Security updates for Thursday
Security updates have been issued by AlmaLinux (dovecot, fence-agents, freeipmi, git-lfs, image-builder, kernel, libsoup, osbuild-composer, and python-tornado), Debian (apache2, libdatetime-timezone-perl, lrzip, tzdata, and wireshark), Fedora (dovecot, forgejo-runner, gh, gnutls, krb5, nano, pdns, pyOpenSSL, squid, vim, and xorg-x11-server-Xwayland), Mageia (graphicsmagick, kernel-linus, krb5-appl, libexif, libtiff, nano, nginx, ntfs-3g, opam, perl-Net-CIDR-Lite, perl-Starlet, perl-Starma … ⌘ Read more
Security updates for Wednesday
Security updates have been issued by AlmaLinux (corosync, dovecot, image-builder, python-tornado, resource-agents, and systemd), Debian (openjdk-11, openjdk-17, and pyjwt), Fedora (pdns, pyOpenSSL, and squid), Slackware (hunspell), SUSE (alloy, avahi, bubblewrap, cmctl, coredns, curl, dpkg, firefox, golang-github-prometheus-prometheus, grafana, libpng12, PackageKit, sed, and xen), and Ubuntu (docker.io-app, nghttp2, python-django, and python-mako). ⌘ Read more
He Couldn’t Land a Job Interview. Was AI to Blame?
Armed with some Python and a white-hot sense of injustice, one medical student spent six months trying to figure out whether an algorithm trashed his job application. ⌘ Read more
Security updates for Monday
Security updates have been issued by AlmaLinux (kernel, libcap, libtiff, sudo, and thunderbird), Debian (dovecot, imagemagick, incus, kernel, libexif, linux-6.1, openjdk-25, pyasn1, python-aiohttp, and thunderbird), Fedora (chromium, firefox, GitPython, glibc, insight, krb5, nano, nss, openssh, openvpn, perl-CryptX, python3.14, rust-openssl, rust-openssl-sys, rust-sequoia-git, and xen), Oracle (dtrace, fence-agents, grafana-pcp, libcap, libtiff, sudo, and xorg-x11-server-Xwayland), **Red Ha … ⌘ Read more
CachyOS Switches Python To Using Tail-Call Interpreter For 5~15% Better Performance
CachyOS is a very fast out-of-the-box Linux distribution and for those concerned about Python performance, the newest updates to this Arch Linux based distribution will provide even better performance… ⌘ Read more
[$] LWN.net Weekly Edition for April 30, 2026
Inside this week’s LWN.net Weekly Edition:
Front: Famfs; Python packaging council; Zig concurrency; pages and folios; Strawberry music manager; 7.1 merge window.
Briefs: GnuPG 2.5.19; Copy Fail; Plasma security; Fedora 44; Ubuntu 26.04; Niri 26.04; pip 26.1; RIP Seth Nickell; RIP Tomáš Kalibera; Quotes; …
Announcements: Newsletters, conferences, security updates, patc … ⌘ Read more
[$] Python packaging council approved
The Python packaging world now has a formal
governance council, of the form described in PEP 772 (“Packaging
Council governance process”), which was approved\
by the steering council on April 16. It has been over a year
since the PEP was first proposed in February 2025 and it has undergone
lengthy discussions in multiple postings … ⌘ Read more
Security updates for Wednesday
Security updates have been issued by AlmaLinux (firefox, gdk-pixbuf2, java-17-openjdk, libxml2, python3, python3.11, python3.12, sudo, and webkit2gtk3), Debian (dnsdist, node-tar, pdns, pdns-recursor, and policykit-1), Fedora (chromium, edk2, and vim), Oracle (firefox, gdk-pixbuf2, go-toolset:rhel8, libpng12, LibRaw, libxml2, python, python3, python3.11, python3.12, python3.12-wheel, vim, webkit2gtk3, xorg-x11-server, xorg-x11-server-Xwayland, yggdrasil, and yggdrasil-worker-package-mana … ⌘ Read more
pip 26.1 released
Version 26.1 of
the pip package installer for Python has been released. Richard Si
has published a blog\
post that looks at some of the highlights of 26.1 including
dependency cooldowns, experimental support for pylock ( pylock.toml)
files, and [resolver\
improvements](https://ichard26.github.io/blog/2026/04/whats-new-i … ⌘ Read more
Security updates for Friday
Security updates have been issued by Fedora (anaconda, dnf5, firefox, flatpak-builder, libexif, minetest, nss, plasma-setup, python-blivet, rpki-client, and xorg-x11-server), Oracle (bind, kernel, osbuild-composer, thunderbird, webkit2gtk3, and wireshark), Red Hat (java-25-openjdk), SUSE (cacti, cacti, cacti-spine, cockpit-machines, cockpit-podman, cockpit-tukit, csync2, flannel, gdk-pixbuf, go1.25-openssl, go1.26-openssl, haproxy, kernel, libcap, libpng16, libtree-sitter0_26, libvirt, ncu … ⌘ Read more
[$] LWN.net Weekly Edition for April 23, 2026
Inside this week’s LWN.net Weekly Edition:
Front: LLMs and Python bugs; scheduler regression; new Rust traits; dependency cooldowns; 7.1 merge window; Shor’s algorithm; drama at The Document Foundation.
