprise: CPU profiling (via py-spy) — not slow DB queries — revealed the culprit; she'd accidentally disabled the cached template loader, and re-enabling it took throughput from ~2-3 req/s to ~12 req/s on a $10/mo VM Michael #2: Who cleans up after the vibe-coding party? FT Magazine piece by Sam Learner (July 11) on AI coding tools overwhelming open source maintainers - sent in by listener Dylan McConnell, whose main point was that this ran in the Financial Times, not a dev blog. cURL as the case study - Daniel Stenberg has been the only full-time person on it for years; libcurl has been installed an estimated 20+ billion times with 3,000+ listed contributors. Bug bounty killed - cURL ended its paid security bounty program in January, citing an "explosion of AI slop reports" that take real time to debunk and drain morale. Extractive contributions - authoring a PR is now nearly free, reviewing one still costs a human; tldraw's Steve Ruiz closed outside contributions entirely, asking why he'd want someone else writing the easy part. Guido weighs in - van Rossum says projects are holding emergency meetings over the slop flow, and notes LLM patches tend to touch unrelated parts of a file, making review more tedious. "Vibe Coding Kills Open Source" - paper from Miklós Koren's group: packages frequently recommended by coding models saw big download jumps with no matching engagement, breaking the reputation loop that sustains maintainers. Stack Overflow flatlined - over 100,000 questions a month before ChatGPT, under 1,500 last month, with the response rate cut roughly in half; the public archive is now stale training data. The course-creator angle - Josh Comeau's newest web dev course launched at about a third of prior enrollment, and he worries about devs who never learn which questions to ask. But the most interesting portion is what was omitted. Focused on: The end of the curl bug-bounty Omitted: High-Quality Chaos Why the omission is interesting It fits a narrative. The FT piece is a maintenance-and-decline story, and January-Stenberg is a perfect witness for it. April-Stenberg complicates it - same person, same project, better data, opposite direction on the specific claim being used. The tell is already in the article. Learner quotes Stenberg saying AI tools are much better at finding problems than fixing them. That's the April thesis in one line, and it goes undeveloped. Reason for the shift is process, not vibes. Killing the bounty removed the cash incentive and the venue change filtered the rest. Worth saying out loud, because "AI reports got better" isn't quite it - "no bounty plus a real triage platform" is closer. Joke too: Sarah O'Connor wrote a related piece (is this just before skynet launches?) Calvin #3: Where Did All Your AI Tokens Go? AgentsView to the rescue! Local-first desktop/web app for browsing, searching, and analyzing your past AI coding agent sessions (Claude Code, Codex, Copilot, Cursor, Gemini, Aider, and dozens more) Auto-discovers session files on your machine — no config needed; everything stored locally in SQLite, no cloud/accounts agentsview usage is a drop-in ccusage alternative — reads from pre-indexed SQLite, reports run 80–220× faster on large histories New Activity dashboard shows peak concurrency, active vs. idle time, agent-minutes, and cost — filterable by project/agent/machine, with a -json CLI report too Full-text + optional semantic search across every session; also imports Claude.ai/ChatGPT chat exports Install via pip install agentsview, uvx agentsview, brew install --cask agentsview, or download desktop binaries from GitHub Releases Michael #4: Careful with phishing all The situation I pass this along because it was a pretty sneaky bit of targeted phishing, and happened to play off an old interaction in bandit's repo. As usual with phishing scams there are a bunch of tells that this isn't legitimate, but just enough plausibility that I could see falling for it in a weak moment. Relative nobodies like me haven't historically been worth the effort to hit with scams this specific. Agents change the game though :-/. Be careful out there folks! Original message From: "Patrick (Blacktrace)" [HTML_REMOVED] To: LISTENER EMAIL Subject: Your Bandit #1350 (B105 NextToken false positive) -- just fixed that exact case Date: Wednesday, July 15, 2026 12:02 AM Hi AJ, Saw your Bandit issue #1350 -- the B105 hardcoded-password false positive on the string NextToken. I build a deterministic gate that filters that class of Bandit noise, and #1350 was literally the case I just fixed: NextToken / next_token / page_token / nextPageToken now stay quiet, while a genuine hardcoded token like api_token="sk-live-..." still fires. Verified against your exact case. 30-second paste: https://blacktrace.co/noise-eraser Where it still trips, published: https://blacktrace.co/kruc Curious whether it clears what you hit -- and if it trips on something of yours, that's the more useful reply. Patrick, Blacktrace I asked Claude for some analysis too. It was pretty good at finding them. The message name-drops enough real detail to feel legit, but the structure is pure phishing - everything in it exists to get AJ onto blacktrace.co. The strongest ones: Freemail sender, corporate signoff. Signs as "Patrick, Blacktrace" but sends from emailpjv@gmail.com. Real company outreach comes from the company domain, not a personal Gmail - and there's no last name. Over-specific targeting. It mirrors AJ's exact public activity - issue #1350, the B105 rule, the NextToken false positive, even the token variants. That's the "just enough plausibility" AJ flagged, and it's exactly what agents make cheap: scrape a GitHub issue, auto-generate tailored bait. Legit cold outreach rarely reads your history back to you this precisely. The entire payload is two links. Strip the technical flattery and the message is just "paste here" plus "see results here." When the whole point of an email is the click, that's the tell. "30-second paste." Low-friction urgency, and "paste" most likely means paste your source into their tool - handing your code to a stranger's site. Exfiltration dressed as convenience. Brand-new, no-reputation domain. blacktrace.co has no track record, and the name is doing some ominous work. The /kruc slug is random noise, not how real product pages get named. Precise-sounding jargon that's actually vague. "Deterministic gate," "noise-eraser" - impressive, empty. Bolted onto correct real details (B105 is the Bandit hardcoded-password test, sk-live- is a Stripe live-key prefix) to borrow credibility. The disarming close. "if it trips on something of yours, that's the more useful reply" - engineered humility that flatters your expertise and baits a response. Makes engaging feel like you're doing them a favor, which drops your guard. Extras Calvin: DjangoCon US 2026 is rapidly approaching, August 24-28, Chicago Ruff v0.16.0 massively expands its default rule set Ruff now enables 413 rules by default, up from 59 https://astral.sh/blog/ruff-v0.16.0 Michael: Completely redesigned the home page. Try /insights in Claude Code (terminal) Joke: We're Safe

For years, "Django and async" came with an asterisk. The docs themselves warned you off it. Scary performance notes, a story that felt half-finished. Well, that story just got rewritten, literally, and the person who rewrote it is here to tell you why the old framing was wrong. Carlton Gibson is a former Django Fellow, sat on the security team for eight years, and he's on the steering council. On this episode we get into the async topic doc rewrite, what actually remains versus what was just fear, the new Tasks framework in 6.0, DB-level cascades and fetch modes landing in 6.1, and why free-threading is the bet that's about to pay off big for Django. If you've been told Django's async story isn't ready, this is the episode that puts that myth to bed. Episode sponsors Sentry Error Monitoring, Code talkpython26 Python in Production Talk Python Courses Links from the show DjangoCon Europe: djangocon.eu PyCon Italia: pycon.it Django on the Med: djangomed.eu Django Mantle: noumenal.es PyPI: pypi.org release notes: docs.djangoproject.com on_delete: docs.djangoproject.com Fetch modes: docs.djangoproject.com HttpRequest.multipart_parser_class: docs.djangoproject.com async topic doc: docs.djangoproject.com docs: docs.djangoproject.com DEP 14: github.com django-tasks: github.com django-tasks-local: github.com Celery: docs.celeryq.dev PEP 703: peps.python.org free-threading HOWTO: docs.python.org PEP 779: peps.python.org ASGI: docs.djangoproject.com PGBouncer: www.pgbouncer.org Channels: channels.readthedocs.io sync_to_async / async_to_sync: docs.djangoproject.com noumenal.es: noumenal.es Django Chat: djangochat.com @carlton@fosstodon.org: fosstodon.org Article: Cutting Python Web App Memory Over 31%: mkennedy.codes Watch this episode on YouTube: youtube.com Episode #556 deep-dive: talkpython.fm/556 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: django-orjson Best Django Redis configuration for speed and size Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Django Steering Council backs the Triptych Project Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Michael #1: django-orjson Adam Johnson dropped django-orjson - drop-in replacements for the Django and DRF pieces that touch JSON, swapping stdlib json for orjson, the Rust-based library. Headline numbers: 10x faster serialization, 2x faster deserialization. The interesting question is why this needs to be a package at all. pip install orjson is the easy part. Adam's actual pitch: adopting it "isn't easy, especially when your framework uses json in many different parts." Django scatters JSON across JsonResponse, the test client and test case classes, the json_script template tag, and more. There's no single hook to grab, so you get a library that catches them all. Adam is refreshingly honest about the scale of the win. His words: "While database queries tend to dominate the typical Django application's runtime, the time spent in serialization and deserialization can still be significant." He calls it "a nearly free performance win" - not "this will 10x your app." That's a claim about cost, not magnitude, and it's worth keeping those straight. Worth flagging what the post doesn't cover: caveats. There are none in the article, but orjson has real ones. Django and Flask both render datetimes as RFC 822 HTTP-date (Wed, 15 Jul 2026 12:00:00 GMT); orjson does ISO 8601. It can't do ensure_ascii, it rejects NaN and Infinity (which stdlib happily emits), and it raises on Decimal. If you've got a JS client parsing dates, that's a wire-format change. Who should actually take this? If you're a DRF shop shoveling JSON all day, yes - it's cheap and it's real. If your app mostly renders HTML templates, you're optimizing a slice of runtime that's already near zero. The problem Adam's package solves doesn't exist in Flask or Quart. They already centralize every JSON operation - jsonify, request.get_json(), the test client, the |tojson filter - behind one provider object at app.json. So there's no library to install. It's about ten lines: import orjson from quart.json.provider import JSONProvider # or flask.json.provider class OrjsonProvider(JSONProvider): def dumps(self, obj, **kwargs) -> str: return orjson.dumps(obj).decode() # provider must return str def loads(self, s, **kwargs): return orjson.loads(s) app.json = OrjsonProvider(app) The numbers on talkpython.fm Evaluated it, measured it, and skipped it. The biggest JSON payload we serve is our MCP server returning a cached episode transcript, about 139 KB. Swapping the provider saves 0.119 milliseconds per request. That total response takes 1.1 ms We got 4.1x, not 10x - and the reason is the good lesson. Payload shape decides your speedup. The 10x is for structure-heavy data, lots of small keys where stdlib burns time in Python-level dispatch per item. Our hot payload is one giant transcript string, so the work is escaping and memcpy Calvin #2: Best Django Redis configuration for speed and size Peter Bengtsson revisits a classic: his 2017 "Fastest Redis configuration for Django" benchmark now has a 2026 update posted this week. The 2017 post pitted django-redis serializers (json, ujson, msgpack, pickle) and compressors (zlib, lzma) against each other; conclusion was msgpack + zlib as the sweet spot - avoid the json serializer, it's fat and slow. The 2026 update narrows focus to just compressors: default (no compression), zlib, lzma, and newcomer zstd. New results: lzma compresses best but is slowest; zstd is the fastest compressor on Ubuntu; differences between them are very small. Big takeaway across both: compression buys you a lot of space (2–3.5x smaller) for very little speed cost - worth it for Redis where memory is the constraint. Caveat from the author: results depend heavily on your data - his test stores short strings of numbers, so benchmark your own workload. Michael #3: Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Write up on Ars. Really good coverage by Maximillian: Time to wake up (for some) Torvalds said that “Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away.” I agree with Max, putting your head in the sand and waiting for AI to go away will likely mean you won't be working professionally in software development in the coming years. The statement came amid a lengthy thread arguing about the use of Sashiko, an “agentic Linux kernel code review system” that its creators claim can, in tests, independently find 53.6 percent of the bugs that would end up being fixed by human coders in later commits. “We're not forcing anybody to use [LLM tools], but I will very loudly ignore people who try to argue against other people from using it,” Torvalds said. “Anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time,” Torvalds wrote. Calvin #4: Django Steering Council backs the Triptych Project Django Steering Council issued a Letter of Collaboration backing Carson Gross & Alex Petros's funding bid for the Triptych Project - three proposals to make HTML more expressive natively, in every browser. The three additions: PUT/PATCH/DELETE methods for forms, button actions (buttons that fire HTTP requests without a wrapping form), and partial page replacement. Distills the core ideas from HTMX/Unpoly/Turbo into the HTML standard itself - no JS, no library, nothing to ship or maintain. Current focus is button actions (WHATWG #12330): Logout instead of wrapping a button in a form. Relevant to Django directly - think the admin submit row and disguised delete links; Django 6.0's template partials were already inspired by these patterns. How to help: companies can send non-binding letters of support on letterhead; individuals can read the proposals and weigh in on the WHATWG issues. Extras Calvin: DOOMQL - A playable first-person shooter whose framebuffer is a SQL query. Michael: Granian 2.7.9 fixes WSGI threadpool scheduler starvation/underscaling Welcome Calvin post Joke: Solving all bugs

