#446: State of Python 2025
About the show
Sponsored by us! Support our work through:
Connect with the hosts
- Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky)
- Brian: @brianokken@fosstodon.org / @brianokken.bsky.social
- Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky)
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Brian #1: pypistats.org was down, is now back, and there’s a CLI
pypistats.org is a cool site to check the download stats for Python packages.
It was down for a while, like 3 weeks?
A couple days ago, Hugo van Kemenade announced that it was back up.
With some changes in stewardship
“pypistats.org is back online! 🚀📈
Thanks to @jezdez for suggesting the @ThePSF takes stewardship and connecting the right people, to @EWDurbin for migrating, and of course to Christopher Flynn for creating and running it for all these years!”
Hugo has a CLI version, pypistats
- You can give it a command for what you want to search for
- recent,overall, python_major, python_minor, system
- Then either a package name, a directory path, or if nothing, it will grab the current directory package via pyproject.toml or setup.cfg
- very cool
- You can give it a command for what you want to search for
Michael #2: State of Python 2025
- Michael’s Themes
- Python people use Python: 86% of respondents use Python as their main language
- We are mostly brand-new programmers: Exactly 50% of respondents have less than two years of professional coding experience
- Data science is now over half of all Python
- Most still use older Python versions despite benefits of newer releases: Compelling math to make the change.
- Python web devs resurgence
- Forward-looking trends
- Agentic AI will be wild
- Async, await, and threading are becoming core to Python
- Python GUIs and mobile are rising
- Actionable ideas
- Action 1: Learn uv
- Action 2: Use the latest Python
- Action 3: Learn agentic AI
- Action 4: Learn to read basic Rust
- Action 5: Invest in understanding threading
- Action 6: Remember the newbies
Brian #3: wrapt: A Python module for decorators, wrappers and monkey patching.
“The aim of the wrapt module is to provide a transparent object proxy for Python, which can be used as the basis for the construction of function wrappers and decorator functions.
An easy to use decorator factory is provided to make it simple to create your own decorators that will behave correctly in any situation they may be used.”
Why not just use
functools.wraps()
?- “The wrapt module focuses very much on correctness. It therefore goes way beyond existing mechanisms such as
functools.wraps()
to ensure that decorators preserve introspectability, signatures, type checking abilities etc. The decorators that can be constructed using this module will work in far more scenarios than typical decorators and provide more predictable and consistent behaviour.”
- “The wrapt module focuses very much on correctness. It therefore goes way beyond existing mechanisms such as
There’s a bunch of blog posts from 2014 / 2015 (and kept updated) that talk about how wrapt solves many issues with traditional ways to decorate and patch things in Python, including “How you implemented your Python decorator is wrong”.
Docs are pretty good, with everything from simple wrappers to an example of building a wrapper to handle thread synchronization
Michael #4: pysentry
via Owen Lamont
Install via
uv tool install pysentry-rs
Scan your Python dependencies for known security vulnerabilities with Rust-powered scanner.
PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (
uv.lock
,poetry.lock
,Pipfile.lock
,pyproject.toml
,Pipfile
,requirements.txt
) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.Key Features:
Multiple Project Formats: Supports
uv.lock
,poetry.lock
,Pipfile.lock
,pyproject.toml
,Pipfile
, andrequirements.txt
filesExternal Resolver Integration: Leverages
uv
andpip-tools
for accurate requirements.txt constraint solvingMultiple Data Sources:
- PyPA Advisory Database (default)
- PyPI JSON API
- OSV.dev (Open Source Vulnerabilities)
Flexible Output for different workflows: Human-readable, JSON, SARIF, and Markdown formats
Performance Focused:
- Written in Rust for speed
- Async/concurrent processing
- Multi-tier intelligent caching (vulnerability data + resolved dependencies)
Comprehensive Filtering:
- Severity levels (low, medium, high, critical)
- Dependency scopes (main only vs all [optional, dev, prod, etc] dependencies)
- Direct vs. transitive dependencies
Enterprise Ready: SARIF output for IDE/CI integration
I tried it on pythonbytes.fm and found only one issue, sadly can’t be fixed:
PYSENTRY SECURITY AUDIT ======================= SUMMARY: 89 packages scanned • 1 vulnerable • 1 vulnerabilities found SEVERITY: 1 LOW UNFIXABLE: 1 vulnerabilities cannot be fixed VULNERABILITIES --------------- 1. PYSEC-2022-43059 aiohttp v3.12.15 [LOW] [source: pypa-zip] AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE:... Scan completed
Extras
Michael:
- I’ve been rumbling with rumdl.
