Veit Schiele
@veit-schiele.de
Author of Python for Data Science, Jupyter Tutorial and PyViz tutorial • pyberlin organiser • Development, consulting and operation of privacy compliant web services at cusy. #Python #Jupyter #PyViz #DataScience
• How can you make your code more secure? • How can you ensure separation of concerns? • How can you continuously verify the security of your dependencies? • How do you create SBOMs? www.python4data.science/en/latest/pr... #Python #SupplyChain #Vulnerability #SBOM
Security
As of July 2026, PyPI hosts over 750,000 packages, and this number is growing daily. An average Python project includes dozens of additional dependencies – packages that you have never explicitly c...
python4data.science
🧵 1/2 Attacks on the software supply chain are increasing rapidly. We have therefore updated our guide on how to make your projects more secure, adding answers to the following questions:
Security
As of July 2026, PyPI hosts over 750,000 packages, and this number is growing daily. An average Python project includes dozens of additional dependencies – packages that you have never explicitly c...
python4data.science
The maintainers considered this a breaking change, hence the version bump, probably because it flips existing expectations. If you expected that the Action was caching downloads before, now it actually does, so it's a logical fix in that regard. Read more: github.com/astral-sh/se...
Release v9.0.0 🌈 Change `prune-cache` default to `false` · astral-sh/setup-uv
Changes This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher ...
github.com
The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised. blog.pypi.org/posts/2026-0... #python #security #supplychain #pypi
Releases now reject new files after 14 days - The Python Package Index Blog
PyPI no longer allows publishing new files to releases older than 14 days.
blog.pypi.org
Software Bill of Materials (SBOMs) are commonly used to check software and its dependencies for vulnerabilities using CVE and OSV. We have described how to create these for Python packages here: python4data.science/en/latest/pr... #Python #SBOM #Vulnerability
Software Bill of Materials (SBOM)
A Software Bill of Materials (SBOM) is a document used to exchange information about software and its composition. This format is primarily used in the security field to check software and its depe...
python4data.science
Specification-Driven Development (SDD) was developed to improve the predictability and maintainability of agentic software development. In particular, we are continuing to give OpenSpec a chance: agentic-software-engineering.readthedocs.io/en/latest/pr... #CodingAgent #SDD #DX
Spec-Driven Development
Development teams are increasingly facing challenges regarding predictability and maintainability when requirements and context are stored exclusively in short-lived chat threads. To address this i...
agentic-software-engineering.readthedocs.io
The #AI platform #HuggingFace appears to have been attacked by autonomous, AI-driven offensive tooling – and was also detected and analysed by AI tools. They advises users to revoke access credentials and tokens, and to check for any recent activity on their accounts: huggingface.co/blog/securit...
Security incident disclosure — July 2026
We’re on a journey to advance and democratize artificial intelligence through open source and open science.
huggingface.co
Now that the FrOSCon programme has been published, I’m planning to attend on 15 and 16 August: programm.froscon.org/froscon2026/... #FrOSCon
FrOSCon 2026
Schedule, talks and talk submissions for FrOSCon 2026
programm.froscon.org
We are switching from pre-commit to prek. Whilst prek is also faster, the decisive factors were the security-related features: pinned SHA revisions and cooldown: www.python4data.science/en/latest/pr... #Python #DX #DevOps #DevSecOps #Security
prek
prek is a variant of pre-commit, written in Rust, for managing and maintaining multilingual commit hooks. An essential task is to make the same scripts available to the entire development team. pre...
python4data.science
When is data truly considered anonymous? The European Data Protection Board has published new guidelines on this topic: www.edpb.europa.eu/public-consu... #EU #DataProtection #Anonymisation #Privacy
Guidelines 02/2026 on Anonymisation | European Data Protection Board
edpb.europa.eu
We have added the `errors` argument to the instructions for reading and writing files, so that files with encoding issues can be read more effectively. And, fortunately, UTF-8 becomes the default in Python 3.15: python-basics-tutorial.readthedocs.io/en/latest/sa... #Python
Files and Directories
pathlib implements path operations using pathlib.PurePath and pathlib.Path objects. The os and os.path modules, on the other hand, provide functions that work at a low level with str and bytes, whi...
python-basics-tutorial.readthedocs.io
We have released a new version. As well as the usual software updates, it includes agent-based code generation and securing the software supply chain: www.python4data.science/en/26.1.0/ #Python #DataScience #AgenticCoding #Claude #SoftwareEngineering #SoftwareSupplyChain #SupplyChain
Python for Data Science
This is a tutorial on Data Science with Python. This immediately raises the question: What is Data Science? The term has become ubiquitous, but there is no single definition. Some even consider the...
python4data.science
On my way to a flying visit to Berlin. Tomorrow, the Python Users Berlin (@python.berlin) are meeting for a talk by Sam Bail on PySpark: www.meetup.com/python-users... #Python #Berlin
Python Users Berlin (PUB): An introduction to PySpark, Thu, Jul 2, 2026, 7:00 PM | Meetup
📆 Agenda * 19:00 Welcome to the PUB (Python Users Berlin) – setting up * 19:15 Main talk * 20:00 Lightning talks * 20:30 Social gathering 🎙 Main talk by [Sam Bail](http
meetup.com
Critical libssh2 vulnerability with a proof-of-concept exploit already published. curl, PHP and libgit2 are also affected. nvd.nist.gov/vuln/detail/... #ssh #Vulnerability #ITSecurity #curl
NVD - CVE-2026-55200
nvd.nist.gov
#TIL that there is also a pre-commit check for uv audit: www.python4data.science/en/latest/pr... #Python #CVE #Vulnerability #Git #ITSecurity #SupplyChain
Security
In previous chapters, we have already provided some tips designed to help ensure safer operation. Here, we would like to summarise and expand on the individual elements once again. We will be using...
python4data.science
🐍🚀 Out now: Python 3.15 beta 3! 💤 Lazy imports! 🧊 frozendict builtin! 💂 sentinel builtin! 📉 Tachyon profiler! 🖼️ Frame pointers everywhere! 🎨 More colour! 🚌 & more! Library maintainer? Add 3.15 to your CI and send us those bugs reports! discuss.python.org/t/python-3-1... #Python #Python315 #release
Python 3.15.0 beta 3 is here!