 PHP Podcast – July 16, 2026 Hosts: Joe Ferguson, Sara Golemon, and Holly Schilling Joe hosts with Sarah and Holly while running on no sleep. The PHP Tech 2027 CFP opens, a fake PHP 9 pitch appears, we crown Holly the accidental main character of internals, and everyone agrees dark mode flashing white is a war crime. PHP Tech 2027 CFP Is Open (And Yes, the Year Is Right This Time) The big news kicking off the show is that the PHP Tech CFP for 2027 is live and open. You can find it over at Sessionize under php-tech-2027, and unlike a certain demo from the previous week, the date on it is actually correct. There was a brief moment where it displayed 2007, but the team fixed that rather quickly, so credit where credit is due. The crew marveled at the fact that we are somehow less than six months out from 2027, which spiraled into a conversation about kids getting learner’s permits, full beards showing up on children who were toddlers just yesterday, and whether anyone’s offspring might actually submit a talk. Helldivers came up. Freedom was spread. And there was a gentle suggestion that SoCalKid and their newly engaged fiancé should be sent the CFP URL immediately. Meanwhile, PHP Tech 2026 videos are rolling out on PHP Tech TV. There are currently 37 available with more still processing thanks to some technical and room issues at the event. Several talks are completely free, including Joe’s talk on modernizing DevOps, Kaylin’s “Modernize Your Old School Endpoints with HTMX,” and both of Ben Ramsey’s talks. Working Groups, Discord, and the People Who Actually Care The conversation turned to the internals process and Ben Ramsey’s working group proposal on the internals mailing list, which the crew encouraged everyone to actually read. The idea of giving working groups some autonomy and even decision-making power drew broad agreement as a way to produce more fully-fleshed RFCs rather than one person’s implementation of a giant feature. A recurring point of confusion is the reference to “Discord conversations” in RFCs. There is no official PHP.net Discord, but phpc.chat will get you to the Discord (and previously the bridged IRC). The PHP Internals channel is where a lot of discussion happens, though far from the only place, and there are also the PHP Foundation and new Foundation Ambassadors channels. Big appreciation went out to the moderators keeping that Discord spam-free and troll-free, with a special shout to Tiffany, who is an absolute machine at helping people, pointing them in the right direction, and posting top-tier cat pictures in the pet flexing channel. The recurring theme: decisions are made by the people who show up. Silence is acquiescence, and if you have issues, speak up. Holly famously just showed up in internals one day, started talking, and they let her stay. This Week in Internals and the Co-Scientist Show Joe wanted to highlight Artisan Build’s YouTube channel, specifically their “This Week in Internals” videos. They are fantastic recaps of what’s happening in the internals world, complete with a very light sprinkling of extremely dry comedic timing that lands perfectly. The videos break down email threads and RFCs into easily digestible summaries of what people are arguing over, then poke a little fun at the sillier arguments. A weekly recap drops regularly and it’s consistently great content for anyone curious about internals. The crew was also impressed by the host’s ability to nail every name pronunciation on what seems like the first try, which spiraled into Holly’s confession that she has a hard memory limit on names learned after kindergarten. Anyone new is simply “out of bounds.” Holly’s Fake PHP 9 Pitch: Structs, Modules, and Surfaces Holly walked through a blog post on eventuallywrong.com featuring a fake PHP 9 pitch full of flagship features she’s prototyped. It kicked off with extensions, which she discovered didn’t exist while trying to build the Longhorn app in native PHP, landing her at the top of that internals video. Next came structs, which started as an attempt to build tuples (turns out full structs were easier). They’re Swift-style value types with strong typing, and after some grumbling at Larry, she reworked things to support interfaces and traits, leaning into composition over inheritance. Modules got the PHP-style treatment: a simple module definition, a public interface declaration, and a new `internal` visibility level that lets members be accessed within the same module. No autoloader modifications required, and reflection remains the escape hatch as always. Finally, surfaces — a keyword that adds a perpendicular-to-visibility scope. A method can belong to a surface, and callers simply declare they want to use that surface of the class. Holly performance-tested it: no impact if unused, minimal impact if used. She also spent a good chunk of the show against friend classes, arguing they’re leaky, unrestricted, and if you’re going to hand out full access to your privates, you shouldn’t have marked them private in the first place. Release Management, Version Stats, and Upgrade Paths Holly is a first-time PHP 8.6 release manager alongside Matteo Beccati, with veteran Daniel Scherzer (also on 8.5) rounding out the team. She stepped down from RM in a prior election because others wanted the work — a reminder that people stepping up in open source is a rarity worth celebrating. Release management, she noted, is less a social job and more about moving data at the right time and signing things. The July 2026 PHP version stats got a thumbs up. Looking at the trends, 8.5 is clearly on the rise, 8.4 climbing slightly, 8.3 starting to trend down, and 8.2 falling harder — exactly the curve you want, with the vast majority sitting inside the support window. Joe shared that upgrading apps from PHP 7 to 8.3/8.4/8.5 has been a much easier lift than the older 7.x hops, thanks to a more consistent release cadence and better deprecation guidance. Holly pushed back on the idea that 5.6-to-7 was ever hard, while Joe pointed out the real pain came from jumping ancient 5.0/5.1 codebases straight to 7 back before Claude existed. There was also a very in-depth debugging tangent about an opcache build flag no longer being needed on 8.5. Accessibility, Dark Mode Crimes, and the JetBrains Survey The JetBrains State of PHP survey is open, and everyone should go take it — there’s even a chance to win one of five vouchers. This led to a discussion about whether JetBrains usage is being decimated by AI tooling, with Holly living almost entirely in the terminal with Claude Code these days while Joe remains loyal to PHPStorm and PyCharm. Sarah, who is going blind and is not joking about it, kicked off a passionate segment on accessibility. Test your apps with a screen reader. Respect font scaling and contrast (F0F0F0 text on white is a genuine crime). Respect the OS toggles for reduced motion, because autistic users and others depend on them and apps routinely ignore them. The crew then united around dark mode etiquette: the only reasonable default is system-selected, and the white flash between two dark-mode pages is caused by JavaScript-based theme switching instead of sane CSS selectors. It is, universally agreed, the worst. The episode closed on eye-tracking privacy (Apple Vision Pro good, Oculus terrifying), heat maps, and a laptop-camera-covering tangent that got appropriately unhinged before Joe called it on that bombshell. Links from the show: PHP Tech 2027 CFP — Now open on Sessionize eventuallywrong.com — Holly’s fake PHP 9 pitch phpc.chat — Get to the PHP Discord store.phparch.com — Now with socks Hosts: Joe Ferguson X: @shocm Mastodon: @joepferguson@social.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners PHP Architect Consulting Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Displace Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/ OurCVEs Your security posture, on autopilot with OurCVEs CodeRabbit Cut code review time & bugs in half instantly with CodeRabbit. Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.07.16 appeared first on PHP Architect.

Topics covered in this episode: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it JupyterLab 4.6 and Notebook 7.6 are out! Tau – new small, readable terminal coding agent Django Tasks and Django 6.1 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/ (Brett Cannon) and https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing (William Woodruff) Trusted Publishing (PyPI's OIDC-based auth scheme, also now used by npm, RubyGems, crates.io, NuGet) replaces long-lived API tokens with short-lived, auto-scoped credentials tied to CI/CD machine identity. Yossarian's post: it's purely an authentication mechanism between a machine identity and a package — it says nothing about package safety or quality. PyPI deliberately avoids any "verified/trusted" badge for it, unlike its verified-URL checkmarks. Same logic applies to PyPI attestations: anyone can sign with any machine identity they control, so an attestation's presence isn't itself a trust signal. Bottom line from that post: don't confuse "trusted" (machine-to-machine) with "trustworthy" (human judgment about the package). Snarky.ca's companion piece is more practical: given GitHub Actions compromises in the news, the real fix is 3 concrete steps — run zizmor to lock down workflow permissions/checkout credentials and pin actions to commit hashes, adopt Trusted Publishing to eliminate stored PyPI tokens, and require manual approval via a GitHub environment before any publish job runs. Takeaway for listeners: Trusted Publishing is good hygiene for how you authenticate to PyPI, but it's not a substitute for securing your CI pipeline itself — or for actually vetting the packages you install. Michael #2: JupyterLab 4.6 and Notebook 7.6 are out! Michał Krassowski's rundown - a chunky minor release: 68 features, 97 bug fixes, 95 contributors, one of the biggest ever. Scratchpad console (Notebook 7.6 headliner) - a console next to your notebook sharing its kernel, for throwaway experiments. Ctrl+B. Jump to last-edited cell - new commands hop through recently edited cells. File browser glow-up - Date Created column, editable breadcrumbs with Tab-completion, and Open in Terminal. Debugger - sources open in the main area, floating step/continue overlay, live kernel-sources filter. Custom layouts (Lab) - activity bar top/bottom, draggable panels, four-way tab splits, per-panel Ctrl+scroll zoom. ~5x faster extension builds - webpack → Rspack, and jupyter-builder means no full Lab install needed to build extensions. Keyboard/a11y - add shortcuts from the UI (no JSON), Find & Replace in Edit menu (Ctrl+H). Calvin #3: Tau – new small, readable terminal coding agent Tau – new small, readable terminal coding agent (Python 3.12+), built as both a working tool and a teaching project for how coding agents work under the hood Install via uv tool install tau-ai, pipx, or pip; ships a tau CLI Three-layer architecture: tau_ai (provider-neutral model layer) → tau_agent (reusable "brain": messages, tools, events, loop) → tau_coding (CLI/TUI, file & shell tools, sessions) Supports OpenAI, Anthropic, OpenAI Codex, OpenRouter, Hugging Face, and custom/local OpenAI-compatible endpoints Built-in tools (read/write/edit/bash), durable JSONL sessions with resume/branching, project instructions via AGENTS.md, and context compaction Core harness is UI-agnostic — same brain can power the TUI, print mode, or a custom frontend — usable as a standalone library too Michael #4: Django Tasks and Django 6.1 Django 6.0 finally ships first-party background tasks (django.tasks) - out of Jake Howard's DEP 14, accepted May 2024, after two decades of everyone bolting on Celery/RQ/Huey. It's an API, not a worker. Django handles task definition, validation, queuing, and result storage - it does not execute them. You bring the backend. The default backend traps people. ImmediateBackend runs tasks inline on the request thread and blocks until done - so out of the box .enqueue() backgrounds nothing (a 5-second task means a 5-second response). The other built-in, DummyBackend, runs nothing at all. Both are dev/test only. Nice API otherwise: slap @task on a function, call .enqueue(), get back a TaskResult you look up later by id - with async twins like aenqueue(). Gotcha: args and return values must survive a JSON round-trip, so a tuple sneakily comes back as a list. The community local backend to know: django-tasks-local by Chris Beaven (SmileyChris). A ThreadPoolExecutor backend that gives real background threads with zero infrastructure - no Redis, no Celery, no database - plus a ProcessPoolBackend for CPU-bound work → github.com/lincolnloop/django-tasks-local Its catch: results live in memory, so pending tasks vanish on restart or deploy. Great for dev and low-traffic production; for persistence, drop to Jake Howard's django-tasks (DatabaseBackend + worker command). Extras Calvin: Fixing the dictionary with Python 3.14 — Hugo van Kemenade stumbled on - and got fixed - a markup bug in the OED's own citation of a 1706 use of the pi symbol. Michael: Bunny DNS is now free Jokes: What's the object-oriented way to become wealthy? Inheritance To understand what recursion is... You must first understand what recursion is 3 SQL statements walk into a NoSQL bar. Soon, they walk out They couldn't find a table.

Coding agents have gotten really good at one kind of work. You scope a feature, edit some files, run the tests, ship it. It all happens on disk. But that is not how data work feels. You load something, you look at it, you run a cell, you watch how it responds, and you decide the next move from whatever is sitting in memory. And until now, your agent couldn't see any of that. It only saw the files. Never the live state. This episode, that wall comes down. marimo pair drops a coding agent right inside a running notebook, with full access to every variable Python is holding in memory. The notebook becomes a shared canvas. You point, it runs the code. You tell it to zoom in on the Picasso paintings, and the chart just updates. No MCP tools to wire up, no schema to describe. Just Python, and an agent that can finally see what you see. Trevor Manz is back to walk us through it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show marimo pair: marimo.io/pair Course transcripts announcement: talkpython.fm/blog anywidget: Jupyter Widgets made easy: talkpython.fm marimo: marimo.io blog: marimo.io GitHub: github.com given this: martinalderson.com llms.txt: talkpython.fm mcp: talkpython.fm cli: talkpython.fm open issues: github.com Discord: marimo.io Marimo Pair: marimo.io OpenCode: opencode.ai AI Tooling for Software Engineers in 2026: newsletter.pragmaticengineer.com Watch this episode on YouTube: youtube.com Episode #555 deep-dive: talkpython.fm/555 Episode transcripts: talkpython.fm Theme Song: Developer Rap

You ask an AI a question and it answers with total confidence. Most of the time, a confidently wrong answer is just an annoyance. But what if the question is medical, and there's a real patient on the other end? In that world, a hallucination isn't a bug, it's a patient-safety event. Sumit Gundawar is a London-based software engineer who builds the clinical platform for a UK longevity and aesthetic-medicine clinic, and his whole argument is that in high-stakes AI, the model is the easy part. Earning trust is the real engineering. We dig into grounding, refusal logic, human-in-the-loop design, and the messy frontier of longevity and biohacking, plus a live demo of an assistant that refuses to answer when it can't back up the claim. Let's get into it. Episode sponsors Six Feet Up Talk Python Courses Links from the show Guest Sumit Gundawar: linkedin.com Course transcripts announcement: talkpython.fm/blog Sumit Gundawar - JAX London Speaker: jaxlondon.com Anthropic: anthropic.com OpenAI Platform: platform.openai.com Anthropic: anthropic.com LangChain: langchain.com OWASP: owasp.org Pydantic: pydantic.dev EU AI Act - Regulatory Framework: digital-strategy.ec.europa.eu HIPAA - HHS: www.hhs.gov NHS: www.nhs.uk Llama: llama.com Qwen - QwenLM on GitHub: github.com OpenAI Platform: platform.openai.com Hugging Face: huggingface.co Llama: llama.com Granola: www.granola.ai HIPAA - HHS: www.hhs.gov CodeRabbit: www.coderabbit.ai Cursor Origin: cursor.com GitHub Status: www.githubstatus.com Midjourney Medical: www.midjourney.com Neko Health: www.nekohealth.com CERN: home.cern ATLAS Experiment: atlas.cern Watch this episode on YouTube: youtube.com Episode #554 deep-dive: talkpython.fm/554 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: dust - a better du Hermes Agent: The AI agent that grows with you llm-coding-agent 0.1a0 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: dust - a better du du + Rust = dust - a fast, visual, intuitive disk-usage CLI Run dust and immediately see the biggest directories and files without piping through sort, head, or awk Smart recursive output focuses on what matters instead of dumping every folder Colored bars show relative size and parent/child hierarchy, making “where did the space go?” obvious Perfect for Python projects bloated by .venv, caches, Docker volumes, downloaded datasets, and local AI models Install via brew, cargo install du-dust, conda-forge, Scoop, Snap, deb-get, or GitHub releases Calvin #2: A Way better ARchive format for Python packaging war - new archive format spec from Astral (same team as uv/ruff), v0.0.2, still no binary encoding defined yet Header-Index-Store layout: header IDs the file, index maps names to store offsets, store holds compressed data Index uses a finite-state transducer (FST) to dedupe common path prefixes across entry names Supports three entry types (file, directory, link) and three compression modes (store/DEFLATE/zstd), plus an "executable" metadata flag Unpacking is atomic - writes to a temp dir, then renames into place, so a failed extract never leaves a half-unpacked directory Strict name-segment rules (no NUL/control chars, no leading/trailing whitespace, blocks Windows-reserved names like CON/PRN) to avoid path traversal and cross-platform footguns Michael #3: Hermes Agent: The AI agent that grows with you Hermes Agent is an open-source, Python-built AI agent framework from Nous Research - think ChatGPT-style assistant, but connected to your tools, files, shell, browser, calendar, memory, and messaging apps I'm using it in Discord as a long-running agent conversation, not just a one-off chatbot session Hermes can connect through a gateway to platforms like Discord, Telegram, Slack, WhatsApp, email, webhooks, and more - so the same assistant can follow you across surfaces In my setup, I can send Hermes voice/text from Discord, keep project context across turns as threads, and ask it to actually do things: read GitHub repos, run commands, edit files, schedule calendar events, generate drafts, and verify results A fun workflow: I can trigger one-shot actions from an Apple Watch shortcut - dictate a request, send it to Hermes, and have the agent execute it asynchronously Hermes has persistent memory, so it can remember durable preferences and facts - for example, how I like my research formatted It also has “skills,” which are reusable procedures the agent can load later, so Hermes can self-improve over time instead of rediscovering the same workflow repeatedly It supports scheduled jobs / cron-style automations, so it can proactively watch for releases, send summaries, run checks, or remind you about things It's provider-agnostic: OpenRouter, Anthropic, Google, xAI, local models, Nous Portal, and others The big idea: Hermes turns an LLM from “a chat box I visit” into “an agent I can reach from anywhere that knows my workflows and can take real actions and learns over time.” Calvin #4: llm-coding-agent 0.1a0 Simon Willison built a Claude/Codex-style coding agent on top of his llm library, using an alpha of the llm package plus his python-lib-template-repo Built almost entirely via prompted TDD - asked an agent to write a spec.md, then commit + implement with red/green tests, occasionally hitting a real OpenAI key to sanity-check Shipped to PyPI as an alpha: uvx --prerelease=allow --with llm-coding-agent llm code Tool set mirrors familiar coding-agent primitives: read_file, edit_file (exact string replace + diff), write_file, list_files, search_files, execute_command Also exposes a Python API - CodingAgent(model="gpt-5.5", root=..., approve=True).run(...) - which Simon didn't ask for but got anyway Demo: llm code --yolo told GPT-5.5 to build a SwiftUI CLI clock; model correctly noted SwiftUI isn't really CLI-friendly and still produced an ASCII-art time display Extras Calvin: Slides, but for developers https://sli.dev/ Wanna reduce your token usage…. only issue is that its lossy https://github.com/teamchong/pxpipe PEP 772 - Python Packaging Council inaugural election dates set, nominations open July 28, voting September 1-15 Michael: What the pls? revisited! Joke: Min requirements for Linux

