Python Bytes

Topics covered in this episode:

Dumb Ways for an Open Source Project to Die

How to create a pylock.toml lockfile

https://github.com/facebook/Lifeguard

Choosing a Python Logging Library in 2026

Extras

Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

Our courses at Talk Python Training

The Complete pytest Course

Patreon Supporters

Connect with the hosts

Michael: @[email protected] / @mkennedy.codes (bsky)

Brian: @[email protected] / @brianokken.bsky.social

Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: Dumb Ways for an Open Source Project to Die

Core categories

The maintainer left

The maintainer is still there

Sabotage and capture

The release pipeline broke

Force majeure

The world moved on

The project split

-

Examples

Bulma PRs still from 2023, issues and PRs with no maintainer response for years, last release 1.5 years ago

diskcache Similar, got hired by OpenAI, crickets after that

Brian #2: How to create a pylock.toml lockfile

Tim Hopper

Tim walks through using uv, pip and pdm to create pylock.toml files.

Recommendation: use uv export --format pylock.toml -o pylock.toml

He also has How to install from a pylock.toml lockfile with pip but the short version is:

use -r because tools treat it like a requirements file

Michael #3: https://github.com/facebook/Lifeguard

Lifeguard is a static analyzer to detect Lazy Imports incompatibilities and ease the adoption overhead for Lazy Imports in Python.

I’m more excited about lazy imports after my Cutting Python Web App Memory Over 31% experience

Some Python patterns depend on imports executing immediately. For example:

Module-level side effects — a module that registers a handler or modifies global state at import time will behave differently if that import is deferred.

The registry pattern — a module that registers itself (e.g., adding to a global dict) when imported will silently fail to register under Lazy Imports.

sys.modules manipulation — code that reads or writes sys.modules assumes prior imports have already executed.

Metaclasses and __init_subclass__ — class creation side effects may depend on imports being resolved.

Project Stage: Beta Lifeguard is in active development. We are aiming to be ready for general use by the Python 3.15 final release.

Brian #4: Choosing a Python Logging Library in 2026

Ayooluwa Isaiah

" which libraries matter, how they compare, where they overlap with the standard module, and when each one makes sense.”

The slant with this article is the need to log json output, which seems reasonable as things like API entry and exit point logging will include json.

Covered libraries

standard library logging with a hat tip to python-json-logger

Same site has a guide to setting up python-json-logger

structlog

Loguru

Logbook

picologging

Some benchmarks with structlog, stdlib+json, and Loguru, with structlog coming out faster

I liked the Loguru example

I’m going to have to try @logger.catch and logger.exception() for easily logging exceptions and serialize=True to enable JSON output.

Extras

Brian:

When Women Stopped Coding - Planet Money segment , spotted on BlueSky from Savannah Ostrowski

Lean TDD is now leaner

Still working on audio version, but some great changes in 0.7.1 version

Ch 6, TDD Interpretations, move ATDD and some of BDD to chapter

Ch 7, Change name to TDD with Teams: BDD and ATDD

Ch 9, Lean TDD, streamline steps and chapter

Ch 10, Change name to Lean TDD with Teams: Lean ATDD

Ch 11, Lean TDD with AI, Add short discussion about guardrails and security

Michael:

New course: Python Web Security: OWASP Top 10 with Agentic AI

All courses now with Spanish subtitles, see announcement

Joke: Stop texting me

Topics covered in this episode:

Using Django Tasks in production

Co-authored with Claude?

PyPI packages are increasing rapidly

httpx2

Extras

Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

Our courses at Talk Python Training

The Complete pytest Course

Patreon Supporters
Connect with the hosts

Michael: @[email protected] / @mkennedy.codes (bsky)

Brian: @[email protected] / @brianokken.bsky.social

Show: @[email protected] / @pythonbytes.fm (bsky)
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Using Django Tasks in production

Tim Schilling shares how the Djangonaut Space website has been using Django’s new tasks framework and some of the info missing from the official Django docs.

Tasks require a third party package, django-tasks-db to actually run the tasks.

Article walks through all changes necessary to get an email process running to notify admins of new testimonials. Cool simple example.

With the db backend, you can monitor progress of tasks in the admin, to see which tasks are scheduled, completed, or have errors.

