• Lock the Ghost
• Fence for Sandboxing
• MALUS: Liberate Open Source
• Harden your GitHub Actions Workflows with zizmor, dependency pinning, and dependency cooldowns
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• **Patreon SupportersConnect with the hosts**
• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: Lock the Ghost

• The five core takeaways:
  1. PyPI "removal" doesn't delete distribution files. When a package is removed from PyPI, it disappears from the index and project page, but the actual distribution files remain accessible if you have a direct URL to them.
  2. uv.lock uniquely preserves access to ghost packages. Because uv.lock stores direct URLs to distribution files rather than relying on the index API at install time, uv sync can successfully install packages that have already been removed, even with cache disabled. No other Python lock file implementation tested behaved this way.
  3. This creates a supply chain attack vector. An attacker could upload a malicious package, immediately remove it to dodge automated security scanning, and still have it installable via a uv.lock file, or combine this with the xz-style strategy of hiding malicious additions in large, auto-generated lock files that nobody reviews.
  4. Removed package names can be hijacked with version collisions. When an owner removes a package, the name can be reclaimed by someone else who can upload different distribution types under the same version number, as happened with "umap." Lock files help until you regenerate them, then you're exposed.
  5. Your dependency scanning needs to cover lock files, not just manifest files. Scanning only pyproject.toml or requirements.txt misses threats embedded in lock files, which is where the actual resolved URLs and hashes live.

Brian #2: Fence for Sandboxing

• Suggested by Martin Häcker
• “Some coding platforms have since integrated built-in sandboxing (e.g., Claude Code) to restrict write access to directories and/or network connectivity. However, these safeguards are typically optional and not enabled by default.”
• “JY Tan (on cc) has extracted the sandboxing logic from Claude Code and repackaged it into a standalone Go binary.”
• Source code on GitHub: https://github.com/Use-Tusk/fence
• Related:
  • Simon Willison lethal trifecta for AI agents article from June 2025
  • Claude Code Sandboxing

Michael #3: MALUS: Liberate Open Source

• via Paul Bauer
• The service will generate the specs of a library with one AI and build the newly licensed library using the specs with another AI circumventing the licensing and copyright rules.
• AI that has not been trained on open source reads the docs and API signature, creates a spec. Another AI processes that spec into working software.
• Is it a real site? Are they accepting real money, or are they just trying to cause a stir around copyright?

Brian #4: Harden your GitHub Actions Workflows with zizmor, dependency pinning, and dependency cooldowns

• Matthias Schoettle
• Avoid things like this: hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far

Extras

Brian:

• GitHub is asking to spy on us, that’s nice

Michael:

• Michael’s new SaaS for podcasters: InterviewCue
• DigitalOcean’s Spaces cold storage for infrequently accessed data
• Minor issue about my fire and forget post, was a latent bug?
• Fire and Forget at Textual follow up article

Joke: Can you?

• Starlette 1.0.0
• Astral to join OpenAI
• uv audit
• Fire and forget (or never) with Python’s asyncio
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters Connect with the hosts
• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Starlette 1.0.0

• As a reminder, Starlette is the foundation for FastAPI
• Starlette 1.0 is here! - fun blog post from Marcello Trylesinski
• “The changes in 1.0 were limited to removing old deprecated code that had been on the way out for years, along with a few bug fixes. From now on we'll follow SemVer strictly.”
• Fun comment in the “What’s next?” section:
  • “Oh, and Sebastián, Starlette is now out of your way to release FastAPI 1.0. 😉”
• Related: Experimenting with Starlette 1.0 with Claude skills
  • Simon Willison
  • example of the new lifespan mechanism, very pytest fixture-like @contextlib.asynccontextmanager async def lifespan(app): async with some_async_resource(): print("Run at startup!") yield print("Run on shutdown!") app = Starlette( routes=routes, lifespan=lifespan )

Michael #2: Astral to join OpenAI

• via John Hagen, thanks
• Astral has agreed to join OpenAI as part of the Codex team
• Congrats Charlie and team
• Seems like **Ruff** and uv play an important roll.
• Perhaps ty holds the most value to directly boost Codex (understanding codebases for the AI)
• All that said, these were open source so there is way more to the motivations than just using the tools.
• After joining the Codex team, we'll continue building our open source tools.
• Simon Willison has thoughts
• discuss.python.org also has thoughts
• The Ars Technica article has interesting comments too
• It’s probably the death pyx
  • Simon points out “pyx is notably absent from both the Astral and OpenAI announcement posts.”