- Ruben fixed one of my complaints about it with issue #58.
- Config seems like it might be off. Here’s mine .rumdl.toml.
- I’ve been using it on the upcoming Talk Python in Production book
- Read the first third online and get notified when its out.
- 20 or so Markdown files
- 45,000 words of content
- I asked if 3.13.6 would be the last 3.13 release? No.
Joke: Marked for destruction
Episode Transcript
Collapse transcript
00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to
00:04 your earbuds. This is episode 446, recorded August 25th, 2025. I am Michael Kennedy.
00:11 And I'm Brian Okken.
00:12 And this episode is brought to you by many cool services and products.
00:17 Can you imagine a course that teaches you how to use pytest? An entire library of 270 hours of
00:23 courses about all Python things, pytest book, and Patreon supporters. Thank you all. Yes,
00:29 check out Brian's courses, Michael's courses, Patreon supporters, so check out Patreon and all that.
00:37 Thank you.
00:38 And I actually have another thing that kind of falls into that category that's pretty awesome I want to talk about later.
00:44 If you want to connect with us on the socials, MastodonBlueSky is probably where we spend most of our time.
00:51 Brian, me, the show, we've all got accounts.
00:54 You can watch us live on YouTube at pythonbytes.fm.
00:57 slash live. If the live show is going on, it should say a big banner across the top. Hey,
01:02 we're live. Click here to go to it. And if not, you'll just see all the past live streams. So
01:07 much appreciated. Typically Monday at 10 a.m. Pacific time. And you should definitely subscribe
01:13 to the newsletter because you'll get a custom email from Brian talking about all the different
01:19 things we covered and not just a list of what we've covered, but diving into extra details,
01:24 extra links more background info very cool also very cool our statistics yeah tell us about these
01:30 things well we have um there's a there's a website called pypi stats.org and and it's it's nice it's
01:37 you pop into it and it just says analytics for pypi packages so let's uh let's pick one
01:43 by test check uh it's my favorite um little thing that i support and then it you what you get is you
01:50 you get these, I'm pretty sure we covered this before, but you get the download statistics.
01:54 So that's not really the news. It is a cool website. You should check it out if you haven't
01:58 checked it out before. And you can also check out the top packages, which ones are the most
02:05 downloaded by day, by week, by month. And that's all fun, but there's some details in the individual
02:13 package that you might want to know if you're supporting stuff. So like, for example, what
02:17 system for pytest check. It looks like it's pretty much all Linux, 97.5% Linux, which makes sense.
02:25 It's a test tool. So a lot of the tests are running in the server and not other places,
02:30 but the package supports Windows anyway. But if I wanted to like, you know, bail on Windows,
02:36 I probably wouldn't be a terror. I mean, I don't think very many people would be mad because
02:40 1% of the people would be pretty upset. Yeah. Well, you know, so maybe I'll leave it. It,
02:47 It isn't OS specific anyway, but some things are, you know?
02:51 So, okay.
02:52 So why am I bringing this up?
02:53 If this is old news, you should know about it anyway.
02:57 But one of the things is a few weeks ago, it went down.
03:02 This is a volunteer supported site.
03:05 And it was by C.R. Flynn.
03:10 I'm sorry.
03:10 I don't know his name.
03:11 But anyway, posted that, hey, PyStats.org is down.
03:17 Somebody reported that like three weeks ago.
03:20 And so I noticed that.
03:22 And Hugo mentioned it.
03:23 And I saw what was going on.
03:25 But just a couple days ago, Hugo announced, hey, PyPI stats is back online.
03:31 And it's more supported now.
03:33 So thanks to Janice and the PSF.
03:38 Thanks to Janice for suggesting that the PSF takes stewardship and connecting the right people.
03:43 like eDurbin for migrating and of course Christopher Flynn oh Christopher Flynn was created it but um
03:50 but a lot of people were involved or at least a handful of people were involved to get it back
03:53 online and get it going and I didn't realize um so that's cool it's back online works great and I
04:00 really appreciate it because I don't use it all the time but occasionally and I won't I'd like to
04:04 use it I didn't know that there was a CLI for it so uh Hugo um put together a project called PyPI
04:12 stats same name but without the dot org but you can pip install it and you can run it on the command
04:17 line and it's super neat um you can actually you can run it on the command line and you get you get
04:23 some you can pass it like python i'm showing on the screen python minor so it shows uh which python
04:30 versions are being being downloaded um but you can do other stuff you you can what i have a list
04:37 look it up. You can do Python major, Python minor, the system, overall downloads, recent downloads.