Some wishes for the community to implement

new tutorial in the Django docs

Django Debug toolbar panel for tasks

test/mock backend

Great title for wish list: Thinks I’d like to see, but I’m too lazy to implement myself.

Michael #2: Co-authored with Claude?

Via Nik T.

We don’t put “executed on macOS”, “edited with PyCharm”, etc. in our commits. Why Claude?

Seems like a growth hack to me, that I don’t really care to participate in.

Some projects that have formalized their thoughts on this: The Generative AI Policy Landscape in Open Source

Adjust to turn off in ~/.claude/settings.json see the docs.

{
"attribution": {
"commit": "",
"pr": ""
}
}

Brian #3: PyPI packages are increasing rapidly

Artem Golubin

There’s been an increase of published packages per week on PyPI

A pretty big increase in the last handful of months.

30% increase since 2025, clearly due to AI

Artem is building hexora, a malicious Python code detector.

Cool package too, it can:

Audit project dependencies to catch potential supply-chain attacks

Detect malicious scripts found on platforms like Pastebin, GitHub, or open directories

Analyze IoC files from past security incidents

Audit new packages uploaded to PyPi.

Artem is using hexora to analyze recently published pypi packages and many are obviously vibecoded and trigger false positives for abuses of eval, exec, and subprocess

Side note: I don’t think that’s necessarily a false positive. Not malicious, but maybe a stupid-code-detector?

Lots are LLM related, Lots have bots contributing code

Publishing rate is crazy, dozens to hundreds of published versions in a day is a bug, not a feature

Brian’s proposal, PyPI should limit releases per day for any package to something a sane human would do, even if they make a mistake on a release, to maybe like 2-3, definitely under 10, in a day. And if the repo has obvious agent contributors listed, maybe lower to the limit to 1-2 a day? Honestly, “move fast and break things” doesn’t apply to breaking the commons.

Michael #4: httpx2

More on the httpx, httpxyz, etc changes: Pydantic people started their own fork, httpx2.

Michiel says “while we think httpxyz was definitely needed, we welcome httpx2 and think it should be the ‘blessed’ fork.”

Kludex, who is among other things maintainer of Starlette, was considering a fork

As it stands, httpx2 is lacking the performance improvements they added to httpxyz. But it will not be long before they will add those, too.

Also they already made some smart decisions:

they are switching from certifi to truststore

they are switching to compression.zstd on Python 3.14+, enabling zstd compression by default

they merged httpcore and vendored it in their repository

Discussion on Hacker News

Extras

Brian:

The Four Horsemen of the LLM Apocalypse - Anarcat

Django/JetBrains 2026 developer survey is open

Pyrefly 1.0 : “meaning we are confident that Pyrefly is ready for production use.”
Michael:

Just about ready to release Python Web Security: OWASP Top 10 with Agentic AI course. Be sure to be on the courses newsletter to get notified.

Joke: Proud Parents

Topics covered in this episode:

httpxyz one month in

Learn concurrency - a deep dive into multithreading with Python

pip 26.1 - lockfiles and dependency cooldowns

Python 3.15 sentinal values from PEP 661

Extras

Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

Our courses at Talk Python Training

The Complete pytest Course

Patreon Supporters

Connect with the hosts

Michael: @[email protected] / @mkennedy.codes (bsky)

Brian: @[email protected] / @brianokken.bsky.social

Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: httpxyz one month in

First version of httpxyz contained just the fixes to get zstd working, and the fixes to get the test suite running on python 3.14, some ‘housekeeping’ changes related to the renaming

End of March: a compatibility shim that allows you to use httpxyz even with third-party packages that import httpx themselves, as long as you import httpxyz first.

Importing httpxyz automatically registers it under the httpx name in sys.modules , see https://httpxyz.org/httpx-compatibility/

Fixed a WHOLE bunch of performance related issues by forking httpcore

Brian #2: Learn concurrency - a deep dive into multithreading with Python

Nikos Vaggalis

“Whenever you are trying to speed up code using multiple cores, always ask yourself: “Do these threads need to talk to each other right now?” If the answer is yes, it will be slow. The best parallel code splits a big job into completely isolated chunks, processes them separately, and merges the results at the finish line.”

