See https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/ . This is another security update that addresses the compromised eMudhra intermediate Certificate Authority keys.

Link to blog: https://devblogs.microsoft.com/python/announcing-tsp/

TLDR:

Pylance (Microsoft's Python extension for VS Code) now officially supports using Meta's Pyrefly to power its analysis.

To enable this, Microsoft developed an extension to the language server protocol (LSP) called the type server protocol (TSP), a new standard that separates wider set of language server features from the type checker/compiler powering some of them.

Weekly Thread: Project Ideas 💡

Welcome to our weekly Project Ideas thread! Whether you're a newbie looking for a first project or an expert seeking a new challenge, this is the place for you.

How it Works:

1. Suggest a Project: Comment your project idea—be it beginner-friendly or advanced.
2. Build & Share: If you complete a project, reply to the original comment, share your experience, and attach your source code.
3. Explore: Looking for ideas? Check out Al Sweigart's "The Big Book of Small Python Projects" for inspiration.

Guidelines:

• Clearly state the difficulty level.
• Provide a brief description and, if possible, outline the tech stack.
• Feel free to link to tutorials or resources that might help.

Example Submissions:

Project Idea: Chatbot

Difficulty: Intermediate

Tech Stack: Python, NLP, Flask/FastAPI/Litestar

Description: Create a chatbot that can answer FAQs for a website.

Resources: Building a Chatbot with Python

Project Idea: Weather Dashboard

Difficulty: Beginner

Tech Stack: HTML, CSS, JavaScript, API

Description: Build a dashboard that displays real-time weather information using a weather API.

Resources: Weather API Tutorial

Project Idea: File Organizer

Difficulty: Beginner

Tech Stack: Python, File I/O

Description: Create a script that organizes files in a directory into sub-folders based on file type.

Resources: Automate the Boring Stuff: Organizing Files

Let's help each other grow. Happy coding! 🌟

hello!

I am a data science student, have been coding 2 years.

I recently use AI to code python, or checking codes people already made or teacher gives us assingment.

but is it really helpful to learn how to code do you think?

i check every single code if i got assingment by asking AI to explain that.

it doesnt feel i study something so i worry about that i really study.

can you guys give me some tips ?

1. Is bytecode platform-specific, and why?
2. What does bytecode look like?
3. What is the difference between a C++ executable file produced after compilation and what a Python VM produces?
4. What does the Python VM actually produce? Is it a binary, CPU instructions, or something else?
5. What is the difference between a binary, an executable, and a CPU instruction? Explain from the basics in detail with specific examples.

https://youtu.be/vxE3XbcLCa8

LiteLLM published its root-cause report on Oct 23. According to LiteLLM, a master key for its Agent Platform was committed publicly on May 27. The team found the leak and rewrote the commit, but the key wasn’t revoked.

LiteLLM says the attacker used that key on Oct 10 to get a GitHub org owner’s token, then took two maintainers’ tokens. Branch protections were disabled. The release was built from a lookalike repo, Berri-AI instead of BerriAI. Malicious 1.107.0 went out on PyPI and container images on Oct 21.

Separately, JFrog, Microsoft and Socket confirm the malware and some earlier malicious workflows. The full chain from the leaked key to the release rests on LiteLLM’s own account.

The "HTTP2Shell" vulnerability affects servers that know how to speak Google's 'brotli' compression protocol, which would likely make its way into your server through an innoccuous-sounding speedup dep like urllib3[brotli] or aiohttp[speedups], and could be used by basically any server, including Flask, Quart, Starlette, FastAPI, etc. It was downloaded 4,200,000 times from PyPI yesterday alone, to give you a sense of the scale.

To find out if you're affected, run a command like on of these...

pip list    | grep -i brotli

uv tree     | grep -i brotli

poetry show | grep -i brotli

...etc., looking for brotli <= 1.2.0 and/or brotlicffi <= 1.2.0.2. If you're affected, obviously update & redeploy immediately.

Beyond that... well, the (colloquial) name kinda says it all. Given the new Cyber normal, I would assume that you have malicious software running on that system and any connected to it until proven otherwise. Check for bitcoin miners, worms, sentient bot swarms -- the usual.

(Note for beginners: this doesn't apply to stuff you run locally, but rather to servers that have been exposed to the public internet. Still worth checking!)

I wasn't gonna post this b/c I'm so not an expert, but it hasn't hit this sub yet and feels particularly bad... not many solo/SMB devs are self-hosting PHP servers, but anyone who's searched "python server compression algo speedup packages" and picked one of the top choices (or let their agent do so) is at huge risk here. I only know about it because of doomscrolling HackerNews, which feels unreliable!