Briefs: Firefox zero-days; kernel code removal; reproduceible Arch; Debian election; Firefox 150; Forgejo 15.0; Git 2.54.0; KDE Gear 26.04; LillyPond 2.26.0; Rust 1.95.0; Quotes; …
[Announcements](https:/ … ⌘ Read more
Security updates for Wednesday
Security updates have been issued by Debian (firefox-esr, flatpak, ngtcp2, ntfs-3g, packagekit, python-geopandas, simpleeval, strongswan, and xdg-dbus-proxy), Fedora (chromium, cups, curl, jq, opkssh, perl-Net-CIDR-Lite, python-cbor2, python-pillow, tinyproxy, xdg-dbus-proxy, and xorg-x11-server-Xwayland), Slackware (libXpm and mozilla), SUSE (botan, chromium, clamav, cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-subscriptions, dovecot24, firefox, flatpak, freeipmi … ⌘ Read more
[$] Using LLMs to find Python C-extension bugs
The open-source world is currently awash in\
reports of LLM-discovered bugs and vulnerabilities, which makes for a lot more
work for maintainers, but many of the current crop are being reported
responsibly with an eye toward minimizing that impact. A recent report
on an effort to systematically find bugs in [Python extensions\
written in C](h … ⌘ Read more
PEP 833: Freezing the HTML simple repository API
This PEP proposes freezing the standard HTML representation of the simple repository API, as originally specified in PEP 503 and updated over subsequent PEPs. ⌘ Read more
Security updates for Monday
Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, delve, freerdp, giflib, go-rpm-macros, libarchive, and openexr), Debian (gimp, imagemagick, luanti, mapserver, mupdf, opam, perl, pillow, postgresql-13, and tiff), Fedora (aqualung, awstats, curl, incus, mac, mbedtls, mingw-LibRaw, python-msal, python3.11, python3.12, python3.15, smb4k, stb, and usd), Gentoo (DTrace and FUSE), Mageia (gdk-pixbuf2.0, giflib, polkit-122, python-cairosvg, and rsync), Oracle … ⌘ Read more
Security updates for Tuesday
Security updates have been issued by Debian (gdk-pixbuf, gst-plugins-bad1.0, and xdg-dbus-proxy), Fedora (chromium, deepin-image-viewer, dtk6gui, dtkgui, efl, elementary-photos, entangle, flatpak, freeimage, geeqie, gegl04, gthumb, ImageMagick, kf5-kimageformats, kf5-libkdcraw, kf6-kimageformats, kstars, libkdcraw, libpasraw, LibRaw, luminance-hdr, nomacs, OpenImageIO, OpenImageIO2.5, photoqt, python-cryptography, rawtherapee, shotwell, siril, swayimg, vips, and webkitgtk), Red Hat (firefox an … ⌘ Read more
Security updates for Monday
Security updates have been issued by AlmaLinux (fontforge, freerdp, libtiff, nginx, nodejs22, and openssh), Debian (bind9, chromium, firefox-esr, flatpak, gdk-pixbuf, inetutils, mediawiki, and webkit2gtk), Fedora (corosync, libcap, libmicrohttpd, libpng, mingw-exiv2, mupdf, pdns-recursor, polkit, trafficserver, trivy, vim, and yarnpkg), Mageia (libpng12, openssl, python-django, python-tornado, squid, and tomcat), Red Hat (rhc), Slackware (openssl), SUSE (chromedriver, chromium, … ⌘ Read more
Security updates for Friday
Security updates have been issued by AlmaLinux (container-tools:rhel8, fontforge, freerdp, go-toolset:rhel8, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good, kernel, kernel-rt, libtasn1, mariadb:10.11, mysql:8.4, nginx:1.24, openssh, pcs, python-jinja2, python3.9, ruby:3.1, vim, virt:rhel and virt-devel:rhel, and xmlrpc-c), Debian (libyaml-syck-perl and openssh), Fedora (cockpit, crun, dnsdist, doctl, fido-device-onboard, libcgif, libpng12, libpng15, mbedtls, o … ⌘ Read more
Security updates for Thursday
Security updates have been issued by Debian (firefox-esr, postgresql-13, and tiff), Fedora (bind, bind-dyndb-ldap, cef, opensc, python-biopython, python-pydicom, and roundcubemail), Slackware (mozilla), SUSE (ckermit, cockpit-repos, dnsdist, expat, freerdp, git-cliff, gnutls, heroic-games-launcher, libeverest, openssl-1_1, openssl-3, polkit, python-poetry, python-requests, python311-social-auth-app-django, and SDL2_image-devel), and Ubuntu (dogtag-pki, gdk-pixbuf, linux, linux-aws, … ⌘ Read more