Brian #3: uv audit

• Submitted by Owen Lemont
• Pieces of uv audit have been trickling in. uv 0.10.12 exposes it to the cli help
• Here’s the roadmap for uv audit
• I tried it out on a package and found a security issue with a dependency
  • not of the project, but of the testing dependencies
  • but only if using Python < 3.10, even though I’m using 3.14
• Kinda cool
• Looks like it generates a uv.lock file, which includes dependencies for all project supported versions of Python and systems, which is a very thorough way to check for vulnerabilities.
• But also, maybe some pointers on how to fix the problem would be good. No --fix yet.

Michael #4: Fire and forget (or never) with Python’s asyncio

• Python’s asyncio.create_task() can silently garbage collect your fire-and-forget tasks starting in Python 3.12
• Formerly fine async code can now stop working, so heads up
• The fix? Use a set to upgrade to a strong ref and a callback to remove it
• Is there a chance of task-based memory leaks? Yeah, maybe.

Extras

Brian:

• Nobody Gets Promoted for Simplicity - interesting read and unfortunate truth in too many places.
• pytest-check - All built-in check helper functions in this list also accept an optional xfail reason.
  • example: check.equal(actual, expected, xfail="known issue #123")
  • Allows some checks to still cause a failure to happen because you no longer have to mark the whole test as xfail Michael:
• TurboAPI - FastAPI + Pydantic compatible framework in Zig (see follow up)
• Pyramid 2.1 is out (yes really! :) first release in 3 years)
• Vivaldi 7.9 adds minimalist hide mode.
• Migrated pythonbytes.fm and talkpython.fm to Raw+DC design pattern
• Robyn + Chameleon package

Joke: We now have translation services

• chardet ,AI, and licensing
• refined-github
• pgdog: PostgreSQL connection pooler, load balancer and database sharder
• Agentic Engineering Patterns
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: chardet ,AI, and licensing

• Thanks Ian Lessing
• Wow, where to start?
• A bit of legal precedence research.
• Chardet dispute shows how AI will kill software licensing, argues Bruce Perens on the Register
• Also see this GitHub issue.
• Dan Blanchard, maintainer of a Python character encoding detection library called chardet, released a new version of the library under a new software license. (LGPL → MIT)
• Dan is allowed to make this change because v7 is a complete “clean room” rewrite using AI
• BTW, v7 is WAY better:
  • The result is a 48x increase in detection speed for a project that lives in the hot loops of many projects. That will lead to noticeable performance increases for literally millions of users (the package gets ~130M downloads per month).
  • It paves a path towards inclusion in the standard library (assuming they don’t institute policies against using AI tools).
  • Thread-safe detect() and detect_all() with no measurable overhead; scales on free-threaded Python 3.13t+
• An individual claiming to be Mark Pilgrim, the original creator of the library, opened an issue in the project's GitHub repo arguing that Blanchard had no right to change the software license, citing the LPGL requirement that the license remain unchanged.
• A 'complete rewrite' is irrelevant, since they had ample exposure to the originally licensed code (i.e. this is not a 'clean room' implementation).
• Blanchard disagreed, citing how version 7.0.0 and 6.0.0 compare when subjected to JPlag, a library for detecting plagiarism.
• Blanchard told The Register he had wanted to get chardet added to the Python standard library for more than a decade since it’s a core dependency to most Python projects.