Does anyone kn*w a good way to to get notified proactively for Python-relevant CVEs and other incidents?

Weekly Thread: Resource Request and Sharing 📚

Stumbled upon a useful Python resource? Or are you looking for a guide on a specific topic? Welcome to the Resource Request and Sharing thread!

How it Works:

1. Request: Can't find a resource on a particular topic? Ask here!
2. Share: Found something useful? Share it with the community.
3. Review: Give or get opinions on Python resources you've used.

Guidelines:

• Please include the type of resource (e.g., book, video, article) and the topic.
• Always be respectful when reviewing someone else's shared resource.

Example Shares:

1. Book: "Fluent Python" - Great for understanding Pythonic idioms.
2. Video: Python Data Structures - Excellent overview of Python's built-in data structures.
3. Article: Understanding Python Decorators - A deep dive into decorators.

Example Requests:

1. Looking for: Video tutorials on web scraping with Python.
2. Need: Book recommendations for Python machine learning.

Share the knowledge, enrich the community. Happy learning! 🌟

I wrote this up. How to check safely and what to rotate
Short version: if you installed an unpinned litellm between 11:39 and 13:23 UTC on October 21, or pulled the latest, main-latest, main-stable or v1.107.0 Docker tags between 11:46 and 14:20 UTC, treat the machine as compromised. Don't start with pip, because the cook.pth and sitecustomize.py files run on every interpreter start. Search the filesystem first, rebuild with litellm==1.106.2, and rotate keys. All of it comes from LiteLLM's own incident report.

Weekly Thread: Meta Discussions and Free Talk Friday 🎙️

Welcome to Free Talk Friday on /r/Python! This is the place to discuss the r/Python community (meta discussions), Python news, projects, or anything else Python-related!

How it Works:

1. Open Mic: Share your thoughts, questions, or anything you'd like related to Python or the community.
2. Community Pulse: Discuss what you feel is working well or what could be improved in the /r/python community.
3. News & Updates: Keep up-to-date with the latest in Python and share any news you find interesting.

Guidelines:

• All topics should be related to Python or the /r/python community.
• Be respectful and follow Reddit's Code of Conduct.

Example Topics:

1. New Python Release: What do you think about the new features in Python 3.11?
2. Community Events: Any Python meetups or webinars coming up?
3. Learning Resources: Found a great Python tutorial? Share it here!
4. Job Market: How has Python impacted your career?
5. Hot Takes: Got a controversial Python opinion? Let's hear it!
6. Community Ideas: Something you'd like to see us do? tell us.

Let's keep the conversation going. Happy discussing! 🌟

Don't you think companies or developers that manage python libraries should be given extra time before a new version release to make things compatible and fix new bugs?

Like a month or two where they get full info about new features but before the version is publicly available to download?

It would make things easier on the consumer end. What do you think?

the payloads run on every python start on the machine and not just when you import litellm. Your IDE, pip, CI jobs everything python on that host is affected.

It steals ssh keys, aws credentials, browser passwords, shell history and AI coding tool configs. The backdoor runs as a daemon and executes whatever code the attacker’s server returns every hour.

Pin to 1.106.2.

complete breakdown: safedep.io/litellm-pypi-compromise-credential-stealer-backdoor

Weekly Thread: Professional Use, Jobs, and Education 🏢

Welcome to this week's discussion on Python in the professional world! This is your spot to talk about job hunting, career growth, and educational resources in Python. Please note, this thread is not for recruitment.

How it Works:

1. Career Talk: Discuss using Python in your job, or the job market for Python roles.
2. Education Q&A: Ask or answer questions about Python courses, certifications, and educational resources.
3. Workplace Chat: Share your experiences, challenges, or success stories about using Python professionally.

Guidelines:

• This thread is not for recruitment. For job postings, please see r/PythonJobs or the recruitment thread in the sidebar.
• Keep discussions relevant to Python in the professional and educational context.

Example Topics:

1. Career Paths: What kinds of roles are out there for Python developers?
2. Certifications: Are Python certifications worth it?
3. Course Recommendations: Any good advanced Python courses to recommend?
4. Workplace Tools: What Python libraries are indispensable in your professional work?
5. Interview Tips: What types of Python questions are commonly asked in interviews?

Let's help each other grow in our careers and education. Happy discussing! 🌟

I tried to start using 3.15, but a lot of libraries don't have packages that support it yet.

In your own experience, what's a good amount of time to wait where most of the libraries support the new version? 1 month, 3 months, 6 months?