Security updates for Wednesday
Security updates have been issued by Debian (openssl), Fedora (corosync, goose, kea, pspp, and rauc), Mageia (python-pygments, roundcubemail, and tigervnc), SUSE (bind, gimp, google-cloud-sap-agent, govulncheck-vulndb, ignition, ImageMagick, python, python-PyJWT, and python-pyOpenSSL), and Ubuntu (adsys, juju-core, lxd, python-django, and salt). ⌘ Read more
Via https://github.com/newsboat/newsboat/issues/3220#issuecomment-4198066671 I came across this nice selection on why not to use AI: https://github.com/Vxrpenter/AIMania/blob/main/WHY.md#why
This then lead me to the slopware list: https://codeberg.org/small-hack/open-slopware
Holy shit, there’s even more than I thought. :-O In addition to Vim, the following affects me more or less daily (but hopefully not my ancient versions): curl, VLC, ImageMagick, rsync, Python, systemd and even the Linux Kernel itself. Oh fuck me dead. :‘-(
Security updates for Tuesday
Security updates have been issued by AlmaLinux (crun, kernel, and kernel-rt), Debian (dovecot), Fedora (calibre and nextcloud), Mageia (freerdp, polkit-122, python-nltk, python-pyasn1, vim, and xz), Red Hat (edk2 and openssl), SUSE (avahi, cockpit, python-pyOpenSSL, python311, and tar), and Ubuntu (lambdaisland-uri-clojure, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-oem-6.17, and linux-realtime-6.17). ⌘ Read more
Python Blood Could Hold the Secret To Healthy Weight Loss
Longtime Slashdot reader fahrbot-bot writes: CU Boulder researchers are reporting that they have discovered an appetite-suppressing compound in python blood that helps the snakes consume enormous meals and go months without eating yet remain metabolically healthy. The findings were published in the journal Natural Metabolism on March 19, 2026.
Pythons can … ⌘ Read more
PEP 829: Structured Startup Configuration via .site.toml Files
This PEP proposes a TOML-based configuration file format to replace the .pth file mechanism used by site.py during interpreter startup. The new format, using files named .site.toml, provides structured configuration for extending sys.path and executing package initialization code, replacing the current ad-hoc .pth format that conflates path configuration with arbitrary code execution. ⌘ Read more
SystemD Contributor Harassed Over Optional Age Verification Field, Suggests Installer-Level Disabling
It’s FOSS interviewed a software engineer whose long-running open source contributions include Python code for the Arch Linux installer and maintaining packages for NixOS. But “a recent change he made to systemd has pushed him into the spotlight” after he’d added the optiona … ⌘ Read more
Popular LiteLLM PyPI Package Backdoored To Steal Credentials, Auth Tokens
joshuark shares a report from BleepingComputer: The TeamPCP hacking group continues its supply-chain rampage, now compromising the massively popular “LiteLLM” Python package on PyPI and claiming to have stolen data from hundreds of thousands of devices during the attack. LiteLLM is an open-source Python library that serves as a gat … ⌘ Read more
Python’s Stamina for Go: Bringing Ergonomic Resilience to Gophers
1 points posted by cinar ⌘ Read more
LLM-Driven Large Code Rewrites With Relicensing Are The Latest AI Concern
The newest open-source concern around AI that is seeing a lot of interest this weekend is when large language models / AI code generators may rewrite large parts of a codebase and then the “developers” claiming an alternative license incompatible with the original source license. This became a real concern this week with a popular Python project experiencing an AI-driven code rewrite and now published under an alternative license that … ⌘ Read more
Resile is an ergonomic, execution resilience and retry library for Go.