Topics covered in this episode: Free-threaded Python: past, present, and future django-admin-site-search Qwen 3.6 27B is the sweet spot for local development A large batch of PEPs are finalized Extras Joke Watch on YouTube Show Intro Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Free-threaded Python: past, present, and future The GIL has prevented true multi-threaded parallelism in CPython since the beginning — multiple past attempts to remove it failed on performance grounds Sam Gross at Meta finally solved it; his work became PEP 703 and ships as free-threaded CPython today Python 3.13 was experimental with 20–40% single-threaded slowdown; 3.14 brought that to 0–10% Python 3.15 (October 2026) delivers a unified ABI — one extension binary works on both GIL and free-threaded builds Already >50% of the top PyPI binary wheels support free threading Wouters predicts free-threaded becomes the default between 3.16–3.20 (2027–2031), with the GIL eventually disappearing next decade Michael #2: django-admin-site-search via Adam Parkin A global/site search modal for the Django admin, by Ahmed Aljawahiry. Hit cmd+k anywhere in the admin and you get a command-palette-style search window, kind of like the one in VS Code. It doesn't just search one model's list page. It searches your entire site in one box: App labels Model labels and field attributes Actual model instances (your data) Two ways to search the instances: model_char_fields (the default): runs an __icontains across every CharField (and subclasses) on the model. Zero config, works out of the box. admin_search_fields: defers to each ModelAdmin's existing get_search_results(), so it respects the search_fields you've already set up. The part I like: it's permission-aware out of the box. Users only see results for the apps and models they actually have view permission on, so you're not leaking anything through search. Results appear as you type, with throttling/debouncing so you're not hammering the server on every keystroke, and it's full keyboard nav: cmd+k to open, up/down to move, enter to go. It's responsive, does dark and light mode, and it pulls Django's built-in admin CSS variables so it just matches whatever admin theme you're running. Under the hood it's Alpine.js, but bundled into static so there's no external CDN dependency. Setup is about what you'd expect: pip install django-admin-site-search, add it to INSTALLED_APPS, mix the AdminSiteSearchView into your AdminSite, and drop a few template includes into base_site.html. Supports Python 3.8 through 3.14 and Django 3.2 through 6.0, MIT licensed, and everything is overridable if you want to skip certain models, add TextField matching, etc. Calvin #3: Qwen 3.6 27B is the sweet spot for local development Qwen 3.6 27B is being called the first local model that genuinely competes as a general-purpose intelligence — benchmarks put it at roughly mid-2025 frontier level (comparable to GPT-5 / Claude Sonnet 4.5) Runs locally via llama.cpp; on an M5 MacBook Max with 8-bit quantization + multi-token prediction, it hits ~32 tokens/sec using ~42GB RAM 4-bit quantization gets it under 18GB, runnable on 32GB devices; Nvidia RTX cards run it even faster The dense 27B is recommended over the faster MoE 35B A3B — author prefers higher quality output over raw speed Privacy and reliability are the pitch: fine-tunable, can't be taken down, suitable for sensitive/proprietary data Author sees this as a stepping stone — frontier open-weight models like GLM 5.2 are now locally runnable with company-grade hardware, and smarter-still local models are coming Michael #4: A large batch of PEPs are finalized A bunch of PEPs went from accepted to final. 668, 687, 691, 699, 701, 703, 728, 770, 773, 829 But this wasn't them making their way into CPython. It's an admin sorta thing. (Thanks PyCoders) See the commit. Extras Calvin: More fun bling for your terminal this time - https://charm.land/ Michael: Follow up from pls, What the pls? Thanks Pito. Joke: BEMoji A production-grade utility and component framework built entirely on emoji class names via Jeff Triplett

This episode is a fun crossover from our Python news and tips podcast, Python Bytes. We have had some big changes over there. Brian Okken has moved on and Calvin Hendryx-Parker has joined the show as the new co-host. To kick off this new era, we decided to do a longer and more personal episode called "All Our Tools". The idea is both of us talk about some of our most useful day-to-day developer and business owner tools that we think you all would find useful. It was so well received, that I'm bringing it to you all as a crossover episode. Enjoy and we hope you find something new and awesome to help you with your software and data science day to day. Episode sponsors Sentry Error Monitoring, Code talkpython26 Python in Production Talk Python Courses Links from the show @calvinhp@sixfeetup.social: sixfeetup.social @calvinhp.com: bsky.app calvinhp.com: calvinhp.com Original airing on Python Bytes: pythonbytes.fm pi: pi.dev superpowers: github.com Warp.dev: Warp.dev OhMyZSH: ohmyz.sh Commandbookapp.com: Commandbookapp.com Blink: blink.sh kitty: sw.kovidgoyal.net mosh: mosh.org tmux: github.com Claude code: www.anthropic.com Claude.md: Claude.md MacWhisper: goodsnooze.gumroad.com Handy: handy.computer Tailscale: tailscale.com Talk Python episode with Alex: talkpython.fm Telescopo: www.telescopo.app Typora markdown: typora.io formal documentation for many of my open source packages: mkennedy.codes Great Docs: posit-dev.github.io Statement on the US government directive to suspend access to Fable 5 and Mythos 5: www.anthropic.com No second date: x.com Watch this episode on YouTube: youtube.com Episode #553 deep-dive: talkpython.fm/553 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Backup Docker volumes locally or to any S3 Pyodide 314.0 Release nb-cli: A Command-Line Interface for AI Agents and Notebook Automation Hindsight Agent Memory That Learns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python AWS Community Day Midwest tomorrow Wednesday the 24th in downtown Indianapolis, Six Feet Up is sponsoring and there are 2 Sixies presenting Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an bonus digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Backup Docker volumes locally or to any S3 Via Bryan Weber (thanks Bryan!), who spotted it over on Virtualization HowTo. Find Bryan at bryanwweber.com. offen/docker-volume-backup is a lightweight companion container that backs up the volumes your apps actually depend on, then ships them somewhere safe. It's tiny: written in Go and about 25MB compressed, roughly 1/20th the size of the shell-based image (jareware/docker-volume-backup) that inspired it. Drop it into your docker compose file as a backup service, mount the volumes you care about as read-only, and you're off. Push backups to a pile of destinations: a local directory, plus any S3, WebDAV, Azure Blob Storage, Dropbox, Google Drive, or SSH-compatible target. Mix and match as many as you want in one run. Recurring cron-style backups in a Compose setup, or one-off backups straight from the Docker CLI. Production-friendly touches worth calling out: Rotates away old backups so you don't quietly fill the disk. GPG encryption for your archives. Notifications on finished and failed runs (so you find out about failures before you need the backup). Stop a container during backup for a consistent snapshot using a simple docker-volume-backup.stop-during-backup=true label, then auto-restart it. Run custom commands during the backup lifecycle (great for a database dump before the file copy). Docker Swarm support, plus arm64 and arm/v7 builds. Hello, Raspberry Pi homelab. Fun aside from Bryan: he searched our back catalog for this tool and the search came back so fast he thought it hadn't run. Love to hear it. Calvin #2: Pyodide 314.0 Release PEP 783 is the real news — Pyodide maintainers used to hand-build 300+ packages. Now anyone can publish Pyodide wheels to PyPI with cibuildwheel. The version jump from 0.29 to 314.0 is intentional — it now tracks the Python version, so 314.x = Python 3.14. Binary compatibility is locked per Python cycle, meaning packages you build today won't break on the next Pyodide release. sqlite3, ssl, and lzma are back in the default stdlib — no more await pyodide.loadPackage("sqlite3"). Bigger download, but a much smoother experience for newcomers. bigint precision bug is fixed — values above 2^53 were silently losing precision when crossing the Python/JS boundary. The new JsBigInt type makes the roundtrip correct. Worth flagging if anyone is doing numeric work in a browser app. Experimental TCP sockets in Node.js — you can now connect Pyodide to a real database (MySQL, PostgreSQL, Redis tested) when running server-side. Blurs the line between "Python in the browser" and "Python runtime anywhere Wasm runs." Michael #3: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation From Piyush Jain (Jupyter and LangChain maintainer) on the Jupyter blog: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation. nb-cli is an experimental, Rust-based CLI to read, write, execute, and search Jupyter notebooks. The premise: agents are great at CLIs but terrible at hand-editing the nested JSON in an .ipynb, so let them operate on the notebook from the outside instead of running inside it. Works with or without a Jupyter server. No server? It reads/writes .ipynb files directly and talks to kernels over ZeroMQ. Connected to a live JupyterLab, your edits show up instantly via Y.js (the same CRDT Jupyter uses). Smart output format: instead of token-heavy JSON or ambiguous plain markdown, it uses @@cell / @@output sentinels with inline metadata. Less wasted context, unambiguous structure, and it degrades gracefully on truncation. The payoff is composability. "Add a summary section and run it" becomes one shell pipeline instead of six agent tool calls. And nb search notebook.ipynb --with-errors returns only the failing cells, so the agent skips the cells that worked. Claude Code tie-in: it ships as an agent skill. npx skills install jupyter-ai-contrib/nb-cli and your agent can drive notebooks via nb. Out of jupyter-ai-contrib, which aims to become an official Jupyter AI subproject. Still early (crates.io is at v0.0.5), so kick the tires before anything load-bearing. See also marimo-pair. Calvin #4: Hindsight Agent Memory That Learns AI agents forget everything between sessions — Hindsight gives them persistent memory that learns over time Simple three-method API: retain(), recall(), reflect() — store, retrieve, and reason over memories TEMPR retrieval runs semantic, keyword, graph, and temporal search in parallel for accurate results Automatically consolidates related facts into durable observations instead of piling up duplicates pip install hindsight-all runs the entire server in-process; integrates with LangChain, LlamaIndex, Pydantic AI, CrewAI, and more Extras Calvin: Clanker: A Word For The Machine **Ponytail — You know him. Long ponytail. Oval glasses. Has been at the company longer than the version control** **Klangk: Multi-User AI Sandboxing, Collaboration and Coding Platform** Cursor announces Origin performative-ui to quick start your new idea Michael: Astral Joins OpenAI: The Interview SpaceX to acquire Cursor And OpenAI renews Open Source support Portuguese subtitles are now available for Talk Python courses DSF is hiring including Six Feet Up support Joke: Oh Babe…

OpenAI just acquired Astral, the company behind uv, Ruff, and ty. And if your first thought was "wait, is uv toast?", you are not alone. But here's the twist Charlie Marsh shared with me: he thinks they may ship more open source at OpenAI than they ever did at Astral. On this episode, we get into the acquisition, the mixed feelings, the future of your favorite Python tools, and what it's like to build right at the center of the AI universe. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show Guest Charlie Marsh: github.com The announcement: astral.sh OpenAI: openai.com uv: github.com ty: github.com Ruff: github.com pyx: astral.sh Codex team: openai.com Anthropic did something similar by acquiring Bun: www.anthropic.com Daily Stars Explorer: emanuelef.github.io Agentic AI Programming for Python: training.talkpython.fm Python Web Security: OWASP Top 10 with Agentic AI: training.talkpython.fm Episode #552 deep-dive: talkpython.fm/552 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: pi + superpowers Terminal: Warp.dev + OhMyZSH {Blink,kitty} + mosh + tmux Claude code MacWhisper or Handy Tailscale Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training Six Feet Up is hosting a LinkedIn Live Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Calvin: @calvinhp@sixfeetup.social / @calvinhp.com (bsky) Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: pi + superpowers terminal-first, open-source coding agent Session management is a first-class citizen Extension model is what makes pi special — it's aggressively composable Superpowers brings a structured software development methodology as loadable skills Steps back and asks you what you're really trying to do “hand you the keys to the car” mode vs guardrails might not be for everyone Michael #2: Terminal: Warp.dev + OhMyZSH If you're using the base terminal with default settings, you have so much head-room for improvement. I've been using Warp.dev since Elvis talked me into it. ;) Remarkable terminal but the AI side of things is a bit junky, can be turned off OhMyZSH gives better autocomplete e.g. git branch [HTML_REMOVED] lists all branches in the local repo! Commandbookapp.com is excellent to keep the terminal focused on terminal things and more server commands and other automation in Command Book. Calvin #3: {Blink,kitty} + mosh + tmux Kitty Terminal — GPU-accelerated terminal emulator for macOS, Linux, and Windows with support for graphics, ligatures, and a powerful tiling layout system built right in. Blink Shell — The go-to terminal for iPad/iPhone power users; full SSH and Mosh client with a gorgeous interface built specifically for mobile professional workflows. Mosh — Mobile Shell replaces SSH for remote connections, surviving network switches, sleep cycles, and flaky Wi-Fi with zero dropped sessions — essential for staying connected to long-running agentic jobs. tmux — Terminal multiplexer that keeps sessions alive on your Linux server indefinitely; detach from a Mosh session on your Mac, reconnect from your iPad, and your agent is right where you left it. The combo — Kitty or Blink + Mosh + tmux creates a "persistent remote brain" pattern: your beefy Linux homelab runs the compute-heavy agent sessions 24/7, and any device becomes a thin client to drop in and out at will. Michael #4: Claude code I prefer the IDE experience, the new PyCharm + Claude integration is really good. VS Code too. Why IDE? Because we should still be present with our code and managing context is much easier. Use the best/latest models on high thinking. “Speed” is not your friend, it's just shortcuts. Create skills and agents and use them. Curate your own rules (e.g. Talk Python's Claude.md) Works well on non-coding things. Just create a folder, put a ton of files in there and it's like NotebookLM + Chat + more. Calvin #5: MacWhisper or Handy Transcribes your speech using your choice of Whisper or Parakeet models. All transcription is done on your device, no data leaves your machine. Automatic Speaker Recognition with local models. Handy is more basic, but open source and runs on all platforms. Michael #6: Tailscale No need to open ports at all, Tailscale makes machines inside the same network accessible to each other Works great for laptops, desktops, etc. But also available for servers. Though I still use cloud firewalls for servers. How I use it: My dev database server, preloaded with QA data, is always running on my home mac mini m4 pro. All my apps look for that server before looking locally and tailscale makes them always accessible to each other My local LLMs expose OpenAI API compatible APIs. Tailscale makes these accessible even while traveling or at a coffee shop. Use my mini as an exit node. All traffic is routed outbound from my local fiber network. Great to restricted IPs like accessing my servers without caring about the local IP. Screen share back to my home machines even while traveling. Listen to the Talk Python episode with Alex for a deeper conversation. Extras Calvin: Telescopo great Mac Markdown viewer/editor. Michael: One more: Typora markdown editor. Created formal documentation for many of my open source packages using Great Docs. Via Mark Little: Statement on the US government directive to suspend access to Fable 5 and Mythos 5 Joke: No second date