Brian #2: refined-github

• Suggested by Matthias Schöttle
• A browser plugin that improves the GitHub experience
• A sampling
  • Adds a build/CI status icon next to the repo’s name.
  • Adds a link back to the PR that ran the workflow.
  • Enables tab and shift tab for indentation in comment fields.
  • Auto-resizes comment fields to fit their content and no longer show scroll bars.
  • Highlights the most useful comment in issues.
  • Changes the default sort order of issues/PRs to Recently updated.
• But really, it’s a huge list of improvements

Michael #3: pgdog: PostgreSQL connection pooler, load balancer and database sharder

• PgDog is a proxy for scaling PostgreSQL.
• It supports connection pooling, load balancing queries and sharding entire databases.
• Written in Rust, PgDog is fast, secure and can manage thousands of connections on commodity hardware.
• Features
  • PgDog is an application layer load balancer for PostgreSQL
  • Health Checks: PgDog maintains a real-time list of healthy hosts. When a database fails a health check, it's removed from the active rotation and queries are re-routed to other replicas
  • Single Endpoint: PgDog can detect writes (e.g. INSERT, UPDATE, CREATE TABLE, etc.) and send them to the primary, leaving the replicas to serve reads
  • Failover: PgDog monitors Postgres replication state and can automatically redirect writes to a different database if a replica is promoted
  • Sharding: PgDog is able to manage databases with multiple shards

Brian #4: Agentic Engineering Patterns

• Simon Willison
• So much great stuff here, especially
  • Anti-patterns: things to avoid
  • And 3 sections on testing
    • Red/green TDD
    • First run the test
    • Agentic manual testing

Extras

Brian:

• uv python upgrade will upgrade all versions of Python installed with uv to latest patch release
  • suggested by John Hagen
• Coding After Coders: The End of Computer Programming as We Know It
  • NY Times Article
  • Suggested by Christopher
  • Best quote: “Pushing code that fails pytest is unacceptable and embarrassing.”

Michael:

• Talk Python Training users get a better account dashboard
• Package Managers Need to Cool Down
• Will AI Kill Open Source, article + video
• My Always activate the venv is now a zsh-plugin, sorta.

Joke: Ergonomic keyboard

Also pretty good and related:

• Claude Code Mandated

Links

• legal precedence research
• Chardet dispute shows how AI will kill software licensing, argues Bruce Perens
• this GitHub issue
• citing
• JPlag
• refined-github
• Agentic Engineering Patterns
• Anti-patterns: things to avoid
• Red/green TDD
• First run the test
• Agentic manual testing
• uv python upgrade
• Coding After Coders: The End of Computer Programming as We Know It
• Suggested by Christopher
• a better account dashboard
• Package Managers Need to Cool Down
• Will AI Kill Open Source
• Always activate the venv
• now a zsh-plugin
• Ergonomic keyboard
• Claude Code Mandated
• claude-mandated.png
• blobs.pythonbytes.fm/keyboard-joke.jpeg?cache_id=a6026b

• Setting up a Python monorepo with uv workspaces
• cattrs: Flexible Object Serialization and Validation
• Learning to program in the AI age
• VS Code extension for FastAPI and friends
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Setting up a Python monorepo with uv workspaces

• Dennis Traub
• The 3 things
  • Give the Root a Distinct Name
  • Use workspace = true for Inter-Package Deps
  • Use importlib Mode for pytest

Michael #2: cattrs: Flexible Object Serialization and Validation

• cattrs is a Swiss Army knife for (un)structuring and validating data in Python.
• A natural alternative/follow on from DataClass Wizard
• Converts to ←→ from dictionaries
• cattrs also focuses on functional composition and not coupling your data model to its serialization and validation rules.
• When you’re handed unstructured data (by your network, file system, database, …), cattrs helps to convert this data into trustworthy structured data.
• Batteries Included: cattrs comes with pre-configured converters for a number of serialization libraries, including JSON (standard library, orjson, UltraJSON), msgpack, cbor2, bson, PyYAML, tomlkit and msgspec (supports only JSON at this time).

