Last week I published a security advisory for Starlette, and the project got hit with a wave of negative press. So I wrote down my perspective as the maintainer. marcelotryle.com/blog/2026/05...

CVE-2026-48710: A Maintainer's Perspective - Marcelo Trylesinski

marcelotryle.com

@sethmlarson.dev and I went through months of intense, complex work to climb a steep and slippery learning curve, only to be stopped short at the very end by a hard ethical line we couldn't cross—it was gut-wrenching. I'm proud of what we did and I'm proud of what we didn't do.

Python Software Foundation@python.org · 9mo ago

TLDR; The PSF has made the decision to put our community and our shared diversity, equity, and inclusion values ahead of seeking $1.5M in new revenue. Please read and share. pyfound.blogspot.com/2025/10/NSF-... 🧵

This post was 5 years in the making, @shazow.net and I made a bet about whether "six", the Python 2/3 compatibility shim, would still be a popular package in 2025: sethmlarson.dev/winning-a-be...

Winning a bet about “six”, the Python 2 compatibility shim

Exactly five years ago today Andrey Petrov and I made a bet about whether “six”, the compatibility shim for Python 2 and 3 APIs, would still be in the top 20 daily downloads on PyPI. I said it woul...

sethmlarson.dev

Our Python doc is officially out in the wild! 🐍 Thanks to everyone who joined the premiere 🙌 such a good vibe. Here’s the link so you can watch it on repeat youtu.be/GfH4QL4VqJ0

Python: The Documentary | An origin story

YouTube video by CultRepo (formerly Honeypot)

youtu.be

Since PyCon Africa is affected by the PSF Grants pause, I am hopeful that donation tickets can make a difference.

Ngazetungue Muheue@muheuenga.bsky.social · last yr.

🎟️ Donation Ticket Now Available! Support PyCon Africa 2025 by purchasing a Donation Ticket, attend the conference and help us bring more developers from across Africa. 👉 za.pycon.org/tickets @python.org @za.pycon.org

Disqus showing ads on my blog was the last straw for me. I thought about storing comments on GitHub with utterances/giscus, but ended up on Commento. They have a generous free tier, don't track their users, and are trusted by Mozilla. Switching took only 10 minutes! commento.io

Commento

Add comments to your website with Commento. It's fast, modern, and privacy-focused.

commento.io

I wrote this to share everything I know about building great SDKs! open.substack.com/pub/pragmati...

Building great SDKs

A guide to creating SDKs that devs – and LLMs – will find a breeze to use, plus an overview of modern approaches for building and maintaining SDKs. By veteran SDK engineer, Quentin Pradet

open.substack.com

Exciting! Free-Threading builds are here to stay. The adoption has been incredibly fast so far. (urllib3 works with free-threading, but still need cryptography to add support before we can test it in CI.)

Donghee Na@corona10.bsky.social · last yr.

The Python Steering Council is pleased to announce that the Free-Threading project is no longer considered experimental! discuss.python.org/t/pep-779-cr...

This talk is incredible. In 30 minutes, a binary search implementation is sped up by 25x using profiling tools, including L1 cache and pipeline stall analysis. While the tools are Apple-specific, the concepts are general and apply everywhere. developer.apple.com/videos/play/...

Optimize CPU performance with Instruments - WWDC25 - Videos - Apple Developer

Learn how to optimize your app for Apple silicon with two new hardware-assisted tools in Instruments. We'll start by covering how to...

developer.apple.com

In the past nine months, three companies (Speakeasy, Stainless, and Fern) have collectively raised $49M to bring SDK and docs generation to everyone. Why now? I have no idea. After all, this has nothing to do with AI, and OpenAPI Generator has been popular for years.

It looks like mapping the new syntax to the Elasticsearch DSL, which natively supports nested queries and boolean operators, was the easy part. Elasticsearch has lots of features, yes, but it is to support advanced usages like this one!

Simon Willison@simonwillison.net · last yr.

Nice clear explanation of how GitHub roll out new implementations of features out that get 2,000 queries a second - including dark-shipping to 1% of users where the new implementation is invisibly compared with the production one via a background job

OpenAPI is incredibly popular and useful, but it is also flawed as a general-purpose API description tool. We hit many issues when using it to describe Elasticsearch APIs.

AGPL continues to get more popular as companies want the open source label for their product! Elastic did the same thing last year.

antirez@antirez.bsky.social · last yr.

Redis is open source again: antirez.com/news/151

Facebook are launching a new type checker written in rust. pyrefly.org

Thank you @americanexpress.bsky.social for sponsoring urllib3 and helping improve critical Python internet infrastructure. I know it takes a lot of activation energy for a large company to sponsor an amount like this, so I extra appreciate whoever did the leg work on this. 🙏

Elastic is now on BlueSky! Follow us here for the latest updates on all things search, observability, security and more.