Resile is an ergonomic, type-safe execution resilience and retry library for Go. Inspired by Python’s stamina, it features generic execution wrappers, AWS Full Jitter backoff, native Retry-After header support, and zero-dependency observability for distributed systems. 1 points posted by cinar ⌘ Read more
AMD GAIA 0.16 Introduces C++17 Agent Framework For Building AI PC Agents In Pure C++
AMD’s GAIA open-source framework for building AI agents that run locally on Ryzen AI hardware via the Radeon iGPUs and/or NPUs is up to version 0.16. With this new GAIA release is support for developing AI agents purely in C++ with no longer needing to depend upon Python… ⌘ Read more
PEP 828: Supporting ‘yield from’ in asynchronous generators
This PEP introduces support for yield from in an asynchronous generator function. ⌘ Read more
Python ‘Chardet’ Package Replaced With LLM-Generated Clone, Re-Licensed
Ancient Slashdot reader ewhac writes: The maintainers of the Python package `chardet`, which attempts to automatically detect the character encoding of a string, announced the release of version 7 this week, claiming a speedup factor of 43x over version 6. In the release notes, the maintainers claim that version 7 is, “a ground … ⌘ Read more
AMD Engineer Leverages AI To Help Make A Pure-Python AMD GPU User-Space Driver
AMD’s VP of AI Software, Anush Elangovan, has used Claude Code to help craft a pure-Python AMD GPU user-space driver. This Python user-space driver is currently being created to help exercise other ROCm code and for debugging in passing through the ROCm/HIP user-space stack… ⌘ Read more
PEP 827: Type Manipulation
We propose to add powerful type-level introspection and construction facilities to the type system, inspired in large part by TypeScript’s conditional and mapped types, but adapted to the quite different conditions of Python typing. ⌘ Read more
Is AI Impacting Which Programming Language Projects Use?
“In August 2025, TypeScript surpassed both Python and JavaScript to become the most-used language on GitHub for the first time ever…” writes GitHub’s senior developer advocate.
They point to this as proof that “AI isn’t just speeding up coding. It’s reshaping which languages, frameworks, and tools developers choose in the first place.”
Eighty percent of … ⌘ Read more
PEP 826: Python 3.16 Release Schedule
This document describes the development and release schedule for Python 3.16. ⌘ Read more
How Python’s Security Response Team Keeps Python Users Safe
This week the Python Software Foundation explained how they keep Python secure. A new blog post recognizes the volunteers and paid Python Software Foundation staff on the Python Security Response Team (PSRT), who “triage and coordinate vulnerability reports and remediations keeping all Python users safe.”
Just last year the PSRT published 16 vulnerabi … ⌘ Read more
Fake Job Recruiters Hid Malware In Developer Coding Challenges
“A new variation of the fake recruiter campaign from North Korean threat actors is targeting JavaScript and Python developers with cryptocurrency-related tasks,” reports the Register.