04:45 So it's pretty interesting information. Some new things that just got released are the ability to,
04:53 you were always able to pass in like a name. So just on the command line, type in a package name
04:59 and get the stats. But now you can also point it at a directory or not point it at anything. And if
05:05 you're in the current directory for a project and it'll just look up by project.tom or set up CFG
05:10 and look it up. So really cool that Hugo extended that command line thing to be able to look up
05:17 that information. That's cool. And it tells you what is the popularity of the packages
05:23 you're using basically? Yeah, well, the popularity, but also just different stuff.
05:26 So like for Pillow, for example, it shows an example of, and this is in black and white on the
05:34 readme, but if you do it on the command line, it's color. So the color output is really kind of nice.
05:40 Nice.
05:40 But you can figure out like start and end date. So if you want a particular date,
05:45 you know, for you want to zoom in on dates, how many downloads last month and whatnot.
05:51 And the different things like the what Python version is good. It's kind of cool because you,
05:58 that's one of those things of like, is it, you think it'll be okay if I completely remove support
06:03 for 3.8 if i want to bump up to 3.10 or something but looking at pillow for example it's um it's
06:11 still uh you know five percent of the people are using uh 3.8 um and some people are still using
06:17 3.6 so maybe they should still support it i'm not sure so maybe they support it or maybe they could
06:24 be the pebble thrown in the water to create the wave that causes those people to upgrade
06:29 Yeah. There's some cool flags for the command line thing, like last month or picking a date, easy to read stuff. And there's an API for it or like a package, importable package that you can do it programmatically.
06:49 So anyway, cool tool.
06:51 Very cool.
06:52 All right.
06:52 Let's jump over and talk about the state of Python 2025, according to the PSF JetBrains
06:59 survey.
07:00 Ooh, neat.
07:01 This article is written by a little known guy named Michael Kennedy.
07:05 I actually worked with, yeah, I worked with JetBrains and they're like, Hey, you want
07:10 to write this?
07:10 I'm like, yeah, sure.
07:11 That'd be great.
07:12 So basically what I did is I went through all of the survey results and pulled out the headlines and like the trends and like what jumped out at me.
07:22 Right. You know, you and I have done this together before, Brian, where we just pull up the survey results and do it on the show.
07:28 I did this with like way more time and effort in written form and then we'll do it on the show.
07:33 How's that? So I think this is maybe like 4000 words.
07:36 It's like quite a quite a write up. Right.
07:39 So I want to just, I don't want to go through all of it.
07:41 You guys can read it, but I do want to pull up some interesting trends.
07:46 So the first trend I think that's pretty wild is that Python people use Python.
07:53 And you're like, oh, Michael, obviously.
07:56 But if you had a JavaScript survey, you would ask, do you use JavaScript?
08:01 And a lot of people that do Python would say, yeah, I use JavaScript.
08:05 A lot of people who do, I don't know,.NET use JavaScript, right?
08:10 Either as little utilities for Node or as because they need a website that has interactivity.
08:16 So I think it's noteworthy that of the people that are in the Python space, they're not there
08:20 as a secondary purpose.
08:21 They're there because of Python, not because like they've got some library that they need
08:25 to work on, right?
08:26 So 86% of people who are Python people use Python, like as their, that's their main thing,
08:32 right?
08:32 As their main.
08:33 And then 14 is secondary, so.
08:35 Yeah, yeah.
08:36 So like maybe they have to support tools in Python, but that's not really what they do.
08:40 The other one that I think is wild is that, I think we maybe have mentioned this.
08:45 I know I've mentioned this on Talk Python before, but people out there are mostly brand new.
08:49 I've seen this once before, but it continues to be true even more so, and it blows my mind.
08:54 How many years of professional coding experience do you have?
08:57 Less than two.
08:58 One to two years, like zero to two years of programming.
09:01 That's 50% of the people.