If you've ever been to PyCon, you know one of the best parts of the expo hall is Startup Row, a stretch of booths where early-stage companies built on Python show off what they're creating. But only attendees get to walk that lane, so let's bring it to everyone. In this episode, we stroll down Startup Row together. We kick things off with the organizers, Jason and Shay, who share the program's origin story going back to Paul Graham and the PSF, plus some surprising stats, including two unicorns among the alumni. Then we meet five startups: Tetrix, bringing AI to institutional investing in private markets. Arcjet, security that lives inside your app as an SDK. Phemeral.dev, serverless hosting built for Python web apps. CapiscIO, an identity and authority layer for AI agents. And Pixeltable, a multimodal database from Marcel Kornacker, co-creator of Apache Parquet. See if you can spot the theme running through them all. Let's go for a walk. Episode sponsors AgentField AI Talk Python Courses Links from the show Guests Naunidh Bhalla: linkedin.com Grant Gittes: linkedin.com Marcel Kornacker: linkedin.com Beon de Nood: linkedin.com Chinmaya Joshi: linkedin.com David Mytton: linkedin.com Shea Tate-Di Donna: linkedin.com Jason Rowley: linkedin.com Azul Garza: github.com Renée Rosillo: linkedin.com Tetrix: tetrix.co Tetrix Jobs: tetrix.co Arcjet: arcjet.com Pixeltable: pixeltable.com Phemeral.dev: phemeral.dev CapiscIO: capisc.io Episode #551 deep-dive: talkpython.fm/551 Episode transcripts: talkpython.fm Theme Song: Developer Rap

In this episode, Python Developer Advocate and author Will Vincent joins the hosts to discuss the lasting appeal of Django, changes in how people learn web development, and the ways AI is reshaping software engineering. While modern AI tools can generate working code in seconds, Django's opinionated design and emphasis on maintainability help developers avoid many of the security and architectural problems that often emerge as projects grow. Drawing on his background as an educator, author, and Developer Advocate at JetBrains, Will shares his perspective on the challenges facing today's developers and computer science students. The conversation touches on "vibe coding," the misconception that a successful prototype automatically translates into a production-ready application, and the increasing burden AI-generated content is placing on open-source maintainers. Will also discusses the rise of specialized AI models, the importance of human trust in technical communities, and why foundational software engineering skills remain valuable despite rapid advances in AI tooling. Key Topics Covered Why Django Still Matters A look at why Django continues to be a strong choice for building production applications, even if it doesn't receive the same level of attention as newer frameworks. The Reality Behind "Vibe Coding" Exploring the gap between generating code with AI and understanding the systems, tradeoffs, and architecture required to build reliable software. Learning to Program as an Adult Will reflects on his path from book editing and startup leadership to becoming a self-taught programmer, educator, and author. AI and Programming Education A discussion about how AI changes the learning process, why fundamentals still matter, and how concepts like music theory can help explain the value of understanding code beneath the surface. The Growing Burden on Open Source How maintainers are dealing with an influx of low-quality AI-generated issues, pull requests, and content, and what that means for community-driven projects. Local and Specialized AI Models Why privacy concerns, lower inference costs, and better hardware may drive adoption of smaller, task-focused models rather than ever-larger general systems. Developer Concerns in the AI Era How engineers are responding to growing pressure from leadership teams eager to adopt AI, and what trends JetBrains is seeing across the developer ecosystem. Resources Mentioned LearnDjango, Will Vincent's platform for learning Django and web development. Hello World 5 Different Ways, a Django tutorial that introduces key concepts through practical examples. Django Chat, the podcast Will co-hosts covering the Django ecosystem and web development. Django News, a weekly newsletter highlighting updates from the Django community. JetBrains, the software development company behind tools such as PyCharm and IntelliJ IDEA.Special Guest: Will Vincent.

Topics covered in this episode: Vulnerability and malware checks in uv HTTP GET requests with the Python standard library Millions of AI agents imperiled by critical vulnerability in open source package alembic-git-revisions Extras Joke Watch on YouTube About the show Goodbye and Thanks Brian Thanks Calvin for being part of this and future episodes! Also new time for the live show. Thanks Brian for all the hard work over the years. Calvin #1: Vulnerability and malware checks in uv release just yesterday by Astral https://astral.sh/blog/uv-audit uv audit scans dependencies for known vulnerabilities and abandoned packages via the OSV database — runs 4–10x faster than pip-audit Malware check runs on every install/sync, catching actively malicious packages (credential stealers, etc.) before they execute — including ones PyPI quarantined but lockfiles can still reference Enable malware scanning with UV_MALWARE_CHECK=1 — it's opt-in and in preview Future roadmap includes a resolver that steers toward vulnerability-free versions and install-time warnings scoped to newly added deps only Michael #2: HTTP GET requests with the Python standard library If you're doing HTTP in Python, you're probably using one of three popular libraries: requests, httpx, or urllib3. There have been issues with httpx lately. Niquest is another option: Drop-in replacement for Requests. Automatic HTTP/1.1, HTTP/2, and HTTP/3. WebSocket, and SSE included. But maybe less is more, especially in the age of agentic AI A good candidate needs two things to be true at once, not one: the used surface is small, and the behavior behind that surface is shallow. Calvin #3: Millions of AI agents imperiled by critical vulnerability in open source package "BadHost" (CVE-2026-48710) is a critical vulnerability in Starlette — the ASGI framework underlying FastAPI — with 325 million weekly downloads; also affects vLLM, LiteLLM, and most MCP server tooling The exploit is trivial: injecting a single character into an HTTP Host header bypasses path-based authentication, and can lead to credential theft, SSRF, and in some cases remote code execution MCP servers are a prime target since they store credentials for external services (email, databases, cloud accounts) — exposed data in the wild includes biopharma clinical trial DBs, full mailboxes, HR/PII pipelines, and AWS topology Fix is available — patch to Starlette 1.0.1 immediately; use the free scanner at mcp-scan.nemesis.services to check if your servers are still running a vulnerable version Open source sustainability footnote: the maintainer triages near-daily security reports solo, in his free time — most are AI-generated noise, and real ones like this still compete for the same evenings and weekends Michael #4: alembic-git-revisions By Julien Danjou from Mergify Automatic Alembic migration chaining based on git commit history. No more Multiple head revisions are present for given argument 'head'. See the introductory article Caused by two migrations landed with the same down_revision, and Alembic doesn't know which one comes first. The fix is always the same: someone manually edits the migration file to re-chain the revisions. The insight: git already knows the order Extras Calvin: GNU make can do pattern matching in the target. Not new at all, mentioned in the 1994-era docs. just and task don't have this super power on the target name yet. train-%: uv run ./train.py $* --save-hyper-params --overwrite $(TRAIN_ARGS) Michael: Updated my HTTP client using packages from httpx to httpx2: listmonk, umami, and memberful. For motivation, see this reddit thread. Joke: Accurate

Topics covered in this episode: CVE-2026-48710: A Maintainer's Perspective daily-stars-explorer Markdown to pdf with pandoc and typst postman2pytest Extras Joke Watch on YouTube About the show Brian #1: CVE-2026-48710: A Maintainer's Perspective Marcelo Trylesinski suggested by Lee Luocks Short version: users of Starlette: upgrade to Starlette 1.0.1 security professionals: we can't treat open source projects like corporations This top link is a Starlette security advisory with the title Missing Host header validation poisons request.url.path, bypassing path-based security checks The CVE apparently caused some negative press targeting starlette. However, “the vulnerability came from the application pattern and the deployment, never from something Starlette intended.” A quote from an OSTIF article: “This bug is a classic “responsibility gap” where if this maintainer didn't patch, thousands of exposed projects would have to individually secure their projects. In doing this work, they've voluntarily taken on the responsibility to protect the ecosystem from long-term systemic harm. As with all open source projects, they owed us nothing and could have left this to be everyone else's problem and took the extraordinary steps of helping the ecosystem.” Both X40 D-Sec and Ars Technica expected immediate fixes and responses from Starlette. That's not good. We can do better. Michael #2: daily-stars-explorer Explore the full history of any GitHub repository.

You wake up, brew the coffee, open GitHub, and there it is. Another pull request on your open source project. Thirteen thousand lines added. No issue filed first. No discussion. Just "here, please review this for me." Over the past year, GitHub activity has spiked roughly twelve times in a few short months, and a huge chunk of that signal is landing on the same small group of maintainers who were already stretched thin. The curl bug bounty got buried under AI-generated noise. Jazzband, the home of Django classics like pip-tools and the Django debug toolbar, hit what its maintainer called an "apocalypse" and started sunsetting. Even CPython just shipped fresh guidelines on AI-assisted contributions this week. So what does all of this actually look like from the receiving end of the pull request? On this episode, Paolo Melchiorre joins us to tell that story from inside the maintainer's chair. Paolo is a director of the Django Software Foundation, an organizer of PyCon Italy, a Django Girls coach, and he has spent the past year carefully collecting examples of how AI is reshaping open source contributions. The good, the bad, and the extra fingers. We dig into his PyCon US talk on AI-assisted contributions and maintainer load, why AI is best understood as an amplifier rather than a new kind of contributor, the wildly different policies across 86 open source foundations, whether projects banning AI today are reacting to last year's models. Episode sponsors AgentField AI Talk Python Courses Links from the show Guest Paolo Melchiorre: github.com DSF: www.djangoproject.com djangonaut-space: djangonaut.space PyCon Italia: 2026.pycon.it uDjango: github.com My PyCon US 2026 post: www.paulox.net AI-Assisted Contributions and Maintainer Load: www.paulox.net Senior Engineer Tries Vibe Coding: www.youtube.com Code Rabbit AI PR Reviews: www.coderabbit.ai GitHub Usage Graphs: github.blog Update on CPython's AI Policies: fosstodon.org High-Quality Chaos from Curl: daniel.haxx.se The Generative AI Policy Landscape in Open Source: redmonk.com Watch this episode on YouTube: youtube.com Episode #550 deep-dive: talkpython.fm/550 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Your documentation has two audiences now - humans reading the rendered HTML, and AI agents trying to make sense of your library. Rich Iannone and Michael Chow from Posit are back on Talk Python with a brand new Python documentation tool called Great Docs that takes both seriously. Rich is the creator of Great Tables, and before that the R package GT, the man has a serious eye for design, and he's pointed that energy at the Python docs ecosystem. We'll talk about how Great Docs spins up a polished site in three commands, why every page ships as Markdown for your favorite LLM, how it leans on Quarto for executable code blocks and tabbed install sections, and where it lands against Sphinx, MkDocs, and Zensical. Plus, you'll meet Tablin. Here we go. Episode sponsors Sentry Error Monitoring, Code talkpython26 Temporal Talk Python Courses Links from the show Guests Michael Chow: github.com Rich lannone: github.com Python Web Security with OWASP Top 10 and Agentic AI Course: talkpython.fm Great Docs: posit-dev.github.io/great-docs Great Tables: posit-dev.github.io GT Episode: talkpython.fm Sphinx: www.sphinx-doc.org mkdocs: www.mkdocs.org Zensical: zensical.org Hugo: gohugo.io Ghost: ghost.org Rs pkgdown: pkgdown.r-lib.org Quarto: quarto.org quickstart: posit-dev.github.io llms.txt file: llmstxt.org llms.txt: talkpython.fm mcp: talkpython.fm cli: talkpython.fm Watch this episode on YouTube: youtube.com Episode #549 deep-dive: talkpython.fm/549 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Dumb Ways for an Open Source Project to Die How to create a pylock.toml lockfile https://github.com/facebook/Lifeguard Choosing a Python Logging Library in 2026 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Dumb Ways for an Open Source Project to Die Core categories The maintainer left The maintainer is still there Sabotage and capture The release pipeline broke Force majeure The world moved on The project split - Examples Bulma PRs still from 2023, issues and PRs with no maintainer response for years, last release 1.5 years ago diskcache Similar, got hired by OpenAI, crickets after that Brian #2: How to create a pylock.toml lockfile Tim Hopper Tim walks through using uv, pip and pdm to create pylock.toml files. Recommendation: use uv export --format pylock.toml -o pylock.toml He also has How to install from a pylock.toml lockfile with pip but the short version is: use -r because tools treat it like a requirements file Michael #3: https://github.com/facebook/Lifeguard Lifeguard is a static analyzer to detect Lazy Imports incompatibilities and ease the adoption overhead for Lazy Imports in Python. I'm more excited about lazy imports after my Cutting Python Web App Memory Over 31% experience Some Python patterns depend on imports executing immediately. For example: Module-level side effects — a module that registers a handler or modifies global state at import time will behave differently if that import is deferred. The registry pattern — a module that registers itself (e.g., adding to a global dict) when imported will silently fail to register under Lazy Imports. sys.modules manipulation — code that reads or writes sys.modules assumes prior imports have already executed. Metaclasses and __init_subclass__ — class creation side effects may depend on imports being resolved. Project Stage: Beta Lifeguard is in active development. We are aiming to be ready for general use by the Python 3.15 final release. Brian #4: Choosing a Python Logging Library in 2026 Ayooluwa Isaiah " which libraries matter, how they compare, where they overlap with the standard module, and when each one makes sense.” The slant with this article is the need to log json output, which seems reasonable as things like API entry and exit point logging will include json. Covered libraries standard library logging with a hat tip to python-json-logger Same site has a guide to setting up python-json-logger structlog Loguru Logbook picologging Some benchmarks with structlog, stdlib+json, and Loguru, with structlog coming out faster I liked the Loguru example I'm going to have to try @logger.catch and logger.exception() for easily logging exceptions and serialize=True to enable JSON output. Extras Brian: When Women Stopped Coding - Planet Money segment , spotted on BlueSky from Savannah Ostrowski Lean TDD is now leaner Still working on audio version, but some great changes in 0.7.1 version Ch 6, TDD Interpretations, move ATDD and some of BDD to chapter Ch 7, Change name to TDD with Teams: BDD and ATDD Ch 9, Lean TDD, streamline steps and chapter Ch 10, Change name to Lean TDD with Teams: Lean ATDD Ch 11, Lean TDD with AI, Add short discussion about guardrails and security Michael: New course: Python Web Security: OWASP Top 10 with Agentic AI All courses now with Spanish subtitles, see announcement Joke: Stop texting me

