Python Tooling Blog
RSS-
Meet the First Python Packaging Council
Brett Cannon, Pradyun Gedam, Donald Stufft, Henry Schreiner, and Ralf Gommers won the inaugural Packaging Council election. Who they are and what the council decides.
-
Claude Mythos 5 Published Malware to PyPI. Fifteen Systems Ran It.
An AI agent published three malicious package versions to PyPI. Fifteen systems ran them before PyPI removed the package.
-
I'm Running for the Python Packaging Council
The inaugural Python Packaging Council election has 17 nominees competing for 5 seats. I'm one of them.
-
uv 0.12 Makes Every New Project a Package
uv init now writes a src/ layout with a build system and a console script. What changed, why it changed back, and how to get the flat main.py layout.
-
Ruff 0.16.0 Enables 7x More Rules by Default
Ruff's first default-ruleset expansion since v0.1.0 adds 354 rules. What changes when you upgrade, which new categories are on, and how to migrate cleanly.
-
PyPI Now Rejects New Files on Releases Older Than 14 Days
PyPI blocks new file uploads to releases older than 14 days, closing an attack that could poison a pinned version without changing its number.
-
uv's Malware Check: What It Blocks and What It Misses
Turn on uv's install-time malware check in pyproject.toml to block known-malicious packages before any of their code runs.
-
ty now checks Pydantic like Pydantic does
ty 0.0.57 added first-class Pydantic support: lax and strict validation modes, ConfigDict parsing, and Field metadata. Here is what it checks and how it changes the ty vs Pyrefly choice.
-
Python 3.15 makes UTF-8 the default encoding
Python 3.15 enables UTF-8 mode by default. On Windows, text-mode open() and subprocess calls without an explicit encoding switch from the system code page to UTF-8. Here is what breaks and how to audit your codebase.
-
uv Wants to Secure Your CLI Tools
uv is building toward vulnerability scanning for globally installed CLI tools. A preview feature in 0.11.25 starts by writing a lockfile for each tool you install.