Good overview of thread concurrency with Python and how that’s been improved dramatically with free-threaded Python

Defines lots of terms you come across, including “embarrassingly parallel multithreading”

There’s a counter example that’s nice

Start with a shared resource, a counter, and multiple threads updating it

Attempt to fix with threading.Lock(), which fixes it, but slows things down

Good explanation of why

Proper fix with concurrent.futures and separating the work of different threads so that they can be independent and their results can be combined when they’re all finished.

Michael #3: pip 26.1 - lockfiles and dependency cooldowns

Python 3.9 is no longer supported

Experimental: installing from pylock files

Dependency cooldowns (see my post about this)

Lifting several 2020 resolver limitations

Brian #4: Python 3.15 sentinal values from PEP 661

MISSING = sentinel("MISSING")
def next_value(default: int | MISSING = MISSING):
...
if default is MISSING:
...

Take a name str as a constructor parameter

Intended to be compared with is operator, similar to None

Sentinal objects can be used as a type, also similar to None

and can be combined with other types with |.

Unlike None, sentinal values are truthy. (Elipses ... are also truthy)

This seems like a strange choice. but I guess it must have made sense to someone.

It does force you to use is instead of depending on False-ness, so I guess it’ll make code using sentinels more readable.

Interesting that the PEP was started in 2021, and we’re finally getting it this year.

Extras

Brian:

Before GitHub - Armin Ronacher

tenacity - cross-platform multi-track audio editor/recorder

learned about it from Armin’s article

Joke:

Joke option Make it myself

Seems similar to what people think about software now

Links

httpxyz one month in

httpxyz.org/httpx-compatibility

Learn concurrency - a deep dive into multithreading with Python

pip 26.1 - lockfiles and dependency cooldowns

my post about this

Python 3.15 sentinal values from PEP 661

Before GitHub

tenacity

Make it myself

Topics covered in this episode:

profiling-explorer

Reverting the incremental GC in Python 3.14 and 3.15

VSCode AI Co-author defaults to on, then off

django freeze

Extras

Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

Our courses at Talk Python Training

The Complete pytest Course

Patreon Supporters

Connect with the hosts

Michael: @[email protected] / @mkennedy.codes (bsky)

Brian: @[email protected] / @brianokken.bsky.social

Show: @[email protected] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: profiling-explorer

Adam Johnson

And intro post Python: introducing profiling-explorer

“profiling-explorer is a tool for exploring profiling data from Python’s built-in profilers, which are stored in pstats files. ”

Features

Dark mode

Click the calls, internal ms, or cumulative ms column headers to sort by that column.

Use the search box to filter by filename or function name.

Hover by a filename + line number pair to reveal the copy button, which copies the location to your clipboard for faster opening.

Click the callers or callees links on the right of a row (not pictured above) to see the callers or callees of that function.

Michael #2: Reverting the incremental GC in Python 3.14 and 3.15

Python 3.14 shipped with a new incremental garbage collector, but production reports of severe memory pressure (Neil Schemenauer measured up to 5× peak RSS on pathological cyclic workloads) have pushed the core team and Steering Council to revert it in both 3.14 and 3.15 - returning to the 3.13-era generational GC.

This is the second time the inc GC has been pulled back: it was also reverted right before 3.13.0 final, and it shipped in 3.14 without going through the PEP process.

The tradeoff is real: Neil's benchmarks showed max GC pause times of 1.3ms with inc GC versus 26ms with the generational one - great for latency-sensitive apps, terrible for memory-constrained ones.

Release manager Hugo van Kemenade will ship 3.14.5 early with the revert, and Gregory Smith floated the idea of a 3.14.5rc1 - the first patch-release RC since 3.9.2 back in 2021.

Tim Peters spent the thread doing live forensics on Windows, running a toy deque program that should cap at 1GB and watching it balloon to 15.6GB on a 16GB machine - and discovered the gen0 collector effectively never fires under the new scheme.

Tim's bigger meta-point: CPython has a chronic shortage of real-world GC benchmarks, pyperformance has "basically no interesting" cyclic workloads, and users almost never share real data - so core devs keep flying blind on changes like this.

Django maintainer Adam Johnson published a blog post mid-thread documenting a real memory "leak" in Django's migration system caused by inc GC, with a manual gc.collect() workaround - the listener-facing receipt that this wasn't just theoretical.