Topics covered in this episode: Using Django Tasks in production Co-authored with Claude? PyPI packages are increasing rapidly httpx2 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Using Django Tasks in production Tim Schilling shares how the Djangonaut Space website has been using Django's new tasks framework and some of the info missing from the official Django docs. Tasks require a third party package, django-tasks-db to actually run the tasks. Article walks through all changes necessary to get an email process running to notify admins of new testimonials. Cool simple example. With the db backend, you can monitor progress of tasks in the admin, to see which tasks are scheduled, completed, or have errors. Some wishes for the community to implement new tutorial in the Django docs Django Debug toolbar panel for tasks test/mock backend Great title for wish list: Thinks I'd like to see, but I'm too lazy to implement myself. Michael #2: Co-authored with Claude? Via Nik T. We don't put “executed on macOS”, “edited with PyCharm”, etc. in our commits. Why Claude? Seems like a growth hack to me, that I don't really care to participate in. Some projects that have formalized their thoughts on this: The Generative AI Policy Landscape in Open Source Adjust to turn off in ~/.claude/settings.json see the docs. { "attribution": { "commit": "", "pr": "" } } Brian #3: PyPI packages are increasing rapidly Artem Golubin There's been an increase of published packages per week on PyPI A pretty big increase in the last handful of months. 30% increase since 2025, clearly due to AI Artem is building hexora, a malicious Python code detector. Cool package too, it can: Audit project dependencies to catch potential supply-chain attacks Detect malicious scripts found on platforms like Pastebin, GitHub, or open directories Analyze IoC files from past security incidents Audit new packages uploaded to PyPi. Artem is using hexora to analyze recently published pypi packages and many are obviously vibecoded and trigger false positives for abuses of eval, exec, and subprocess Side note: I don't think that's necessarily a false positive. Not malicious, but maybe a stupid-code-detector? Lots are LLM related, Lots have bots contributing code Publishing rate is crazy, dozens to hundreds of published versions in a day is a bug, not a feature Brian's proposal, PyPI should limit releases per day for any package to something a sane human would do, even if they make a mistake on a release, to maybe like 2-3, definitely under 10, in a day. And if the repo has obvious agent contributors listed, maybe lower to the limit to 1-2 a day? Honestly, “move fast and break things” doesn't apply to breaking the commons. Michael #4: httpx2 More on the httpx, httpxyz, etc changes: Pydantic people started their own fork, httpx2. Michiel says “while we think httpxyz was definitely needed, we welcome httpx2 and think it should be the ‘blessed' fork.” Kludex, who is among other things maintainer of Starlette, was considering a fork As it stands, httpx2 is lacking the performance improvements they added to httpxyz. But it will not be long before they will add those, too. Also they already made some smart decisions: they are switching from certifi to truststore they are switching to compression.zstd on Python 3.14+, enabling zstd compression by default they merged httpcore and vendored it in their repository Discussion on Hacker News Extras Brian: The Four Horsemen of the LLM Apocalypse - Anarcat Django/JetBrains 2026 developer survey is open Pyrefly 1.0 : “meaning we are confident that Pyrefly is ready for production use.” Michael: Just about ready to release Python Web Security: OWASP Top 10 with Agentic AI course. Be sure to be on the courses newsletter to get notified. Joke: Proud Parents

What if your database worked more like Git? Every change captured as an immutable event you can replay, instead of a single mutating row that quietly forgets its own history. That's event sourcing, and Chris May is back on Talk Python, fresh off our Datastar panel, to walk us through what it actually looks like in Python. We'll cover the core patterns, the libraries to reach for, when not to use it, and why event sourcing turns out to be a surprisingly good fit for AI-assisted coding. Episode sponsors Sentry Error Monitoring, Code talkpython26 Temporal Talk Python Courses Links from the show Guest Chris May: everydaysuperpowers.dev Intro to event sourcing e-book: everydaysuperpowers.gumroad.com Domain-Driven Design: The Power of CQRS and Event Sourcing: How CQRS/ES Redefine Building Scalable System: ricofritzsche.me DDD: www.amazon.com Understanding Eventsourcing (Martin Dilger): www.amazon.com Event Sourcing Explained using Football Video: www.youtube.com Why I finally embraced event sourcing and why you should too article: everydaysuperpowers.dev valkey: valkey.io diskcache: talkpython.fm eventsourcing package: github.com eventsourcing docs: eventsourcing.readthedocs.io John Bywater: github.com Datastar: data-star.dev Microconf: microconf.com Event Modeling & Event Sourcing Podcast: podcast.eventmodeling.org Python Package Guides for AI Agents: github.com Iodine tablets AI joke: x.com KurrentDb: www.kurrent.io Watch this episode on YouTube: youtube.com Episode #548 deep-dive: talkpython.fm/548 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: httpxyz one month in Learn concurrency - a deep dive into multithreading with Python pip 26.1 - lockfiles and dependency cooldowns Python 3.15 sentinal values from PEP 661 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: httpxyz one month in First version of httpxyz contained just the fixes to get zstd working, and the fixes to get the test suite running on python 3.14, some ‘housekeeping' changes related to the renaming End of March: a compatibility shim that allows you to use httpxyz even with third-party packages that import httpx themselves, as long as you import httpxyz first. Importing httpxyz automatically registers it under the httpx name in sys.modules , see https://httpxyz.org/httpx-compatibility/ Fixed a WHOLE bunch of performance related issues by forking httpcore Brian #2: Learn concurrency - a deep dive into multithreading with Python Nikos Vaggalis “Whenever you are trying to speed up code using multiple cores, always ask yourself: “Do these threads need to talk to each other right now?” If the answer is yes, it will be slow. The best parallel code splits a big job into completely isolated chunks, processes them separately, and merges the results at the finish line.” Good overview of thread concurrency with Python and how that's been improved dramatically with free-threaded Python Defines lots of terms you come across, including “embarrassingly parallel multithreading” There's a counter example that's nice Start with a shared resource, a counter, and multiple threads updating it Attempt to fix with threading.Lock(), which fixes it, but slows things down Good explanation of why Proper fix with concurrent.futures and separating the work of different threads so that they can be independent and their results can be combined when they're all finished. Michael #3: pip 26.1 - lockfiles and dependency cooldowns Python 3.9 is no longer supported Experimental: installing from pylock files Dependency cooldowns (see my post about this) Lifting several 2020 resolver limitations Brian #4: Python 3.15 sentinal values from PEP 661 MISSING = sentinel("MISSING") def next_value(default: int | MISSING = MISSING): ... if default is MISSING: ... Take a name str as a constructor parameter Intended to be compared with is operator, similar to None Sentinal objects can be used as a type, also similar to None and can be combined with other types with |. Unlike None, sentinal values are truthy. (Elipses ... are also truthy) This seems like a strange choice. but I guess it must have made sense to someone. It does force you to use is instead of depending on False-ness, so I guess it'll make code using sentinels more readable. Interesting that the PEP was started in 2021, and we're finally getting it this year. Extras Brian: Before GitHub - Armin Ronacher tenacity - cross-platform multi-track audio editor/recorder learned about it from Armin's article Joke: Joke option Make it myself Seems similar to what people think about software now Links httpxyz one month in httpxyz.org/httpx-compatibility Learn concurrency - a deep dive into multithreading with Python pip 26.1 - lockfiles and dependency cooldowns my post about this Python 3.15 sentinal values from PEP 661 Before GitHub tenacity Make it myself

When OpenAI trained GPT-3, they didn't roll their own orchestration layer. They used Ray, an open source Python framework born out of the same Berkeley research lab lineage that gave us Apache Spark. And here's the twist: Ray was originally built for reinforcement learning research, then quietly faded as RL hit a wall. Until ChatGPT showed up. Suddenly reinforcement learning was back, as the post-training step that turns a raw language model into something genuinely useful. Edward Oakes and Richard Liaw, two founding engineers behind Ray and Anyscale, join me on Talk Python to tell that story. We'll trace Ray from its RISE Lab origins at UC Berkeley to powering some of the largest training runs in the world. We'll talk about what Ray actually is, a distributed execution engine for AI workloads, and how a few lines of Python become work running across hundreds of GPUs. We'll cover Ray Data for multimodal pipelines, the dashboard, the VS Code remote debugger, KubRay for Kubernetes, and where Ray fits alongside Dask, multiprocessing, and asyncio. If you've ever stared at a single-machine Python script and thought, "there has to be a better way to scale this", this one's for you Episode sponsors Sentry Error Monitoring, Code talkpython26 AgentField AI Talk Python Courses Links from the show Guests Richard Liaw: github.com Edward Oakes: github.com Ray: www.ray.io Example code (we used for walk-through): docs.ray.io Getting Started with Ray: docs.ray.io Ray Libraries: docs.ray.io kuberay: github.com Watch this episode on YouTube: youtube.com Episode #547 deep-dive: talkpython.fm/547 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: profiling-explorer Reverting the incremental GC in Python 3.14 and 3.15 VSCode AI Co-author defaults to on, then off django freeze Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: profiling-explorer Adam Johnson And intro post Python: introducing profiling-explorer “profiling-explorer is a tool for exploring profiling data from Python's built-in profilers, which are stored in pstats files. ” Features Dark mode Click the calls, internal ms, or cumulative ms column headers to sort by that column. Use the search box to filter by filename or function name. Hover by a filename + line number pair to reveal the copy button, which copies the location to your clipboard for faster opening. Click the callers or callees links on the right of a row (not pictured above) to see the callers or callees of that function. Michael #2: Reverting the incremental GC in Python 3.14 and 3.15 Python 3.14 shipped with a new incremental garbage collector, but production reports of severe memory pressure (Neil Schemenauer measured up to 5× peak RSS on pathological cyclic workloads) have pushed the core team and Steering Council to revert it in both 3.14 and 3.15 - returning to the 3.13-era generational GC. This is the second time the inc GC has been pulled back: it was also reverted right before 3.13.0 final, and it shipped in 3.14 without going through the PEP process. The tradeoff is real: Neil's benchmarks showed max GC pause times of 1.3ms with inc GC versus 26ms with the generational one - great for latency-sensitive apps, terrible for memory-constrained ones. Release manager Hugo van Kemenade will ship 3.14.5 early with the revert, and Gregory Smith floated the idea of a 3.14.5rc1 - the first patch-release RC since 3.9.2 back in 2021. Tim Peters spent the thread doing live forensics on Windows, running a toy deque program that should cap at 1GB and watching it balloon to 15.6GB on a 16GB machine - and discovered the gen0 collector effectively never fires under the new scheme. Tim's bigger meta-point: CPython has a chronic shortage of real-world GC benchmarks, pyperformance has "basically no interesting" cyclic workloads, and users almost never share real data - so core devs keep flying blind on changes like this. Django maintainer Adam Johnson published a blog post mid-thread documenting a real memory "leak" in Django's migration system caused by inc GC, with a manual gc.collect() workaround - the listener-facing receipt that this wasn't just theoretical. If the inc GC comes back for 3.16, it'll go through a proper PEP, and the discussion is already shifting toward keeping both collectors available via a startup flag - which Neil and Sergey Miryanov have both prototyped. Brian #3: VSCode AI Co-author defaults to on, then off VSCode merges Enabling ai co author by default - 3 week ago Ton's of “why would you do this” and related comments VSCode merges Change default for git.addAICoAuthor to off - yesterday Take-away, don't rely on default, set addAICoAuthor to off yourself Michael #4: django freeze Convert your dynamic django site to a static one with one line of code. Just run python manage.py generate_static_site :) Features Generate the static version of your Django site, optionally compressed .zip file Generate/download the static site using urls (only superuser and staff) Follow sitemap.xml urls Follow internal links founded in each page Follow redirects Report invalid/broken urls Selectively include/exclude media and static files Custom base url (very useful if the static site will run in a specific folder different by the document-root) Convert urls to relative urls (very useful if the static site will run offline or in an unknown folder different by the document-root) Prevent local directory index Extras Brian: Thinking Less, Trusting More: GenAI's Impacts on Students' Cognitive Habits Michael: Vercel breached, employee to blame Introducing the new Talk Python web player GitHub uptime (a couple of views 1, 2) Joke: Friends in tech

The cloud is convenient until it isn't. You upload your photos, sync your contacts, click through the cookie banners. Then prices go up again or you read about a family that lost their entire Google account over a medical photo sent to a doctor. At some point, the question shifts from "why would I run this myself?" to "why aren't I?" My guest this week is Alex Kretzschmar, head of DevRel at Tailscale, longtime host of the Self-Hosted podcast, and co-founder of Linuxserver.io. We cover what self-hosting really means in 2026, the apps worth running yourself like Immich and Home Assistant, why Docker Compose ties it all together, and how Tailscale lets you reach any of it from anywhere, without opening a single port. If you've been thinking about pulling your digital life back behind your own walls, this is your roadmap. Episode sponsors Temporal Talk Python Courses Links from the show Guest Alex Kretzschmar: alex.ktz.me Bitflip podcast: bitflip.show Self-Hosted podcast (Alex's previous show): selfhosted.show Perfect Media Server: perfectmediaserver.com KTZ Systems on YouTube: youtube.com/@ktzsystems Linuxserver.io (co-founded by Alex): linuxserver.io "How Tailscale Works" blog post: tailscale.com/blog/how-tailscale-works https://tailscale.com/: tailscale.com Self-hosted apps discussed Awesome Self-Hosted (GitHub list): github.com Immich (Google Photos alternative): immich.app Home Assistant: home-assistant.io Open Home Foundation: openhomefoundation.org Plausible Analytics: plausible.io Umami Analytics: umami.is Python integration for umami: pypi.org Pi-hole: pi-hole.net AdGuard Home: adguard.com NextDNS: nextdns.io Coolify: coolify.io Docker + ufw: docs.docker.com Storage, backup & filesystem OpenZFS: openzfs.org ZFS.rent (offsite ZFS replication): zfs.rent Backblaze: backblaze.com Hetzner Storage Box: hetzner.com DigitalOcean: digitalocean.com Secrets management mentioned OpenBao (open-source Vault fork): openbao.org HashiCorp Vault: hashicorp.com Bitwarden: bitwarden.com 1Password: 1password.com Hardware mentioned Proxmox VE: proxmox.com Minisforum MS01: minisforum.com Zima Board / Zima OS: zimaspace.com Other references Cory Doctorow on "enshittification" (Cory's blog where he coined the term): pluralistic.net Linus Tech Tips' WAN Show (Linus mentioned NAS-building going mainstream): linustechtips.com Watch this episode on YouTube: youtube.com Episode #546 deep-dive: talkpython.fm/546 Episode transcripts: talkpython.fm Theme Song: Developer Rap