Brian #3: Learning to program in the AI age

• Jose Blanca
• “I teach a couple of introductory Python courses and I've been thinking about which advice to give to my students, that are studying how to program for the first time. I have collected my ideas in these blog posts”
  • Why learning to program is as useful as ever, even with powerful AI tools available.
  • How to use AI as a tutor rather than a shortcut, and why practice remains the key to real understanding.
  • What the real learning objectives are: mental models, managing complexity, and thinking like a software developer.

Michael #4: VS Code extension for FastAPI and friends

• Enhances the FastAPI development experience in Visual Studio Code
• Path Operation Explorer: Provides a hierarchical tree view of all FastAPI routes in your application.
• Search for routes: Use the Command Palette and quickly search for routes by path, method, or name.
• CodeLens links appear above HTTP client calls like client.get('/items'), letting you jump directly to the matching route definition.
• Deploy your application directly to FastAPI Cloud from the status bar with zero config.
• View real-time logs from your FastAPI Cloud deployed applications directly within VS Code.
• Install from Marketplace.

Extras

Brian:

• Guido van Rossum interviews key Python developers from the first 25 years
  • Interview with Brett Cannon
  • Interview with Thomas Wouters Michael:
• IntelliJ IDEA: The Documentary | An origin story video
• Cursor Joined the ACP Registry and Is Now Live in Your JetBrains IDE
• What hyper-personal software looks like
• I’m doing in-person training again (limited scope):
  • On-site, hands-on AI engineering enablement for software teams with Michael

Joke: Saas is dead

• Raw+DC: The ORM pattern of 2026?
• pytest-check releases
• Dataclass Wizard
• SQLiteo - “native macOS SQLite browser built for normal people”
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters Connect with the hosts
• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: Raw+DC: The ORM pattern of 2026?

• ORMs/ODMs provide great support and abstractions for developers
• They are not the native language of agentic AI
• Raw queries are trained 100x+ more than standard ORMs
• Using raw queries at the data access optimizes for AI coding
• Returning some sort of object mapped to the data optimizes for type safety and devs

Brian #2: pytest-check releases

• 3 merged pull requests
• 8 closed issues
• at one point got to 0 PR’s and 1 enhancement request
• Now back to 2 issues and 1 PR, but activity means it’s still alive and being used. so cool
• Check out changelog for all mods
• A lot of changes around supporting mypy
  • I’ve decided to NOT have the examples be fully --strict as I find it reduces readability
    • See tox.ini for explanation
  • But src is --strict clean now, so user tests can be --strict clean.

Michael #3: Dataclass Wizard

• Simple, elegant wizarding tools for Python’s dataclasses.
• Features
  • 🚀 Fast — code-generated loaders and dumpers
  • 🪶 Lightweight — pure Python, minimal dependencies
  • 🧠 Typed — powered by Python type hints
  • 🧙 Flexible — JSON, YAML, TOML, and environment variables
  • 🧪 Reliable — battle-tested with extensive test coverage
• No Inheritance Needed

Brian #4: SQLiteo - “native macOS SQLite browser built for normal people”

• Adam Hill
• This is a fun tool, built by someone I trust.
• That trust part is something I’m thinking about a lot in these days of dev+agent built tools
• Some notes on my thoughts when evaluating
  • I know mac rules around installing .dmg files not from the apple store are picky.
    • And I like that
  • But I’m ok with the override when something comes from a dev I trust
  • The contributors are all Adam
    • I’m still not sure how I feel about letting agents do commits in repos
  • There’s “AGENTS” folder and markdown files in the project for agents, so Ad

Extras

Michael:

• PyTV Python Unplugged This Week
• IBM Crashes 11% in 4 Hours - $24 Billion Wiped Out After Anthropic's Claude Code Threatens the Entire COBOL Consulting Industry
• Loving my 40” ultrawide monitor more every day
• Updatest for updating all the mac things
• Ice has Thawed out (mac menubar app)

Joke: House is read-only!