If the inc GC comes back for 3.16, it'll go through a proper PEP, and the discussion is already shifting toward keeping both collectors available via a startup flag - which Neil and Sergey Miryanov have both prototyped.

Brian #3: VSCode AI Co-author defaults to on, then off

VSCode merges Enabling ai co author by default - 3 week ago

Ton’s of “why would you do this” and related comments

VSCode merges Change default for git.addAICoAuthor to off - yesterday

Take-away, don’t rely on default, set addAICoAuthor to off yourself

Michael #4: django freeze

Convert your dynamic django site to a static one with one line of code.

Just run python manage.py generate_static_site :)

Features

Generate the static version of your Django site, optionally compressed .zip file

Generate/download the static site using urls (only superuser and staff)

Follow sitemap.xml urls

Follow internal links founded in each page

Follow redirects

Report invalid/broken urls

Selectively include/exclude media and static files

Custom base url (very useful if the static site will run in a specific folder different by the document-root)

Convert urls to relative urls (very useful if the static site will run offline or in an unknown folder different by the document-root)

Prevent local directory index

Extras

Brian:

Thinking Less, Trusting More: GenAI’s Impacts on Students’ Cognitive Habits

Michael:

Vercel breached, employee to blame

Introducing the new Talk Python web player

GitHub uptime (a couple of views 1, 2)

Joke: Friends in tech

Topics covered in this episode:

Django Modern Rest

Already playing with Python 3.15

Cutting Python Web App Memory Over 31%

tryke - A Rust-based Ptyhon test runner with a Jest-style API

Extras

Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

Our courses at Talk Python Training

The Complete pytest Course

Patreon Supporters
Connect with the hosts

Michael: @[email protected] / @mkennedy.codes (bsky)

Brian: @[email protected] / @brianokken.bsky.social

Show: @[email protected] / @pythonbytes.fm (bsky)
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: Django Modern Rest

Modern REST framework for Django with types and async support

Supports Pydantic, Attrs, and msgspec

Has ai coding support with llms.txt

See an example at the “showcase” section

Brian #2: Already playing with Python 3.15

3.15.0a8, 2.14.4 and 3.13.13 are out

Hugo von Kemenade

beta comes in May, CRs in Sept, and Final planned for October

But still, there’s awesome stuff here already, here’s what I’m looking forward to:

PEP 810: Explicit lazy imports

PEP 814: frozendict built-in type

PEP 798: Unpacking in comprehensions with * and **

PEP 686: Python now uses UTF-8 as the default encoding

Michael #3: Cutting Python Web App Memory Over 31%

I cut 3.2 GB of memory usage from our Python web apps using five techniques:

async workers

import isolation

the Raw+DC database pattern

local imports for heavy libraries

disk-based caching

See the full article for details.

Brian #4: tryke - A Rust-based Ptyhon test runner with a Jest-style API

Justin Chapman

Watch mode, Native async support, Fast test discovery, In-source testing, Support for doctests, Client/server mode for fast editor integrations, Pretty, per-assertion diagnostics, Filtering and marks, Changed mode (like pytest-picked), Concurrent tests, Soft assertions,

JSON, JUnit, Dot, and LLM reporters

Honestly haven’t tried it yet, but you know, I’m kinda a fan of thinking outside the box with testing strategies so I welcome new ideas.

Extras

Brian:

Why are’t we uv yet?

Interesting take on the “agents prefer pip”

Problem with analysis.

Many projects are libraries and don’t publish uv.lock file

Even with uv, it still often seen as a developer preference for non-libarries. You can sitll use uv with requirements.txt

PyCon US 2026 talks schedule is up

Interesting that there’s an AI track now. I won’t be attending, but I might have a bot watch the videos and summarize for me. :)

What has technology done to us?

Justin Jackson

Lean TDD new cover

Also, 0.6.1 is so ready for me to start f-ing reading the audio book and get on with this shipping the actual f-ing book and yes I realize I seem like I’m old because I use “f-ing” while typing.
Michael:

Python 3.14.4 is out

Beanie 2.1 release

Joke: HumanDB - Blazingly slow. Emotionally consistent.