At PyConDE 2026, community leaders, educators, and Python tooling builders explored how Python is evolving in the age of AI — and why human connection, mentorship, and strong fundamentals matter more than ever.Jessica Greene (Ecosia / PyLadies Berlin) spoke about her work as a machine learning engineer and community organizer. She highlighted PyLadies Berlin's role in creating inclusive spaces for learning, networking, and career growth, and emphasized that AI should be seen as an amplification tool—not a replacement for solid engineering or people skills.Cheuk Ting Ho (JetBrains) discussed her role on the PyCharm team, where conferences are key for gathering feedback and staying connected to the community. She shared insights from her talk on free-threaded Python and her approach to technical storytelling across talks, blogs, videos, and informal interviews.Sebastian Raschka reflected on his work as an AI educator focused on “from scratch” explanations of machine learning and LLMs. Driven by curiosity, he prefers creating new talks over repeating old ones and aims to help people understand what happens under the hood—especially with reasoning models.Kyle Into (Meta) introduced Pyrefly, a Rust-based Python type checker designed for large codebases. He explained how type checking improves both human and AI-assisted development by making interfaces explicit, reducing risk, and strengthening project structure.Valerio Maggio shared his journey from data science into developer advocacy and community organizing. He emphasized that conferences rely on volunteers, that lightning talks boost accessibility and energy, and that sustainable processes are essential to avoid burnout.Tereza Iofciu discussed her “Data Diplomat” coaching framework, helping data professionals navigate leadership and uncertainty. She noted that AI and lean teams are raising expectations, making it crucial to think strategically, build fundamentals, and invest in real networks.Irina Saribekova described her transition from organizing Python events in Saint Petersburg to supporting PyData Berlin and PyConDE. She highlighted that conferences are built on trust, relationships, and clear systems—and that developer relations extends this work through talks, writing, and community engagement.Jessica GreeneMachine Learning Engineer at Ecosia, PyLadies Berlin co-organizer, and chair of the PyLadies Germany fund.Connect: ⁠https://www.linkedin.com/in/jessica0greene/⁠Cheuk Ting HoDeveloper Advocate at JetBrains working with the PyCharm team and active in the global Python community.Connect: ⁠https://www.linkedin.com/in/cheukting-ho/⁠Sebastian RaschkaAI educator, author, and machine learning researcher focused on LLMs, reasoning models, and educational “from scratch” implementations.Connect: ⁠https://www.linkedin.com/in/sebastianraschka/⁠Kyle IntoEngineer at Meta working on Pyrefly, a fast Python type checker built for large-scale codebases and AI-assisted development.Connect: ⁠https://www.linkedin.com/in/kyleinto/⁠Valerio MaggioData scientist, developer advocate, community organizer, and long-time contributor to PyCon Italia andPyConDE.Connect: ⁠https://www.linkedin.com/in/valeriomaggio/⁠Tereza IofciuData coach, trainer, community contributor, and creator of the Data Diplomat framework for data professionals and leaders.Connect: ⁠https://www.linkedin.com/in/tereza-iofciu/⁠Irina SaribekovaDeveloper relations specialist and Python community organizer involved in PyData Berlin, PyConDE, and conference community building.Connect: ⁠https://www.linkedin.com/in/irinasaribekova/⁠

Topics covered in this episode: Django Modern Rest Already playing with Python 3.15 Cutting Python Web App Memory Over 31% tryke - A Rust-based Ptyhon test runner with a Jest-style API Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Django Modern Rest Modern REST framework for Django with types and async support Supports Pydantic, Attrs, and msgspec Has ai coding support with llms.txt See an example at the “showcase” section Brian #2: Already playing with Python 3.15 3.15.0a8, 2.14.4 and 3.13.13 are out Hugo von Kemenade beta comes in May, CRs in Sept, and Final planned for October But still, there's awesome stuff here already, here's what I'm looking forward to: PEP 810: Explicit lazy imports PEP 814: frozendict built-in type PEP 798: Unpacking in comprehensions with * and ** PEP 686: Python now uses UTF-8 as the default encoding Michael #3: Cutting Python Web App Memory Over 31% I cut 3.2 GB of memory usage from our Python web apps using five techniques: async workers import isolation the Raw+DC database pattern local imports for heavy libraries disk-based caching See the full article for details. Brian #4: tryke - A Rust-based Ptyhon test runner with a Jest-style API Justin Chapman Watch mode, Native async support, Fast test discovery, In-source testing, Support for doctests, Client/server mode for fast editor integrations, Pretty, per-assertion diagnostics, Filtering and marks, Changed mode (like pytest-picked), Concurrent tests, Soft assertions, JSON, JUnit, Dot, and LLM reporters Honestly haven't tried it yet, but you know, I'm kinda a fan of thinking outside the box with testing strategies so I welcome new ideas. Extras Brian: Why are't we uv yet? Interesting take on the “agents prefer pip” Problem with analysis. Many projects are libraries and don't publish uv.lock file Even with uv, it still often seen as a developer preference for non-libarries. You can sitll use uv with requirements.txt PyCon US 2026 talks schedule is up Interesting that there's an AI track now. I won't be attending, but I might have a bot watch the videos and summarize for me. :) What has technology done to us? Justin Jackson Lean TDD new cover Also, 0.6.1 is so ready for me to start f-ing reading the audio book and get on with this shipping the actual f-ing book and yes I realize I seem like I'm old because I use “f-ing” while typing. Michael: Python 3.14.4 is out Beanie 2.1 release Joke: HumanDB - Blazingly slow. Emotionally consistent.

The OWASP Top 10 just got a fresh update, and there are some big changes: supply chain attacks, exceptional condition handling, and more. Tanya Janca is back on Talk Python to walk us through every single one of them. And we're not just talking theory, we're going to turn Claude Code loose on a real open source project and see what it finds. Let's do it. Episode sponsors Temporal Talk Python Courses Links from the show DevSec Station Podcast: www.devsecstation.com SheHacksPurple Newsletter: newsletter.shehackspurple.ca owasp.org: owasp.org owasp.org/Top10/2025: owasp.org from here: github.com Kinto: github.com A01:2025 - Broken Access Control: owasp.org A02:2025 - SecuA02 Security Misconfiguration: owasp.org ASP.NET: ASP.NET A03:2025 - Software Supply Chain Failures: owasp.org A04:2025 - Cryptographic Failures: owasp.org A05:2025 - Injection: owasp.org A06:2025 - Insecure Design: owasp.org A07:2025 - Authentication Failures: owasp.org A08:2025 - Software or Data Integrity Failures: owasp.org A09:2025 - Security Logging and Alerting Failures: owasp.org A10 Mishandling of Exceptional Conditions: owasp.org https://github.com/KeygraphHQ/shannon: github.com anthropic.com/news/mozilla-firefox-security: www.anthropic.com generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business: www.generalpurpose.com Python Example Concepts: blobs.talkpython.fm Watch this episode on YouTube: youtube.com Episode #545 deep-dive: talkpython.fm/545 Episode transcripts: talkpython.fm Theme Song: Developer Rap

When you pip install a package with compiled code, the wheel you get is built for CPU features from 2009. Want newer optimizations like AVX2? Your installer has no way to ask for them. GPU support? You're on your own configuring special index URLs. The result is fat binaries, nearly gigabyte-sized wheels, and install pages that read like puzzle books. A coalition from NVIDIA, Astral, and QuanSight has been working on Wheel Next: A set of PEPs that let packages declare what hardware they need and let installers like uv pick the right build automatically. Just uv pip install torch and it works. I sit down with Jonathan Dekhtiar from NVIDIA, Ralf Gommers from Quansight and the NumPy and SciPy teams, and Charlie Marsh, founder of Astral and creator of uv, to dig into all of it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Temporal Talk Python Courses Links from the show Guests Charlie Marsh: github.com Ralf Gommers: github.com Jonathan Dekhtiar: github.com CPU dispatcher: numpy.org build options: numpy.org Red Hat RHEL: www.redhat.com Red Hat RHEL AI: www.redhat.com RedHats presentation: wheelnext.dev CUDA release: developer.nvidia.com requires a PEP: discuss.python.org WheelNext: wheelnext.dev Github repo: github.com PEP 817: peps.python.org PEP 825: discuss.python.org uv: docs.astral.sh A variant-enabled build of uv: astral.sh pyx: astral.sh pypackaging-native: pypackaging-native.github.io PEP 784: peps.python.org Watch this episode on YouTube: youtube.com Episode #544 deep-dive: talkpython.fm/544 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Migrating from mypy to ty: Lessons from FastAPI Oxyde ORM Typeshedded CPython docs Raw+DC Database Pattern: A Retrospective Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Migrating from mypy to ty: Lessons from FastAPI Tim Hopper I saw this post by Sebastián Ramírez about all of his projects switching to ty FastAPI, Typer, SQLModel, Asyncer, FastAPI CLI SqlModel is already ty only - mypy removed This signals that ty is ready to use Tim lists some steps to apply ty to your own projects Add ty alongside mypy Set error-on-warning = true Accept the double-ignore comments Pick a smaller project to cut over first Drop mypy when the noise exceeds the signalAdd ty alongside mypy Related anecdote: I had tried out ty with pytest-check in the past with difficulty Tried it again this morning, only a few areas where mypy was happy but ty reported issues At least one ty warning was a potential problem for people running pre-releases of pytest, Not really related: packaging.version.parse is awesome Michael #2: Oxyde ORM Oxyde ORM is a type-safe, Pydantic-centric asynchronous ORM with a high-performance Rust core. Note: Oxyde is a young project under active development. The API may evolve between minor versions. No sync wrappers or thread pools. Oxyde is async from the ground up Includes oxyde-admin Features Django-style API - Familiar Model.objects.filter() syntax Pydantic v2 models - Full validation, type hints, serialization Async-first - Built for modern async Python with asyncio Rust performance - SQL generation and execution in native Rust Multi-database - PostgreSQL, SQLite, MySQL support Transactions - transaction.atomic() context manager with savepoints Migrations - Django-style makemigrations and migrate CLI Brian #3: Typeshedded CPython docs Thanks emmatyping for the suggestion Documentation for Python with typeshed types Source: typeshedding_cpython_docs Michael #4: Raw+DC Database Pattern: A Retrospective A new design pattern I'm seeing gain traction in the software space: Raw+DC: The ORM pattern of 2026 I've had a chance to migrate three of my most important web app. Thrilled to report that yes, the web app is much faster using Raw+DC Plus, this was part of the journey to move from 1.3 GB memory usage to 0.45 GB (more on this next week) Extras Brian: Lean TDD 0.5 update Significant rewrite and focus Michael: pytest-just (for just command file testing), by Michael Booth Something going on with Encode httpx: Anyone know what's up with HTTPX? And forked starlette and uvicorn: Transfer of Uvicorn & Starlette mkdocs: The Slow Collapse of MkDocs django-rest-framework: Move to django commons? Certificates at Talk Python Training Joke: Neue Rich

When you type a question into ChatGPT, the model only has what you typed to work with. But tools like Claude Code can plan, iterate, test, and recover from mistakes. They work more like we do. The difference is the agent harness: Planning tools, file system access, sub-agents, and carefully crafted system prompts that turn a raw LLM into something genuinely capable. Sydney Runkle is back on Talk Python representing LangChain and their new open source library, Deep Agents: A framework for building your own deep agents with plain Python functions, middleware hooks, and MCP support. This is how the magic works under the hood. Episode sponsors Sentry Error Monitoring, Code talkpython26 Agentic AI Course Talk Python Courses Links from the show Guest Sydney Runkle: github.com Claude Code uses: x.com Deep Research: openai.com Manus: manus.im Blog post announcement: blog.langchain.com Claudes system prompt: github.com sub agents: docs.anthropic.com the quick start: docs.langchain.com CLIs: github.com Talk Python's CLI: talkpython.fm custom tools: docs.langchain.com DeepAgents Examples: github.com Custom Middleware: docs.langchain.com Built in middleware: docs.langchain.com Improving Deep Agents with harness engineering: blog.langchain.com Prebuilt middleware: docs.langchain.com Watch this episode on YouTube: youtube.com Episode #543 deep-dive: talkpython.fm/543 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Lock the Ghost Fence for Sandboxing MALUS: Liberate Open Source Harden your GitHub Actions Workflows with zizmor, dependency pinning, and dependency cooldowns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course **Patreon SupportersConnect with the hosts** Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Lock the Ghost The five core takeaways: PyPI "removal" doesn't delete distribution files. When a package is removed from PyPI, it disappears from the index and project page, but the actual distribution files remain accessible if you have a direct URL to them. uv.lock uniquely preserves access to ghost packages. Because uv.lock stores direct URLs to distribution files rather than relying on the index API at install time, uv sync can successfully install packages that have already been removed, even with cache disabled. No other Python lock file implementation tested behaved this way. This creates a supply chain attack vector. An attacker could upload a malicious package, immediately remove it to dodge automated security scanning, and still have it installable via a uv.lock file, or combine this with the xz-style strategy of hiding malicious additions in large, auto-generated lock files that nobody reviews. Removed package names can be hijacked with version collisions. When an owner removes a package, the name can be reclaimed by someone else who can upload different distribution types under the same version number, as happened with "umap." Lock files help until you regenerate them, then you're exposed. Your dependency scanning needs to cover lock files, not just manifest files. Scanning only pyproject.toml or requirements.txt misses threats embedded in lock files, which is where the actual resolved URLs and hashes live. Brian #2: Fence for Sandboxing Suggested by Martin Häcker “Some coding platforms have since integrated built-in sandboxing (e.g., Claude Code) to restrict write access to directories and/or network connectivity. However, these safeguards are typically optional and not enabled by default.” “JY Tan (on cc) has extracted the sandboxing logic from Claude Code and repackaged it into a standalone Go binary.” Source code on GitHub: https://github.com/Use-Tusk/fence Related: Simon Willison lethal trifecta for AI agents article from June 2025 Claude Code Sandboxing Michael #3: MALUS: Liberate Open Source via Paul Bauer The service will generate the specs of a library with one AI and build the newly licensed library using the specs with another AI circumventing the licensing and copyright rules. AI that has not been trained on open source reads the docs and API signature, creates a spec. Another AI processes that spec into working software. Is it a real site? Are they accepting real money, or are they just trying to cause a stir around copyright? Brian #4: Harden your GitHub Actions Workflows with zizmor, dependency pinning, and dependency cooldowns Matthias Schoettle Avoid things like this: hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far Extras Brian: GitHub is asking to spy on us, that's nice Michael: Michael's new SaaS for podcasters: InterviewCue DigitalOcean's Spaces cold storage for infrequently accessed data Minor issue about my fire and forget post, was a latent bug? Fire and Forget at Textual follow up article Joke: Can you?

If you've built documentation in the Python ecosystem, chances are you've used Martin Donath's work. His Material for MKDocs powers docs for FastAPI, uv, AWS, OpenAI, and tens of thousands of other projects. But when MKDocs 2.0 took a direction that would break Material and 300 ecosystem plugins, Martin went back to the drawing board. The result is Zensical: A new static site generator with a Rust core, differential builds in milliseconds instead of minutes, and a migration path designed to bring the whole community along. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show Guest Martin Donath: github.com Zensical: zensical.org Material for MkDocs: squidfunk.github.io Getting Started: zensical.org Github pages: docs.github.com Cloudflare pages: pages.cloudflare.com Michaels Example: gist.github.com Material for MkDocs: zensical.org gohugo.io/content-management/shortcodes: gohugo.io a sense of size of the project: blobs.talkpython.fm Zensical Spark: zensical.org Watch this episode on YouTube: youtube.com Episode #542 deep-dive: talkpython.fm/542 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Starlette 1.0.0 Astral to join OpenAI uv audit Fire and forget (or never) with Python's asyncio Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Starlette 1.0.0 As a reminder, Starlette is the foundation for FastAPI Starlette 1.0 is here! - fun blog post from Marcello Trylesinski “The changes in 1.0 were limited to removing old deprecated code that had been on the way out for years, along with a few bug fixes. From now on we'll follow SemVer strictly.” Fun comment in the “What's next?” section: “Oh, and Sebastián, Starlette is now out of your way to release FastAPI 1.0.