PEP 751 has been accepted! peps.python.org/pep-0751/ This means #Python now has a lock file standard that can act as an export target for tools that can create some sort of lock file. And for some tools the format can act as their primary lock file format as well instead of some proprietary format.

PEP 751 – A file format to record Python dependencies for installation reproducibility | peps.python.org

This PEP proposes a new file format for specifying dependencies to enable reproducible installation in a Python environment. The format is designed to be human-readable and machine-generated. Installe...

peps.python.org

Now I'm looking for someone with 7+ years of FastAPI experience 🤭 Jokes aside, I'm doing interesting new things and want some extra help full-time 🚀 I'm looking for tons of skills and knowledge in SRE / DevOps / Platform / Cloud / name-it ...and of course, FastAPI Email jobs@fastapilabs.com

It's here! The 2024 annual report for #urllib3, a relatively quiet year that included work on HTTP/2 and Web Assembly (WASM). $3,300 worth of bounty issues exist today! quentin.pradet.me/blog/urllib3...

#Git mini tip: Use '-' to refer to the previously checked-out branch with 'git switch' and 'git checkout'. It’s great for returning to a feature branch after pulling the main or toggling back and forth to compare.

Tidelift, @microsoft.com, LaunchDarkly, @sentry.io, @sourcegraph.com, Canva, and @codecov.bsky.social all supported urllib3 in 2024. Thank you!

10 years ago, as part of my PhD, I launched a small PHP 5 application online. It's still up! Now using PHP 8. I intend to keep it online for a few more decades. Cool URIs don't change. Part of the trick is @alwaysdata.bsky.social, my hosting provider, which handles database and system upgrades.

📦 urllib3 2.3.0 is now available! It supports the WebAssembly JSPI API (enabling experimental Node.js support) and adds `HTTPResponse.shutdown()` (thanks to LaunchDarkly for sponsoring this feature). github.com/urllib3/urll... Note that we're still raising funds for full HTTP/2 support!

Release 2.3.0 · urllib3/urllib3

🚀 urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial ...

github.com

@gergely.pragmaticengineer.com has this impressive page listing early trends he identified: blog.pragmaticengineer.com/early-trends/. Here's one more: GenAI tools are heavily subsidized (newsletter.pragmaticengineer.com/p/ide-that-s...), so we'll see more expensive subscriptions like ChatGPT Pro.

What this also means is that urllib3 works great with free-threaded Python! 🎉 I am sure it will expose some subtle concurrency bugs that exist already. But before we can have CI, we need cryptography wheels as we use it to generate test certificates.

David Pilato 🇪🇺🇫🇷@pilato.fr · 2y ago

📣 @quentin.pradet.me wrote 'Does the #Elasticsearch #Python client works with free-threaded Python (no-GIL)?' for the @elastic #AdventCalendar ▶️ https://discuss.elastic.co/t/370392. 🎅🏼🎄🎁

📣 @quentin.pradet.me wrote 'Does the #Elasticsearch #Python client works with free-threaded Python (no-GIL)?' for the @elastic #AdventCalendar ▶️ https://discuss.elastic.co/t/370392. 🎅🏼🎄🎁

Trying #Python 3.13 free-threading builds with uv is as easy as specifying `--python 3.13t`. If you don't have such an interpreter available, uv will download a standalone build for you! The full list of options to install 3.13t builds is here: py-free-threading.github.io/installing_c...

I really enjoyed this talk and the fun anecdotes around #Python packaging! The highlight for me was @burntsushi.net making `uv pip compile` 3x faster by representing most versions as a single u64 integer, making comparisons much cheaper.

Yaron Minsky@yminsky.bsky.social · 2y ago

Jane Street recently restarted our tech talk series after a pandemic-driven hiatus. Our first talk was from Charlie Marsh of Ruff fame, talking about how they made uv, their new package manager for Python, so fast! youtu.be/gSKTfG1GXYQ?...

Time flies: urllib3 is fully type annotated since 2021! sethmlarson.dev/tests-arent-... Since then, maintaining the types has been easy despite our growth. And they kept paying dividends, just like our decision of enforcing 100% coverage. #Python #SoftwareEngineering

Tests aren’t enough: Case study after adding type hints to urllib3

Since Python 3.5 was released in 2015 including PEP 484 and the typing module type hints have grown from a nice-to-have to an expectation for popular packages. To fulfill this expectation our team...

sethmlarson.dev

Our #elastic community is growing on bsky 🫎🔎 💙🩵🩷💚💛