09:03 Wow. 50% of the people in the Python space just started. And if you're one of those 50% listening,
09:10 thanks for listening. I know a lot of people listen to our podcasts so that they can jump
09:15 into the community and get up to speed. So that's pretty awesome. But this has tons of consequences,
09:19 right? Like if you're creating tutorials and you're just like, Hey, yeah, install that,
09:23 make a VNV and then install the package for local editing. Now we get started the tutorials,
09:27 like hold on, you, you got to realize you're talking to people that are just getting started,
09:31 like half of them.
09:32 And I think that has a lot of implications for tooling, for tutorials, for presentations, et cetera.
09:37 Yeah, but this is also, this question is how many years of professional coding,
09:42 not necessarily how many years of coding.
09:44 Yeah, there's more results in there that are like how much experience you have with Python at all,
09:48 and it's like really quite low.
09:50 Okay.
09:51 So this, but this is also noteworthy in the sense that like, not just how much time do they have with Python,
09:56 but how much they have time professionally coding at all.
09:59 Yeah.
10:00 Right?
10:00 Yeah, and I'm noticing that a lot with people I teach as well, I get a lot of, on the Python test community,
10:08 get a lot of questions that say, I don't know if I can ask this here, but basically I don't have any CS background.
10:13 And so I don't know what a lock is or something like that.
10:19 So I'm like, yeah, sure.
10:21 Let's talk about that.
10:21 Yeah, exactly.
10:22 Yeah, and it's fine.
10:24 Another one, I don't know.
10:25 I've always thought of the Python community being broken into thirds, like one-thirds or web API, one-third data science,
10:32 and one-third catch all others, automation, little tools, whatever.
10:37 Well, that is no longer valid.
10:39 Data science is now half of Python.
10:44 51%.
10:45 And it's probably 51% AI, too, because with AI, you can go over 100%.
10:51 That's right.
10:51 Absolutely.
10:51 You don't need it to add up.
10:52 Now, this does include data engineers who I got a message from so many.
10:57 I don't want to be grouped in with data science.
10:59 Like, okay.
11:01 But you also don't belong in web.
11:03 And you don't belong in other, I don't think.
11:05 I don't know.
11:06 But, you know, that does include some data engineering.
11:09 But nonetheless, this is a significant portion.
11:13 Another thing to keep in mind.
11:14 Okay, so does this survey include the LLM people?
11:19 Yeah, yeah, oh, absolutely.
11:19 Yeah, yeah, definitely.
11:20 I think a lot of this is people getting into machine learning and so on.
11:24 Okay, this is, I think, the last main thing I wanted to, I know, two more things real quick.
11:30 The other one is, and this one I think I want to put out there as a, if you were in this group, reconsider.
11:36 Most people, 83% use a major version older of Python or older.
11:43 I mean, we're at the end of 3.13, and it's like 83% are like 3.12 or below.
11:48 And not just like-
11:49 We're not at the end of 3.13.
11:51 Well, no, not in the end of like support.
11:53 I mean, we're about to have 314 is what I mean.
11:56 Yeah, right.
11:56 That's what I mean.
11:57 Like it's 313 is not, it's about to no longer be the latest is what I'm saying.
12:02 So this is pretty wild.
12:02 And I did some quick math, just like, you know, some people are like, well, it works fine for me.
12:06 I don't really need it to be any better.
12:08 Like I don't need the new tools.
12:09 So 311, let's say 311 is fine.
12:11 Or let's say 310, 310 is fine.
12:13 Even 39, it's supported for another couple of years, right?
12:15 Probably, maybe one.
12:18 But there's, I did, like, let me do some quick math here.
12:21 Just see if I can put this in perspective Like in addition to just, you might need to be on the later version to have some of the newer tooling, right?
12:29 Some of the new libraries and so on that decide to drop the old one so they can adopt some feature, right?
12:34 Yeah.
12:34 But I said, well, what if you're on 3.11?
12:37 48% of the people currently using 3.11, if they upgraded to 3.13, their code would run 11% faster and use 10 to 15% less memory.
12:45 Yeah.
12:45 If you're on 310, you get a 42% speed increase and 20 to 30% less memory just by changing the Python you're running on.
12:54 Chances are it's extremely minimal or zero upgrade cost.
12:58 You just got to try it out.
12:59 And then I also did some of that.
13:00 Yeah, this is like no code changes.
13:02 Just change the interpreter.
13:03 Exactly.
13:04 Just change the start command or what's installed.
13:07 So what if you're a medium business?
13:08 I did a little research like vendor.com and stuff.
13:10 I said the average AWS bill for a medium-sized business is $2.3 million a year.