When LLMs write code to accomplish a task, that code has to actually run somewhere. And right now, the options aren't great. Spin up a sandboxed container and you're paying a full second of cold start overhead plus the complexity of another service. Let the LLM loose on your actual machine and... well, you'd better be watching. On this episode, I sit down with Samuel Colvin, creator of Pydantic, now at 10 billion downloads, to explore Monty, a Python interpreter written from scratch in Rust, purpose-built to run LLM-generated code. It starts in microseconds, is completely sandboxed by design, and can even serialize its entire state to a database and resume later. We dig into why this deliberately limited interpreter might be exactly what the AI agent era needs. Episode sponsors Talk Python Courses Python in Production Links from the show Guest Samuel Colvin: github.com CPython: github.com IronPython: ironpython.net Jython: www.jython.org Pyodide: pyodide.com monty: github.com Pydantic AI: pydantic.dev Python AI conference: pyai.events bashkit: github.com just-bash: github.com Narwhals: narwhals-dev.github.io Polars: pola.rs Strands Agents: aws.amazon.com Subscribe Running Pydantic's Monty Rust sandboxed Python subset in WebAssembly: simonwillison.net Rust Python: github.com Valgrind: valgrind.org Cod Speed: codspeed.io Watch this episode on YouTube: youtube.com Episode #541 deep-dive: talkpython.fm/541 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: chardet ,AI, and licensing refined-github pgdog: PostgreSQL connection pooler, load balancer and database sharder Agentic Engineering Patterns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: chardet ,AI, and licensing Thanks Ian Lessing Wow, where to start? A bit of legal precedence research. Chardet dispute shows how AI will kill software licensing, argues Bruce Perens on the Register Also see this GitHub issue. Dan Blanchard, maintainer of a Python character encoding detection library called chardet, released a new version of the library under a new software license. (LGPL → MIT) Dan is allowed to make this change because v7 is a complete “clean room” rewrite using AI BTW, v7 is WAY better: The result is a 48x increase in detection speed for a project that lives in the hot loops of many projects. That will lead to noticeable performance increases for literally millions of users (the package gets ~130M downloads per month). It paves a path towards inclusion in the standard library (assuming they don't institute policies against using AI tools). Thread-safe detect() and detect_all() with no measurable overhead; scales on free-threaded Python 3.13t+ An individual claiming to be Mark Pilgrim, the original creator of the library, opened an issue in the project's GitHub repo arguing that Blanchard had no right to change the software license, citing the LPGL requirement that the license remain unchanged. A 'complete rewrite' is irrelevant, since they had ample exposure to the originally licensed code (i.e. this is not a 'clean room' implementation). Blanchard disagreed, citing how version 7.0.0 and 6.0.0 compare when subjected to JPlag, a library for detecting plagiarism. Blanchard told The Register he had wanted to get chardet added to the Python standard library for more than a decade since it's a core dependency to most Python projects. Brian #2: refined-github Suggested by Matthias Schöttle A browser plugin that improves the GitHub experience A sampling Adds a build/CI status icon next to the repo's name. Adds a link back to the PR that ran the workflow. Enables tab and shift tab for indentation in comment fields. Auto-resizes comment fields to fit their content and no longer show scroll bars. Highlights the most useful comment in issues. Changes the default sort order of issues/PRs to Recently updated. But really, it's a huge list of improvements Michael #3: pgdog: PostgreSQL connection pooler, load balancer and database sharder PgDog is a proxy for scaling PostgreSQL. It supports connection pooling, load balancing queries and sharding entire databases. Written in Rust, PgDog is fast, secure and can manage thousands of connections on commodity hardware. Features PgDog is an application layer load balancer for PostgreSQL Health Checks: PgDog maintains a real-time list of healthy hosts. When a database fails a health check, it's removed from the active rotation and queries are re-routed to other replicas Single Endpoint: PgDog can detect writes (e.g. INSERT, UPDATE, CREATE TABLE, etc.) and send them to the primary, leaving the replicas to serve reads Failover: PgDog monitors Postgres replication state and can automatically redirect writes to a different database if a replica is promoted Sharding: PgDog is able to manage databases with multiple shards Brian #4: Agentic Engineering Patterns Simon Willison So much great stuff here, especially Anti-patterns: things to avoid And 3 sections on testing Red/green TDD First run the test Agentic manual testing Extras Brian: uv python upgrade will upgrade all versions of Python installed with uv to latest patch release suggested by John Hagen Coding After Coders: The End of Computer Programming as We Know It NY Times Article Suggested by Christopher Best quote: “Pushing code that fails pytest is unacceptable and embarrassing.” Michael: Talk Python Training users get a better account dashboard Package Managers Need to Cool Down Will AI Kill Open Source, article + video My Always activate the venv is now a zsh-plugin, sorta. Joke: Ergonomic keyboard Also pretty good and related: Claude Code Mandated Links legal precedence research Chardet dispute shows how AI will kill software licensing, argues Bruce Perens this GitHub issue citing JPlag refined-github Agentic Engineering Patterns Anti-patterns: things to avoid Red/green TDD First run the test Agentic manual testing uv python upgrade Coding After Coders: The End of Computer Programming as We Know It Suggested by Christopher a better account dashboard Package Managers Need to Cool Down Will AI Kill Open Source Always activate the venv now a zsh-plugin Ergonomic keyboard Claude Code Mandated claude-mandated.png blobs.pythonbytes.fm/keyboard-joke.jpeg?cache_id=a6026b

Topics covered in this episode: chardet ,AI, and licensing refined-github pgdog: PostgreSQL connection pooler, load balancer and database sharder Agentic Engineering Patterns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: chardet ,AI, and licensing Thanks Ian Lessing Wow, where to start? A bit of legal precedence research. Chardet dispute shows how AI will kill software licensing, argues Bruce Perens on the Register Also see this GitHub issue. Dan Blanchard, maintainer of a Python character encoding detection library called chardet, released a new version of the library under a new software license. (LGPL → MIT) Dan is allowed to make this change because v7 is a complete “clean room” rewrite using AI BTW, v7 is WAY better: The result is a 48x increase in detection speed for a project that lives in the hot loops of many projects. That will lead to noticeable performance increases for literally millions of users (the package gets ~130M downloads per month). It paves a path towards inclusion in the standard library (assuming they don't institute policies against using AI tools). Thread-safe detect() and detect_all() with no measurable overhead; scales on free-threaded Python 3.13t+ An individual claiming to be Mark Pilgrim, the original creator of the library, opened an issue in the project's GitHub repo arguing that Blanchard had no right to change the software license, citing the LPGL requirement that the license remain unchanged. A 'complete rewrite' is irrelevant, since they had ample exposure to the originally licensed code (i.e. this is not a 'clean room' implementation). Blanchard disagreed, citing how version 7.0.0 and 6.0.0 compare when subjected to JPlag, a library for detecting plagiarism. Blanchard told The Register he had wanted to get chardet added to the Python standard library for more than a decade since it's a core dependency to most Python projects. Brian #2: refined-github Suggested by Matthias Schöttle A browser plugin that improves the GitHub experience A sampling Adds a build/CI status icon next to the repo's name. Adds a link back to the PR that ran the workflow. Enables tab and shift tab for indentation in comment fields. Auto-resizes comment fields to fit their content and no longer show scroll bars. Highlights the most useful comment in issues. Changes the default sort order of issues/PRs to Recently updated. But really, it's a huge list of improvements Michael #3: pgdog: PostgreSQL connection pooler, load balancer and database sharder PgDog is a proxy for scaling PostgreSQL. It supports connection pooling, load balancing queries and sharding entire databases. Written in Rust, PgDog is fast, secure and can manage thousands of connections on commodity hardware. Features PgDog is an application layer load balancer for PostgreSQL Health Checks: PgDog maintains a real-time list of healthy hosts. When a database fails a health check, it's removed from the active rotation and queries are re-routed to other replicas Single Endpoint: PgDog can detect writes (e.g. INSERT, UPDATE, CREATE TABLE, etc.) and send them to the primary, leaving the replicas to serve reads Failover: PgDog monitors Postgres replication state and can automatically redirect writes to a different database if a replica is promoted Sharding: PgDog is able to manage databases with multiple shards Brian #4: Agentic Engineering Patterns Simon Willison So much great stuff here, especially Anti-patterns: things to avoid And 3 sections on testing Red/green TDD First run the test Agentic manual testing Extras Brian: uv python upgrade will upgrade all versions of Python installed with uv to latest patch release suggested by John Hagen Coding After Coders: The End of Computer Programming as We Know It NY Times Article Suggested by Christopher Best quote: “Pushing code that fails pytest is unacceptable and embarrassing.” Michael: Talk Python Training users get a better account dashboard Package Managers Need to Cool Down Will AI Kill Open Source, article + video My Always activate the venv is now a zsh-plugin, sorta. Joke: Ergonomic keyboard Also pretty good and related: Claude Code Mandated Links legal precedence research Chardet dispute shows how AI will kill software licensing, argues Bruce Perens this GitHub issue citing JPlag refined-github Agentic Engineering Patterns Anti-patterns: things to avoid Red/green TDD First run the test Agentic manual testing uv python upgrade Coding After Coders: The End of Computer Programming as We Know It Suggested by Christopher a better account dashboard Package Managers Need to Cool Down Will AI Kill Open Source Always activate the venv now a zsh-plugin Ergonomic keyboard Claude Code Mandated claude-mandated.png blobs.pythonbytes.fm/keyboard-joke.jpeg?cache_id=a6026b

Monorepos -- you've heard the talks, you've read the blog posts, maybe you've seen a few tantalizing glimpses into how Google or Meta organize their massive codebases. But it's often in the abstract and behind closed doors. What if you could crack open a real, production monorepo, one with over a million lines of Python and over 100 of sub-packages, and actually see how it's built, step by step, using modern tools and standards? That's exactly what Apache Airflow gives us. On this episode, I sit down with Jarek Potiuk and Amogh Desai, two of Airflow's top contributors, to go inside one of the largest open-source Python monorepos in the world and learn how they manage it with uv, pyproject.toml, and the latest packaging standards, so you can apply those same patterns to your own projects. Episode sponsors Agentic AI Course Python in Production Talk Python Courses Links from the show Guests Amogh Desai: github.com Jarek's GitHub: github.com definition of a monorepo: monorepo.tools airflow: airflow.apache.org Activity: github.com OpenAI: airflowsummit.org Part 1. Pains of big modular Python projects: medium.com Part 2. Modern Python packaging standards and tools for monorepos: medium.com Part 3. Monorepo on steroids - modular prek hooks: medium.com Part 4. Shared “static” libraries in Airflow monorepo: medium.com PEP-440: peps.python.org PEP-517: peps.python.org PEP-518: peps.python.org PEP-566: peps.python.org PEP-561: peps.python.org PEP-660: peps.python.org PEP-621: peps.python.org PEP-685: peps.python.org PEP-723: peps.python.org PEP-735: peps.python.org uv: docs.astral.sh uv workspaces: blobs.talkpython.fm prek.j178.dev: prek.j178.dev your presentation at FOSDEM26: fosdem.org Tallyman: github.com Watch this episode on YouTube: youtube.com Episode #540 deep-dive: talkpython.fm/540 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Setting up a Python monorepo with uv workspaces cattrs: Flexible Object Serialization and Validation Learning to program in the AI age VS Code extension for FastAPI and friends Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Setting up a Python monorepo with uv workspaces Dennis Traub The 3 things Give the Root a Distinct Name Use workspace = true for Inter-Package Deps Use importlib Mode for pytest Michael #2: cattrs: Flexible Object Serialization and Validation cattrs is a Swiss Army knife for (un)structuring and validating data in Python. A natural alternative/follow on from DataClass Wizard Converts to ←→ from dictionaries cattrs also focuses on functional composition and not coupling your data model to its serialization and validation rules. When you're handed unstructured data (by your network, file system, database, …), cattrs helps to convert this data into trustworthy structured data. Batteries Included: cattrs comes with pre-configured converters for a number of serialization libraries, including JSON (standard library, orjson, UltraJSON), msgpack, cbor2, bson, PyYAML, tomlkit and msgspec (supports only JSON at this time). Brian #3: Learning to program in the AI age Jose Blanca “I teach a couple of introductory Python courses and I've been thinking about which advice to give to my students, that are studying how to program for the first time. I have collected my ideas in these blog posts” Why learning to program is as useful as ever, even with powerful AI tools available. How to use AI as a tutor rather than a shortcut, and why practice remains the key to real understanding. What the real learning objectives are: mental models, managing complexity, and thinking like a software developer. Michael #4: VS Code extension for FastAPI and friends Enhances the FastAPI development experience in Visual Studio Code Path Operation Explorer: Provides a hierarchical tree view of all FastAPI routes in your application. Search for routes: Use the Command Palette and quickly search for routes by path, method, or name. CodeLens links appear above HTTP client calls like client.get('/items'), letting you jump directly to the matching route definition. Deploy your application directly to FastAPI Cloud from the status bar with zero config. View real-time logs from your FastAPI Cloud deployed applications directly within VS Code. Install from Marketplace. Extras Brian: Guido van Rossum interviews key Python developers from the first 25 years Interview with Brett Cannon Interview with Thomas Wouters Michael: IntelliJ IDEA: The Documentary | An origin story video Cursor Joined the ACP Registry and Is Now Live in Your JetBrains IDE What hyper-personal software looks like I'm doing in-person training again (limited scope): On-site, hands-on AI engineering enablement for software teams with Michael Joke: Saas is dead

