Tessera
Folgen

Brett Cannon

@snarky.ca

#Python core developer who also works on packaging; works on Python stuff at #Microsoft (although this is a personal account). Proudly #Canadian.

573 Posts4073 Follower82 Folgt
Kelsey Hightower@kelseyhightower.com · 3w ago

I talk to a lot of startups building security tools for AI agents, and my advice to all of them is, treat AI agents like malware. Even if agents provide a lot of value to those who use them, agents are a security nightmare to those who have to secure them.

npm@npmjs.com · 4w ago

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

github.blog

Brett Cannon@snarky.ca · 4w ago

If you use GitHub Actions to publish to #PyPI, I wrote a blog post outlining what I consider the key things you can do to secure your publishing workflow. snarky.ca/how-to-publi... If you don't use GitHub Actions for publishing, this post will NOT be of interest to you.

How to publish to PyPI using GitHub Actions securely

There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say "GitHub Actions is the weakest link" in publishing and to GitHub publish...

snarky.ca

Brett Cannon@snarky.ca · 4w ago

@tiangolo.com are there any plans for hosting SQLite3 databases on @fastapicloud.com ? For a personal blog I just don't need something as fancy as Postgres which requires setting up another service. All I want is a SQLite3 file that I can occasionally download for backup purposes.

Gleam Programming Language@gleam.run · 2mo ago

The rainbow is here all year long, so we don't need to change the profile for June. But it is a good time to remind everyone that LGBTQIA+ rights are under attack all year long as well. And to steal @haskell.org's message: there would be no Gleam without trans people 🩵🩷🤍

pink star looking in the mirror with text "I'm going to be brave. I'm going to be myself", with rainbow pride and trans pride stickers on it. The background is rainbow
Python Software Foundation@python.org · 2mo ago

🤔📚 Wondering what to do this weekend? Grab the latest No Starch Press Humble Bundle, ‘Python: the Good Stuff’ and dig into 15 #Python related titles for just $36! A percentage of the proceeds goes to supporting the PSF! www.humblebundle.com/books/python...

No Starch Press@nostarchpress.bsky.social · 2mo ago

A @humblebundle.com for people learning Python, people automating busywork, people teaching the machines, and people trying to escape Excel. Pay what you want. DRM-free. Supports @python.org https://www.humblebundle.com/books/python-good-stuff-no-starch-books

Square promotional graphic for the "Python: The Good Stuff" Humble Bundle by No Starch Press, offering five Python books for $36 (regular price $584). The books shown are Python for Excel Users, Computer Science from Scratch, Practical Deep Learning, Automate the Boring Stuff with Python, and Python Crash Course.
Hugo van Kemenade@hugovk.dev · 2mo ago

🐍🚀 Out now: Python 3.15 beta 2! 💤 Lazy imports! 🧊 frozendict builtin! 💂 sentinel builtin! 📉 Tachyon profiler! 🖼️ Frame pointers everywhere! 🎨 More colour! 🚌 & more! Library maintainer? Add 3.15 to your CI and keep those bugs coming! discuss.python.org/t/python-3-1... #Python315 #Python #release

Python 3.15.0 beta 2 is here!

Here comes the antepenultimate beta. This is a beta preview of Python 3.15 Python 3.15 is still in development. This release, 3.15.0b2, is the second of four planned beta releases. Beta release p...

discuss.python.org

FastAPI@fastapi.tiangolo.com · 2mo ago

Your FastAPI is safe 🔒 Today, FastAPI was incorrectly flagged as malicious by automated tooling from a large company, among several other packages. FastAPI was not compromised. It was a false positive. We were not contacted before publication. This should not happen to OSS.

Hugo van Kemenade@hugovk.dev · 3mo ago

prek now supports cooldown in either user or project config: github.com/j178/prek/re... pre-commit closed and locked the feature request as one of many many duplicates, but I can't find any: github.com/pre-commit/p... #PreCommit #prek #cooldown

Release 0.3.12 · j178/prek

Release Notes Released on 2026-05-05. Highlights auto_update.cooldown_days is now available in both the user-level global config (~/.config/prek/prek.toml on Linux and macOS, or $XDG_CONFIG_HOME/pr...

github.com

Hugo van Kemenade@hugovk.dev · 3mo ago

Well, let's fix those pprint defaults! mastodon.social/@treyhunner/... Which do you prefer? github.com/python/cpyth... github.com/python/cpyth... #Python #Python315 #pprint

main produces: {'database': {'host': 'db.example.com', 'options': {'connect_timeout': 5, 'pool_size': 10, 'ssl': True, 'sslmode': 'verify-full'}, 'port': 5432}, 'logging': {'file': '/var/log/app.log', 'handlers': {'console': {'enabled': True}, 'file': {'max_bytes': 1048576, 'rotate': True}}, 'level': 'INFO'}}This PR produces: { 'database': { 'host': 'db.example.com', 'options': {'connect_timeout': 5, 'pool_size': 10, 'ssl': True, 'sslmode': 'verify-full'}, 'port': 5432, }, 'logging': { 'file': '/var/log/app.log', 'handlers': {'console': {'enabled': True}, 'file': {'max_bytes': 1048576, 'rotate': True}}, 'level': 'INFO', }, }
Trey Hunner@trey.io · 4mo ago

Big news (for me at least): pprint on Python 3.15 is going to allow MUCH friendlier output! 🎉 Instead of: pprint.pprint(some_object) If you do this: pprint.pprint(some_object, indent=4, expand=True) You'll see output that looks like the most commonly used modern Python line-wrapping style!

Ryan Cavanaugh@searyanc.dev · 3mo ago

Sometimes when you're naming a flag, nothing seems to stick. You try for weeks, ask everyone you know, but the "right" name doesn't seem to be there. Eventually maybe you just ship a name that's bad enough that you figure people will read the docs to figure out what it does.