Researchers at software supply-chain security company ReversingLabs say that the threat actor creates fake companies in the blockchain and crypto-trading sectors and publ … ⌘ Read more
Autonomous AI Agent Apparently Tries to Blackmail Maintainer Who Rejected Its Code
“I’ve had an extremely weird few days…” writes commercial space entrepreneur/engineer Scott Shambaugh on LinkedIn. (He’s the volunteer maintainer for the Python visualization library Matplotlib, which he describes as “some of the most widely used software in the world” with 130 million downloads each month.) … ⌘ Read more
OpenIndiana Is Porting Solaris’ IPS Package Management To Rust
OpenIndiana as the open-source project built atop Illumos that is continuing to maintain and advance the former OpenSolaris code is working on a big ambitions of modernizing the Image Packaging System (IPS) package management solution. As part of that they are working to move from a C and Python codebase over to Rust… ⌘ Read more
↳
In-reply-to
»
Omg, Python. Parsing arguments with
⤋ Read More
argparse takes 50 ms on my NUC, because this pulls in all kinds of fancy stuff behind the scenes, colorization and what not. 😮💨
Just importing data classes takes another 60 ms … This fancy new stuff is really costly.
Omg, Python. Parsing arguments with argparse takes 50 ms on my NUC, because this pulls in all kinds of fancy stuff behind the scenes, colorization and what not. 😮💨
AMD Making It Easier To Install vLLM For ROCm
Deploying vLLM for LLM inference and serving on NVIDIA hardware can be as easy as pip3 install vllm. Beautifully simple just as many of the AI/LLM Python libraries can deploy straight-away and typically “just work” on NVIDIA. Running vLLM atop AMD Radeon/Instinct hardware though has traditionally meant either compiling vLLM from source yourself or AMD’s recommended approach of using Docker containers that contain pre-built versions of vLLM. Finally there is now a blessed P … ⌘ Read more
Spent basically the entire day (except for the mandatory walk) fighting with Python’s type hints. But, the result is that my widget toolkit now passes mypy --strict.
I really, really don’t want to write larger pieces of software without static typing anymore. With dynamic typing, you must test every code path in your program to catch even the most basic errors. pylint helps a bit (doesn’t need type hints), but that’s really not enough.
Also, somewhere along the way, I picked up a very bad (Python) programming style. (Actually, I know exactly where I picked that up, but I don’t want to point the finger now.) This style makes heavy use of dicts and tuples instead of proper classes. That works for small scripts, but it very quickly turns into an absolute mess once the program grows. Prime example: jenny. 😩
I have a love-hate relationship with Python’s type hints, because they are meaningless at runtime, so they can be utterly misleading. I’m beginning to like them as an additional safety-net, though.
(But really, if correctness is the goal, you either need to invest a ton of time to get 100% test coverage – or don’t use Python.)
Anthropic Invests $1.5 Million in the Python Software Foundation and Open Source Security
Python Software Foundation: We are thrilled to announce that Anthropic has entered into a two-year partnership with the Python Software Foundation (PSF) to contribute a landmark total of $1.5 million to support the foundation’s work, with an emphasis on Python ecosystem security. This investme … ⌘ Read more
↳
In-reply-to
»
@movq @prologic That's what I like about Go, too. However, every now and then I really dislike the result, e.g. when removing spaces from a column layout. Doesn't happen often, but when it does, I hate it.
⤋ Read More
Pep8 is deprecated, I think
Hmm, I don’t think it is, this still says “Status: Active”: https://peps.python.org/pep-0008/ 🤔
↳
In-reply-to
»
Since I used so much Rust during the holidays, I got totally used to
⤋ Read More
rustfmt. I now use similar tools for Python (black and isort).
@movq@www.uninformativ.de @prologic@twtxt.net That’s what I like about Go, too. However, every now and then I really dislike the result, e.g. when removing spaces from a column layout. Doesn’t happen often, but when it does, I hate it.
I think I should have a look at Python formatters, too. Pep8 is deprecated, I think, it’s been some time that I looked at it.
Intel Releases Open3D 0.19 With Experimental Cross-Platform GPU Support Using SYCL
Not to be confused with the Open 3D game engine, Intel’s Intelligent Systems Lab Organization released Open3D 0.19 as the latest iteration of this open-source library for 3D data processing in Python and C++… ⌘ Read more
PEP 821: Support for unpacking TypedDicts in Callable type hints
This PEP proposes allowing Unpack[TypedDict] in the parameter list inside Callable, enabling concise and type-safe ways to describe keyword-only callable signatures. Currently, Callable assumes positional-only parameters, and typing keyword-only functions requires verbose callback protocols. With this proposal, the keyword structure defined by a TypedDict can be reused directly in Callable. ⌘ Read more