• Better Python tests with inline-snapshot
• jolt Battery intelligence for your laptop
• Markdown code formatting with ruff
• act - run your GitHub actions locally
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters Connect with the hosts
• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Better Python tests with inline-snapshot

• Alex Hall, on Pydantic blog
• Great for testing complex data structures

• Allows you to write a test like this:

  from inline_snapshot import snapshot def test_user_creation(): user = create_user(id=123, name="test_user") assert user.dict() == snapshot({})

• Then run pytest --inline-snapshot=fix

• And the library updates the test source code to look like this:

  def test_user_creation(): user = create_user(id=123, name="test_user") assert user.dict() == snapshot({ "id": 123, "name": "test_user", "status": "active" })

• Now, when you run the code without “fix” the collected data is used for comparison

• Awesome to be able to visually inspect the test data right there in the test code.
• Projects mentioned
  • inline-snapshot
  • pytest-examples
  • syrupy
  • dirty-equals
  • executing

Michael #2: jolt Battery intelligence for your laptop

• Support for both macOS and Linux
• Battery Status — Charge percentage, time remaining, health, and cycle count
• Power Monitoring — System power draw with CPU/GPU breakdown
• Process Tracking — Processes sorted by energy impact with color-coded severity
• Historical Graphs — Track battery and power trends over time
• Themes — 10+ built-in themes with dark/light auto-detection
• Background Daemon — Collect historical data even when the TUI isn't running
• Process Management — Kill energy-hungry processes directly

Brian #3: Markdown code formatting with ruff

• Suggested by Matthias Schoettle
• ruff can now format code within markdown files
• Will format valid Python code in code blocks marked with python, py, python3 or py3.
• Also recognizes pyi as Python type stub files.
• Includes the ability to turn off formatting with comment <!-- fmt:off --> , <!-- fmt:on --> blocks.
• Requires preview mode [tool.ruff.lint] preview = true

Michael #4: act - run your GitHub actions locally

• Run your GitHub Actions locally! Why would you want to do this? Two reasons:
  • Fast Feedback - Rather than having to commit/push every time you want to test out the changes you are making to your .github/workflows/ files (or for any changes to embedded GitHub actions), you can use act to run the actions locally. The environment variables and filesystem are all configured to match what GitHub provides.
  • Local Task Runner - I love make. However, I also hate repeating myself. With act, you can use the GitHub Actions defined in your .github/workflows/ to replace your Makefile!
• When you run act it reads in your GitHub Actions from .github/workflows/ and determines the set of actions that need to be run.
  • Uses the Docker API to either pull or build the necessary images, as defined in your workflow files and finally determines the execution path based on the dependencies that were defined.
  • Once it has the execution path, it then uses the Docker API to run containers for each action based on the images prepared earlier.
  • The environment variables and filesystem are all configured to match what GitHub provides.

Extras

Michael:

• Winter is coming: Frozendict accepted
• Django ORM stand-alone
• Command Book app announcement post

Joke: Plug ‘n Paste

• Command Book App
• uvx.sh: Install Python tools without uv or Python
• Ending 15 years of subprocess polling
• monty: A minimal, secure Python interpreter written in Rust for use by AI
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters Connect with the hosts
• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: Command Book App

• New app from Michael
• Command Book App is a native macOS app for developers, data scientists, AI enthusiasts and more.
• This is a tool I've been using lately to help build Talk Python, Python Bytes, Talk Python Training, and many more applications.
• It's a bit like advanced terminal commands or complex shell aliases, but hosted outside of your terminal. This leaves the terminal there for interactive commands, exploration, short actions.
• Command Book manages commands like "tail this log while I'm developing the app", "Run the dev web server with true auto-reload", and even "Run MongoDB in Docker with exactly the settings I need"
• I'd love it if you gave it a look, shared it with your team, and send me feedback.
• Has a free version and paid version.
• Build with Swift and Swift UI
• Check it out at https://commandbookapp.com