Here comes the penultimate beta. This is a beta preview of Python 3.15 Python 3.15 is still in development. This release, 3.15.0b3, is the third of four planned beta releases, containing around 19...
discuss.python.org
Guardrails enable you to defend against prompt injection or jailbreak attacks by your coding agents. In our tutorial, we show you the options available to you for this purpose: agentic-software-engineering.readthedocs.io/en/latest/se... #PromptInjection #Jailbreak #AI #Agentic #Coding #ITSecurity
Guardrails
The term AI guardrails first appeared in 2023, when ChatGPT launched its consumer service. The initial versions contained numerous security and privacy vulnerabilities, which ultimately prompted ma...
agentic-software-engineering.readthedocs.io
Spack v1.2.0 is out, loaded with features and performance improvements! Highlights: 🧵Parallel installer 🛠️Concretization groups 🧠Concretization caching 📝SBOMs 🔒spack isolate 🏖️ experimental sandboxing Get it now! github.com/spack/spack/... Demo: asciinema.org/a/755827
Release v1.2.0 (2026-06-21) · spack/spack
v1.2.0 is a major feature release. The main changes you'll notice are the new, parallel installer and the many performance improvements we've added. There are also usability features like concretiz...
github.com
We have added a section on @tiangolo.com’s Library Skills to our agent-based software engineering tutorial: agentic-software-engineering.readthedocs.io/en/latest/sh... #AI #Agentic #Coding #Skills
Skills
As coding agents evolve from simple chat interfaces towards autonomous task execution, context engineering has become a critical challenge. Agent Skills provide an open standard for modularising co...
agentic-software-engineering.readthedocs.io
I’m organising the next @pyberlin meet-up, featuring a talk by Sam Bail on PySpark: www.meetup.com/python-users... #Python #Berlin #DataScience
Python Users Berlin (PUB): PySpark, Thu, Jul 2, 2026, 7:00 PM | Meetup
📆 Agenda * 19:00 Welcome to the PUB (Python Users Berlin) – setting up * 19:15 Main talk * 20:00 Lightning talks * 20:30 Social gathering 🎙 Main talk by [Sam Bail](http
meetup.com
Taking Measure spoke to Guido van Rossum to find out more about #Python, what he gets up to in his spare time, and his brief spell at #NIST: www.nist.gov/blogs/taking...
The Programming Language Named for Monty Python Evolved at NIST
The creator of the popular programming language Python worked at NIST while developing it.
nist.gov
Taking Measure spoke to Guido van Rossum to find out more about #Python, what he gets up to in his spare time, and his brief spell at #NIST: www.nist.gov/blogs/taking...
The Programming Language Named for Monty Python Evolved at NIST
The creator of the popular programming language Python worked at NIST while developing it.
nist.gov
Der Artikel »Wie LLM-Agenten Open-Source-Projekte gefährden« von Frank Hofmann und mir ist im Linux-Magazin erschienen: www.linux-magazin.de/ausgaben/202... #OpenSource #LLM #SLOP
We have expanded our tutorials to include answers to the question of how coding agents can assist data scientists with programming: • python-basics-tutorial.readthedocs.io/de/latest/li... • github.com/veit/python-... #Python #DataScience #CodingAgents #Claude #Cursor
With uv≥0.11.19, you can check dependencies in your project for known vulnerabilities: • python-basics-tutorial.readthedocs.io/en/latest/li... • www.python4data.science/en/latest/pr... #Python #uv #Vulnerability #ITSecurity
Security
In previous chapters, we have already provided some tips designed to help ensure safer operation. Here, we would like to summarise and expand on the individual elements once again. We will be using...
python4data.science
📆 On 13 August, all #Berlin #Python user groups – @pyladiesberlin.bsky.social , @python.berlin, dub, PyBerlin, etc. will be getting together again for a BBQ @c-base.org: www.meetup.com/python-users...
Python in Berlin BBQ @ c-base, Thu, Aug 13, 2026, 7:00 PM | Meetup
Normally we announce our talks here, but this time we are taking a short summer break and therefore invite you to a barbecue at the Spree. The BBQ is for all Berlin Python
meetup.com
I wrote a new post for the Astral blog about how we’re building more vulnerability and malware defenses directly into uv: astral.sh/blog/uv-audit
Vulnerability and malware checks in uv
Find vulnerabilities in your Python dependencies with uv audit and prevent installation of known malware with uv's experimental malware detection.
astral.sh
If uv is not available in a Python environment, you can still specify the versions using pylock.toml. We have described how to do this here: python-basics-tutorial.readthedocs.io/en/latest/li... #Python #DevSecOps #ITSecurity
Adding more Python libraries
Although Python’ „Batteries included“ philosophy means that you can already do a lot with the default installation of Python, there will inevitably come a situation where you need functionality tha...
python-basics-tutorial.readthedocs.io