Some context first: I'm one person building an open-source research tool, and most of the code is written by AI coding agents (Claude Code and Codex) running in parallel. They write code quickly. What slowed everything down was the test suite: on one recent change the merge check selected 406 test files and took just over four hours, and the agents sat idle the whole time.

So I pulled together every timing the suite had already recorded (old JUnit XML and --durations output) and summed it per test. That covers about 9,000 test IDs seen across past runs, around 6,800 of which still exist.

243 of them, under 3%, took 77% of the summed time. Most of those build a whole workspace and run an end-to-end day of the app. Also, not a single test qualified as "small" in the Google sense (no disk, no network), because one autouse fixture asks for tmp_path on every test.

So I'm moving to Google's small/medium/large split (the 2010 Testing Blog post). Merge checks will run small and medium only, and the large ones go to release candidates and a nightly run. After that I want per-size timeouts with pytest-timeout, so a "medium" test that slowly grows into a large one fails instead of quietly eating everyone's time.

Two mistakes I made along the way:

The first labelling pass went by names. Anything with "golden" or "first_use" in it got marked large. When someone actually read the bodies, 28 of the 54 groups were fast in-memory checks. They'd have dropped out of merge runs entirely. Label by fixtures and what the test does, not the name.

The other one was worse. I select tests for a merge by following imports from the changed files. My script followed imports through the package but never through shared test helpers or conftest. For one change to a common helper it selected 6 test files; a selector that follows those edges selected 405. I'd been running a fast gate that was mostly blind to helper changes.

Next I'm trying pytest-testmon for coverage-based selection, running it next to the import-based one on real diffs before I trust it on its own.

Curious how others handle this. Do you split by size, or just throw more CI machines at it?

Is this company (Anaconda) doing well, would you work there?

Have you heard anything positive or negative about working there?

Thanks.

A security incident affecting eMudhra intermediate certificates has required removing the emSign root CA certificate from CA bundles such as “certifi”. It’s important to immediately upgrade the software packages below to at least the versions specified and rebuild container images to fetch the latest system certificates. Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org and pypi.org .

• certifi 2026.10.19 (1)
• pip 26.2.2
• uv 0.13.4
• sigstore 4.5.1

(1): Advisory mentions 2026.10.18, but 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.

For all existing virtual environments on your system, please upgrade pip and uv to the latest versions.

Please read the full post on discuss.python.org for up-to-date information: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

We've been working on PEP 723 inline metadata support for ty both on the command line (ty check) and in the IDE (code navigation, autocompletion, etc) for a while now; we're finally at a stage where we're ready for more people to try it out and let us know what works and what doesn't.

This required integrating ty with uv, which also let us ship a new uv check command that uses ty to check your entire project or workspace (similar to how uv format uses Ruff). All of the above is powered by a brand new uv workspace metadata command that carries the required information between the tools.

More details in the blog post, including how to try these.

All of the above is currently opt-in, experimental, and subject to change at any time 😄 But if you're willing to give it a try, I'd be curious how it went.

My boss is thinking about using python in a secure VPN environment. Because of this, we have to validate the hash of the python download and any libraries used.

I looked on the site but didn't see anything. Is there somewhere we can find the hash value so we can validate the download vs the hash code?

Hi r/python 👋

Another year, another version of Python, and yet more features to guess which version of Python they belong to 😵‍💫

I've updated my "one page" Summary of Major Changes Between Python Versions for Python 3.15 and hope that it continues to be a useful resource for the community 😊

This summary is human typed/copied from the official release notes.

Correct me if I am wrong but a normal thing to do is import a module and possibly create new attributes on an object instantiated from such. For some reason PyCharm recognizes this as a warning. I normally like the JetBrains IDEs because when you get rid of all the static analysis warnings you know you are kosher, to some degree. I can't get rid of this warning. Load up the same code in VS Code and it's no problem.

Hi,

A senior dev left left my team and with them left a lot of the code standards. Previously code review was painful and took hours and sometimes it would require a rewrite. However, that was the best code I have probably ever written. I genuinely enjoyed learning coding principles from someone who had been doing it for 20+ years and had reasons behind their principles. Its hard to find discipline these days.

Are there any projects that come to mind that have abrasive or strict longstanding maintainers? My preferred languages are Python and Go but I'd be willing to learn something new.

https://pyfound.blogspot.com/2026/10/announcing-python-software-foundation.html

The PSF is pleased to announce its third batch of PSF Fellows for 2026. Let us welcome the new PSF Fellows for Q3! The following people continue to do amazing things for the Python community:

• Aldo Caneo
• Donghee Na
• Paul Moore
• Takayuki Shimizukawa

Thank you for your continued contributions. We have added you to our Fellows Roster.