Brian #2: uvx.sh: Install Python tools without uv or Python

• Tim Hopper

Michael #3: Ending 15 years of subprocess polling

• by Giampaolo Rodola
• The standard library's subprocess module has relied on a busy-loop polling approach since the timeout parameter was added to Popen.wait() in Python 3.3, around 15 years ago
• The problem with busy-polling
  • CPU wake-ups: even with exponential backoff (starting at 0.1ms, capping at 40ms), the system constantly wakes up to check process status, wasting CPU cycles and draining batteries.
  • Latency: there's always a gap between when a process actually terminates and when you detect it.
  • Scalability: monitoring many processes simultaneously magnifies all of the above.
  • + L1/L2 CPU cache invalidations
• It’s interesting to note that waiting via poll() (or kqueue()) puts the process into the exact same sleeping state as a plain time.sleep() call. From the kernel's perspective, both are interruptible sleeps.
• Here is the merged PR for this change.

Brian #4: monty: A minimal, secure Python interpreter written in Rust for use by AI

• Samuel Colvin and others at Pydantic
• Still experimental
• “Monty avoids the cost, latency, complexity and general faff of using a full container based sandbox for running LLM generated code. “
• “Instead, it lets you safely run Python code written by an LLM embedded in your agent, with startup times measured in single digit microseconds not hundreds of milliseconds.”

Extras

Brian:

• Expertise is the art of ignoring - Kevin Renskers
  • You don’t need to master the language. You need to master your slice.
  • Learning everything up front is wasted effort.
  • Experience changes what you pay attention to.
• I hate fish - Rands (Michael Lopp)
  • Really about productivity systems
  • And a nice process for dealing with email

Michael:

• Talk Python now has a CLI
• New essay: It's not vibe coding - Agentic engineering
• GitHub is having a day
• Python 3.14.3 and 3.13.12 are available
• Wall Street just lost $285 billion because of 13 markdown files

Joke: Silence, current side project!

• django-bolt: Faster than FastAPI, but with Django ORM, Django Admin, and Django packages
• pyleak
• More Django (three articles)
• Datastar
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: django-bolt : Faster than FastAPI, but with Django ORM, Django Admin, and Django packages

• Farhan Ali Raza
• High-Performance Fully Typed API Framework for Django
• Inspired by DRF, FastAPI, Litestar, and Robyn
• Django-Bolt docs
• Interview with Farhan on Django Chat Podcast
• And a walkthrough video

Michael #2: pyleak

• Detect leaked asyncio tasks, threads, and event loop blocking with stack trace in Python. Inspired by goleak.
• Has patterns for
  • Context managers
  • decorators
• Checks for
  • Unawaited asyncio tasks
  • Threads
  • Blocking of an asyncio loop
  • Includes a pytest plugin so you can do @pytest.mark.no_leaks

Brian #3: More Django (three articles)

• Migrating From Celery to Django Tasks
  • Paul Taylor
  • Nice intro of how easy it is to get started with Django Tasks
• Some notes on starting to use Django
  • Julia Evans
  • A handful of reasons why Django is a great choice for a web framework
    • less magic than Rails
    • a built-in admin
    • nice ORM
    • automatic migrations
    • nice docs
    • you can use sqlite in production
    • built in email
  • The definitive guide to using Django with SQLite in production
    • I’m gonna have to study this a bit.
    • The conclusion states one of the benefits is “reduced complexity”, but, it still seems like quite a bit to me.

Michael #4: Datastar

• Sent to us by Forrest Lanier

• Lots of work by Chris May

• Out on Talk Python soon.

• Official Datastar Python SDK

• Datastar is a little like HTMX, but

  • The single source of truth is your server

  • Events can be sent from server automatically (using SSE)

    • e.g
    yield SSE.patch_elements( f"""<span id="currentTime">{datetime.now().isoformat()}""" )

• Why I switched from HTMX to Datastar article

Extras

Brian:

• Django Chat: Inverting the Testing Pyramid - Brian Okken
  • Quite a fun interview
• PEP 686 – Make UTF-8 mode default
  • Now with status “Final” and slated for Python 3.15

Michael:

• Prayson Daniel’s Paper tracker
• Ice Cubes (open source Mastodon client for macOS)
• Rumdl for PyCharm, et. al
• cURL Gets Rid of Its Bug Bounty Program Over AI Slop Overrun
• Python Developers Survey 2026

Joke: Pushed to prod

• GreyNoise IP Check
• tprof: a targeting profiler
• TOAD is out
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: GreyNoise IP Check

• GreyNoise watches the internet's background radiation—the constant storm of scanners, bots, and probes hitting every IP address on Earth.
• Is your computer sending out bot or other bad-actor traffic? What about the myriad of devices and IoT things on your local IP?
• Heads up: If your IP has recently changed, it might not be you (false positive).