You're adding type hints to your Python code, your editor is happy, autocomplete is working great. But then you switch tools and suddenly there are red squiggles everywhere. Who decides what a float annotation actually means? Or whether passing None where an int is expected should be an error? It turns out there's a five-person council dedicated to exactly these questions -- and two brand-new Rust-based type checkers are raising the bar. On this episode, I sit down with three members of the Python Typing Council -- Jelle Zijlstra, Rebecca Chen, and Carl Meyer -- to learn how the type system is governed, where the spec and the type checkers agree and disagree, and get the council's official advice on how much typing is just enough. Episode sponsors Sentry Error Monitoring, Code talkpython26 Agentic AI Course Talk Python Courses Links from the show Guests Carl Meyer: github.com Jelle Zijlstra: jellezijlstra.github.io Rebecca Chen: github.com Typing Council: github.com typing.python.org: typing.python.org details here: github.com ty: docs.astral.sh pyrefly: pyrefly.org conformance test suite project: github.com typeshed: github.com Stub files: mypy.readthedocs.io Pydantic: pydantic.dev Beartype: github.com TOAD AI: github.com PEP 747 – Annotating Type Forms: peps.python.org PEP 724 – Stricter Type Guards: peps.python.org Python Typing Repo (PRs and Issues): github.com Watch this episode on YouTube: youtube.com Episode #539 deep-dive: talkpython.fm/539 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Raw+DC: The ORM pattern of 2026? pytest-check releases Dataclass Wizard SQLiteo - “native macOS SQLite browser built for normal people” Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Raw+DC: The ORM pattern of 2026? ORMs/ODMs provide great support and abstractions for developers They are not the native language of agentic AI Raw queries are trained 100x+ more than standard ORMs Using raw queries at the data access optimizes for AI coding Returning some sort of object mapped to the data optimizes for type safety and devs Brian #2: pytest-check releases 3 merged pull requests 8 closed issues at one point got to 0 PR's and 1 enhancement request Now back to 2 issues and 1 PR, but activity means it's still alive and being used. so cool Check out changelog for all mods A lot of changes around supporting mypy I've decided to NOT have the examples be fully --strict as I find it reduces readability See tox.ini for explanation But src is --strict clean now, so user tests can be --strict clean. Michael #3: Dataclass Wizard Simple, elegant wizarding tools for Python's dataclasses. Features

Digital humanities sounds niche, until you realize it can mean a searchable archive of U.S. amendment proposals, Irish folklore, or pigment science in ancient art. Today I'm talking with David Flood from Harvard's DARTH team about an unglamorous problem: What happens when the grant ends but the website can't. His answer, static sites, client-side search, and sneaky Python. Let's dive in. Episode sponsors Sentry Error Monitoring, Code talkpython26 Command Book Talk Python Courses Links from the show Guest David Flood: davidaflood.com DARTH: digitalhumanities.fas.harvard.edu Amendments Project: digitalhumanities.fas.harvard.edu Fionn Folklore Database: fionnfolklore.org Mapping Color in History: iiif.harvard.edu Apatosaurus: apatosaurus.io Criticus: github.com github.com/palewire/django-bakery: github.com sigsim.acm.org/conf/pads/2026/blog/artifact-evaluation: sigsim.acm.org Hugo: gohugo.io Water Stories: waterstories.fas.harvard.edu Tsumeb Mine Notebook: tmn.fas.harvard.edu Dharma and Punya: dharmapunya2019.org Pagefind library: pagefind.app django_webassembly: github.com Astro Static Site Generator: astro.build PageFind Python Lib: pypi.org Frozen-Flask: frozen-flask.readthedocs.io Watch this episode on YouTube: youtube.com Episode #538 deep-dive: talkpython.fm/538 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Better Python tests with inline-snapshot jolt Battery intelligence for your laptop Markdown code formatting with ruff act - run your GitHub actions locally Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: Better Python tests with inline-snapshot Alex Hall, on Pydantic blog Great for testing complex data structures Allows you to write a test like this: from inline_snapshot import snapshot def test_user_creation(): user = create_user(id=123, name="test_user") assert user.dict() == snapshot({}) Then run pytest --inline-snapshot=fix And the library updates the test source code to look like this: def test_user_creation(): user = create_user(id=123, name="test_user") assert user.dict() == snapshot({ "id": 123, "name": "test_user", "status": "active" }) Now, when you run the code without “fix” the collected data is used for comparison Awesome to be able to visually inspect the test data right there in the test code. Projects mentioned inline-snapshot pytest-examples syrupy dirty-equals executing Michael #2: jolt Battery intelligence for your laptop Support for both macOS and Linux Battery Status — Charge percentage, time remaining, health, and cycle count Power Monitoring — System power draw with CPU/GPU breakdown Process Tracking — Processes sorted by energy impact with color-coded severity Historical Graphs — Track battery and power trends over time Themes — 10+ built-in themes with dark/light auto-detection Background Daemon — Collect historical data even when the TUI isn't running Process Management — Kill energy-hungry processes directly Brian #3: Markdown code formatting with ruff Suggested by Matthias Schoettle ruff can now format code within markdown files Will format valid Python code in code blocks marked with python, py, python3 or py3. Also recognizes pyi as Python type stub files. Includes the ability to turn off formatting with comment [HTML_REMOVED] , [HTML_REMOVED] blocks. Requires preview mode [tool.ruff.lint] preview = true Michael #4: act - run your GitHub actions locally Run your GitHub Actions locally! Why would you want to do this? Two reasons: Fast Feedback - Rather than having to commit/push every time you want to test out the changes you are making to your .github/workflows/ files (or for any changes to embedded GitHub actions), you can use act to run the actions locally. The environment variables and filesystem are all configured to match what GitHub provides. Local Task Runner - I love make. However, I also hate repeating myself. With act, you can use the GitHub Actions defined in your .github/workflows/ to replace your Makefile! When you run act it reads in your GitHub Actions from .github/workflows/ and determines the set of actions that need to be run. Uses the Docker API to either pull or build the necessary images, as defined in your workflow files and finally determines the execution path based on the dependencies that were defined. Once it has the execution path, it then uses the Docker API to run containers for each action based on the images prepared earlier. The environment variables and filesystem are all configured to match what GitHub provides. Extras Michael: Winter is coming: Frozendict accepted Django ORM stand-alone Command Book app announcement post Joke: Plug ‘n Paste

You love building web apps with Python, and HTMX got you excited about the hypermedia approach -- let the server drive the HTML, skip the JavaScript build step, keep things simple. But then you hit that last 10%: You need Alpine.js for interactivity, your state gets out of sync, and suddenly you're juggling two unrelated libraries that weren't designed to work together. What if there was a single 11-kilobyte framework that gave you everything HTMX and Alpine do, and more, with real-time updates, multiplayer collaboration out of the box, and performance so fast you're actually bottlenecked by the monitor's refresh rate? That's Datastar. On this episode, I sit down with its creator Delaney Gillilan, core maintainer Ben Croker, and Datastar convert Chris May to explore how this backend-driven, server-sent-events-first framework is changing the way full-stack developers think about the modern web. Episode sponsors Sentry Error Monitoring, Code talkpython26 Command Book Talk Python Courses Links from the show Guests Delaney Gillilan: linkedin.com Ben Croker: x.com Chris May: everydaysuperpowers.dev Datastar: data-star.dev HTMX: htmx.org AlpineJS: alpinejs.dev Core Attribute Tour: data-star.dev data-star.dev/examples: data-star.dev github.com/starfederation/datastar-python: github.com VSCode: marketplace.visualstudio.com OpenVSX: open-vsx.org PyCharm/Intellij plugin: plugins.jetbrains.com data-star.dev/datastar_pro: data-star.dev gg: discord.gg HTML-ivating your Django web app's experience with HTMX, AlpineJS, and streaming HTML - Chris May: www.youtube.com Senior Engineer tries Vibe Coding: www.youtube.com 1 Billion Checkboxes: checkboxes.andersmurphy.com Game of life example: example.andersmurphy.com Watch this episode on YouTube: youtube.com Episode #537 deep-dive: talkpython.fm/537 Episode transcripts: talkpython.fm Theme Song: Developer Rap

You've built your FastAPI app, it's running great locally, and now you want to share it with the world. But then reality hits -- containers, load balancers, HTTPS certificates, cloud consoles with 200 options. What if deploying was just one command? That's exactly what Sebastian Ramirez and the FastAPI Cloud team are building. On this episode, I sit down with Sebastian, Patrick Arminio, Savannah Ostrowski, and Jonathan Ehwald to go inside FastAPI Cloud, explore what it means to build a "Pythonic" cloud, and dig into how this commercial venture is actually making FastAPI the open-source project stronger than ever. Episode sponsors Command Book Python in Production Talk Python Courses Links from the show Guests Sebastián Ramírez: github.com Savannah Ostrowski: github.com Patrick Arminio: github.com Jonathan Ehwald: github.com FastAPI labs: fastapilabs.com quickstart: fastapicloud.com an episode on diskcache: talkpython.fm Fastar: github.com FastAPI: The Documentary: www.youtube.com Tailwind CSS Situation: adams-morning-walk.transistor.fm FastAPI Job Meme: fastapi.meme Migrate an Existing Project: fastapicloud.com Join the waitlist: fastapicloud.com Talk Python CLI Talk Python CLI Announcement: talkpython.fm Talk Python CLI GitHub: github.com Command Book Download Command Book: commandbookapp.com Announcement post: mkennedy.codes Watch this episode on YouTube: youtube.com Episode #536 deep-dive: talkpython.fm/536 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Command Book App uvx.sh: Install Python tools without uv or Python Ending 15 years of subprocess polling monty: A minimal, secure Python interpreter written in Rust for use by AI Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Command Book App New app from Michael Command Book App is a native macOS app for developers, data scientists, AI enthusiasts and more. This is a tool I've been using lately to help build Talk Python, Python Bytes, Talk Python Training, and many more applications. It's a bit like advanced terminal commands or complex shell aliases, but hosted outside of your terminal. This leaves the terminal there for interactive commands, exploration, short actions. Command Book manages commands like "tail this log while I'm developing the app", "Run the dev web server with true auto-reload", and even "Run MongoDB in Docker with exactly the settings I need" I'd love it if you gave it a look, shared it with your team, and send me feedback. Has a free version and paid version. Build with Swift and Swift UI Check it out at https://commandbookapp.com Brian #2: uvx.sh: Install Python tools without uv or Python Tim Hopper Michael #3: Ending 15 years of subprocess polling by Giampaolo Rodola The standard library's subprocess module has relied on a busy-loop polling approach since the timeout parameter was added to Popen.wait() in Python 3.3, around 15 years ago The problem with busy-polling CPU wake-ups: even with exponential backoff (starting at 0.1ms, capping at 40ms), the system constantly wakes up to check process status, wasting CPU cycles and draining batteries. Latency: there's always a gap between when a process actually terminates and when you detect it. Scalability: monitoring many processes simultaneously magnifies all of the above. + L1/L2 CPU cache invalidations It's interesting to note that waiting via poll() (or kqueue()) puts the process into the exact same sleeping state as a plain time.sleep() call. From the kernel's perspective, both are interruptible sleeps. Here is the merged PR for this change. Brian #4: monty: A minimal, secure Python interpreter written in Rust for use by AI Samuel Colvin and others at Pydantic Still experimental “Monty avoids the cost, latency, complexity and general faff of using a full container based sandbox for running LLM generated code. “ “Instead, it lets you safely run Python code written by an LLM embedded in your agent, with startup times measured in single digit microseconds not hundreds of milliseconds.” Extras Brian: Expertise is the art of ignoring - Kevin Renskers You don't need to master the language. You need to master your slice. Learning everything up front is wasted effort. Experience changes what you pay attention to. I hate fish - Rands (Michael Lopp) Really about productivity systems And a nice process for dealing with email Michael: Talk Python now has a CLI New essay: It's not vibe coding - Agentic engineering GitHub is having a day Python 3.14.3 and 3.13.12 are available Wall Street just lost $285 billion because of 13 markdown files Joke: Silence, current side project!

Topics covered in this episode: django-bolt: Faster than FastAPI, but with Django ORM, Django Admin, and Django packages pyleak More Django (three articles) Datastar Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: django-bolt : Faster than FastAPI, but with Django ORM, Django Admin, and Django packages Farhan Ali Raza High-Performance Fully Typed API Framework for Django Inspired by DRF, FastAPI, Litestar, and Robyn Django-Bolt docs Interview with Farhan on Django Chat Podcast And a walkthrough video Michael #2: pyleak Detect leaked asyncio tasks, threads, and event loop blocking with stack trace in Python. Inspired by goleak. Has patterns for Context managers decorators Checks for Unawaited asyncio tasks Threads Blocking of an asyncio loop Includes a pytest plugin so you can do @pytest.mark.no_leaks Brian #3: More Django (three articles) Migrating From Celery to Django Tasks Paul Taylor Nice intro of how easy it is to get started with Django Tasks Some notes on starting to use Django Julia Evans A handful of reasons why Django is a great choice for a web framework less magic than Rails a built-in admin nice ORM automatic migrations nice docs you can use sqlite in production built in email The definitive guide to using Django with SQLite in production I'm gonna have to study this a bit. The conclusion states one of the benefits is “reduced complexity”, but, it still seems like quite a bit to me. Michael #4: Datastar Sent to us by Forrest Lanier Lots of work by Chris May Out on Talk Python soon. Official Datastar Python SDK Datastar is a little like HTMX, but The single source of truth is your server Events can be sent from server automatically (using SSE) e.g yield SSE.patch_elements( f"""{(#HTML#)}{datetime.now().isoformat()}""" ) Why I switched from HTMX to Datastar article Extras Brian: Django Chat: Inverting the Testing Pyramid - Brian Okken Quite a fun interview PEP 686 – Make UTF-8 mode default Now with status “Final” and slated for Python 3.15 Michael: Prayson Daniel's Paper tracker Ice Cubes (open source Mastodon client for macOS) Rumdl for PyCharm, et. al cURL Gets Rid of Its Bug Bounty Program Over AI Slop Overrun Python Developers Survey 2026 Joke: Pushed to prod

Building on the web is like working with the perfect clay. It's malleable and can become almost anything. But too often, frameworks try to hide the web's best parts away from us. Today, we're looking at PyView, a project that brings the real-time power of Phoenix LiveView directly into the Python world. I'm joined by Larry Ogrodnek to dive into PyView. Episode sponsors Talk Python Courses Python in Production Links from the show Guest Larry Ogrodnek: hachyderm.io pyview.rocks: pyview.rocks Phoenix LiveView: github.com this section: pyview.rocks Core Concepts: pyview.rocks Socket and Context: pyview.rocks Event Handling: pyview.rocks LiveComponents: pyview.rocks Routing: pyview.rocks Templating: pyview.rocks HTML Templates: pyview.rocks T-String Templates: pyview.rocks File Uploads: pyview.rocks Streams: pyview.rocks Sessions & Authentication: pyview.rocks Single-File Apps: pyview.rocks starlette: starlette.dev wsproto: github.com apscheduler: github.com t-dom project: github.com Watch this episode on YouTube: youtube.com Episode #535 deep-dive: talkpython.fm/535 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Your cloud SSD is sitting there, bored, and it would like a job. Today we're putting it to work with DiskCache, a simple, practical cache built on SQLite that can speed things up without spinning up Redis or extra services. Once you start to see what it can do, a universe of possibilities opens up. We're joined by Vincent Warmerdam to dive into DiskCache. Episode sponsors Talk Python Courses Python in Production Links from the show diskcache docs: grantjenks.com LLM Building Blocks for Python course: training.talkpython.fm JSONDisk: grantjenks.com Git Code Archaeology Charts: koaning.github.io Talk Python Cache Admin UI: blobs.talkpython.fm Litestream SQLite streaming: litestream.io Plash hosting: pla.sh Watch this episode on YouTube: youtube.com Episode #534 deep-dive: talkpython.fm/534 Episode transcripts: talkpython.fm Theme Song: Developer Rap