Brian #2: tprof: a targeting profiler

• Adam Johnson
• Intro blog post: Python: introducing tprof, a targeting profiler

Michael #3: TOAD is out

• Toad is a unified experience for AI in the terminal
• Front-end for AI tools such as OpenHands, Claude Code, Gemini CLI, and many more.
• Better TUI experience (e.g. @ for file context uses fuzzy search and dropdowns)
• Better prompt input (mouse, keyboard, even colored code and markdown blocks)
• Terminal within terminals (for TUI support)

Brian #4: FastAPI adds Contribution Guidelines around AI usage

• Docs commit: Add contribution instructions about LLM generated code and comments and automated tools for PRs
• Docs section: Development - Contributing : Automated Code and AI
• Great inspiration and example of how to deal with this for popular open source projects
  • “If the human effort put in a PR, e.g. writing LLM prompts, is less than the effort we would need to put to review it, please don't submit the PR.”
• With sections on
  • Closing Automated and AI PRs
  • Human Effort Denial of Service
  • Use Tools Wisely

Extras

Brian:

• Apparently Digg is back and there’s a Python Community there
• Why light-weight websites may one day save your life - Marijke LuttekesHome

Michael:

• Blog posts about Talk Python AI Integrations
  • Announcing Talk Python AI Integrations ****on Talk Python’s Blog
  • Blocking AI crawlers might be a bad idea on Michael’s Blog
• Already using the compile flag for faster app startup on the containers:
  • RUN --mount=type=cache,target=/root/.cache uv pip install --compile-bytecode --python /venv/bin/python
  • I think it’s speeding startup by about 1s / container.
• Biggest prompt yet? 72 pages, 11, 000

Joke: A date

• via From Pat Decker

• Better Django management commands with django-click and django-typer
• PSF Lands a $1.5 million sponsorship from Anthropic
• How uv got so fast
• PyView Web Framework
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Better Django management commands with django-click and django-typer

• Lacy Henschel
• Extend Django manage.py commands for your own project, for things like
  • data operations
  • API integrations
  • complex data transformations
  • development and debugging
• Extending is built into Django, but it looks easier, less code, and more fun with either django-click or django-typer, two projects supported through Django Commons

Michael #2: PSF Lands a $1.5 million sponsorship from Anthropic

• Anthropic is partnering with the Python Software Foundation in a landmark funding commitment to support both security initiatives and the PSF's core work.
• The funds will enable new automated tools for proactively reviewing all packages uploaded to PyPI, moving beyond the current reactive-only review process.
• The PSF plans to build a new dataset of known malware for capability analysis
• The investment will sustain programs like the Developer in Residence initiative, community grants, and infrastructure like PyPI.

Brian #3: How uv got so fast

• Andrew Nesbitt
• It’s not just be cause “it’s written in Rust”.
• Recent-ish standards, PEPs 518 (2016), 517 (2017), 621 (2020), and 658 (2022) made many uv design decisions possible
• And uv drops many backwards compatible decisions kept by pip.
• Dropping functionality speeds things up.
  • “Speed comes from elimination. Every code path you don’t have is a code path you don’t wait for.”
• Some of what uv does could be implemented in pip. Some cannot.
• Andrew discusses different speedups, why they could be done in Python also, or why they cannot.
• I read this article out of interest. But it gives me lots of ideas for tools that could be written faster just with Python by making design and support decisions that eliminate whole workflows.

Michael #4: PyView Web Framework

• PyView brings the Phoenix LiveView paradigm to Python
• Recently interviewed Larry on Talk Python
• Build dynamic, real-time web applications using server-rendered HTML
• Check out the examples.
  • See the Maps demo for some real magic
• How does this possibly work? See the LiveView Lifecycle.

Extras

Brian:

• Upgrade Django, has a great discussion of how to upgrade version by version and why you might want to do that instead of just jumping ahead to the latest version. And also who might want to save time by leapfrogging
  • Also has all the versions and dates of release and end of support.
• The Lean TDD book 1st draft is done.
  • Now available through both pythontest and LeanPub
    • I set it as 80% done because of future drafts planned.
  • I’m working through a few submitted suggestions. Not much feedback, so the 2nd pass might be fast and mostly my own modifications. It’s possible.
  • I’m re-reading it myself and already am disappointed with page 1 of the introduction. I gotta make it pop more. I’ll work on that.
  • Trying to decide how many suggestions around using AI I should include.
    • It’s not mentioned in the book yet, but I think I need to incorporate some discussion around it.

Michael:

• Python: What’s Coming in 2026
• Python Bytes rewritten in Quart + async (very similar to Talk Python’s journey)
• Added a proper MCP server at Talk Python To Me (you don’t need a formal MCP framework btw)
  • Example one: latest-episodes-mcp.png
  • Example two: which-episodes-mcp.webp
• Implmented /llms.txt for Talk Python To Me (see talkpython.fm/llms.txt )

Joke: Reverse Superman

• port-killer
• How we made Python's packaging library 3x faster
• CodSpeed
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters

Connect with the hosts

• Michael: @[email protected] / @mkennedy.codes (bsky)
• Brian: @[email protected] / @brianokken.bsky.social
• Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: port-killer

• A powerful cross-platform port management tool for developers.
• Monitor ports, manage Kubernetes port forwards, integrate Cloudflare Tunnels, and kill processes with one click.
• Features:
  • 🔍 Auto-discovers all listening TCP ports
  • ⚡ One-click process termination (graceful + force kill)
  • 🔄 Auto-refresh with configurable interval
  • 🔎 Search and filter by port number or process name
  • ⭐ Favorites for quick access to important ports
  • 👁️ Watched ports with notifications
  • 📂 Smart categorization (Web Server, Database, Development, System)

Brian #2: How we made Python's packaging library 3x faster

• Henry Schreiner
• Some very cool graphs demonstrating some benchmark data.
• And then details about how various speedups
  • each being 2-37% faster
  • the total adding up to about 3x speedup, or shaving 2/3 of the time.
• These also include nice write-ups about why the speedups were chosen.
• If you are trying to speed up part of your system, this would be good article to check out.

Michael #3: AI’s Impact on dev companies

• On TailwindCSS: via Simon
  • Tailwind is growing faster than ever and is bigger than it has ever been
  • Its revenue is down close to 80%.
  • 75% of the people on our engineering team lost their jobs here yesterday because of the brutal impact AI has had on our business.
  • “We had 6 months left”
  • Listen to the founder: “A Morning Walk”
  • Super insightful video: Tailwind is in DEEP trouble
• On Stack Overflow: See video.
  • SO was founded around 2009, first month had 3,749 questions
  • December, SO had 3,862 questions asked
  • Most of its live it had 200,000 questions per month
  • That is a 53x drop!

Brian #4: CodSpeed

• “CodSpeed integrates into dev and CI workflows to measure performance, detect regressions, and enable actionable optimizations.”
• Noticed it while looking through the GitHub workflows for FastAPI
• Free for small teams and open-source projects
• Easy to integrate with Python by marking tests with @pytest.mark.benchmark
• They’ve releases a GitHub action to incorporate benchmarking in CI workflows

Extras

Brian:

• Part 2 of Lean TDD released this morning, “Lean TDD Practices”, which has 9 mini chapters.

Michael:

• Our Docker build just broke because of the supply chain techniques from last week (that’s a good thing!). Not a real issue, but really did catch an open CVE.
• Long passwords are bad now? ;)

Joke: Check out my app!