13:16 And EC2 represents 50% to 70% of that.
13:19 And if you're paying for a bunch of cloud machines or cloud compute in whatever form,
13:26 and you get those boosts I talked about, well, your small business just saved $420,000 by just changing from 310 to 313.
13:36 Wow.
13:36 If you're a large scale business, like a large enterprise, you save $5.6 million by just switching to run on the newer version of Python.
13:43 So anyway, I think these are like really, really interesting.
13:46 And then the last one is there's a big resurgence in Python web development, I think.
13:51 Over the years, this has been trending down 45, 43, 42%.
13:56 But it's back, baby.
13:58 And not just are people using, saying that they're doing a little more web development.
14:03 But if you look at things like CSS or HTML in terms of how much they're used, they jumped, I think it's like 15% up year over year.
14:14 Not a like 30 to 45%, but the increase from what it was to the new one is like a 15% growth from what it was previously.
14:23 So like all in databases just across the board.
14:25 So I think that's really interesting because there had been like a long, slow trend of kind of like Python's less for web, Python's less for web, probably more JavaScript.
14:34 And it's like, it's back.
14:35 So I think that's pretty interesting.
14:37 And then there's a bunch of like guidance that I gave for people at the end.
14:41 Like, okay, now that you know all this stuff, here are some actions, some actionable things you can do to take advantage of these trends and whatnot.
14:48 So I've said enough about this.
14:51 People can check it out.
14:51 It's a super long and interesting article, I think.
14:54 Yeah.
14:55 Okay, cool.
14:55 I can't wait to check this out.
14:57 Yeah, indeed.
14:57 All right, over to you.
15:00 Well, I'd like to swap out and take a look at wrapt.
15:05 Actually, I couldn't resist, so I'm going to talk about a package called wrapt,
15:09 and I went ahead and looked at the PyPI stats, and it's used a lot.
15:14 So it's the, I don't know, numbers percent-wise or where it is at the top packages or something.
15:21 But it's downloaded almost 5 million, 4.8 million daily downloads.
15:28 That's pretty good, pretty big.
15:30 So a pretty popular package.
15:32 So what is wrapt?
15:33 wrapt is, I can't believe we actually haven't talked about this yet, but wrapt is a Python module for decorators, wrappers, and monkey patching.
15:41 And to be honest, the first time I ran across wrapt, I thought, well, wait, don't we have functools wraps?
15:48 That's what I've been using before.
15:49 However, so let's talk about wrapt a little bit.
15:53 The aim of the module is to provide a transparent object proxy for Python.
15:57 Yep, wrappers, which can be used as a basis for construction of function wrappers and decorator functions.
16:05 Right, got it.
16:06 Funktools wraps, right?
16:07 No, apparently.
16:09 So the wrapt module focuses very much on correctness.
16:13 It's therefore goes way beyond the existing mechanisms such as func tools wraps to ensure
16:18 decorators preserve introspect ability signatures type checking abilities.
16:23 Okay.
16:24 Yeah.
16:24 Cause sometimes you'll, you, you, like, let's say if you, one of the examples of, I can't
16:28 remember where it is in the, in the docs, but if you, if something that is in a package
16:34 is implemented as a property, not a method or then, then the return value is different
16:42 than if it was just a function.
16:43 But, and functools wraps gets that wrong, but wrapt, I think functools wraps gets that wrong,
16:49 but wrapt gets it correct.
16:50 It has it behave and signature wise look the same, which is pretty cool.
16:55 Wish I knew about this.
16:57 I just thought I was battling.
16:58 This decorator doesn't have the right, you know, it transforms the type of signature
17:04 of this function.
17:05 So then you get some warning.
17:06 I'm like, I don't care.
17:07 It's a web function.
17:08 No one's going to call it directly, but it's just an IDE warning.
17:10 I'm like, ah, make it go away.
17:12 And to be fair, the main reason why I usually am reaching for, if I reach for functools wraps is because it makes the name of the function be correct.
17:21 And it isn't the silly little function.
17:23 It changes the name and it changes the doc string.
17:26 So if anybody's looking at the name or the doc string, it gets corrected.
17:30 And if that's enough for you, yeah, that's fine.
17:32 But it's kind of interesting looking at some of the history.
17:36 So I was looking back.
17:38 There's a blog that the creator of this wrote, Graham Dumpleton.
17:45 And this is back from apparently originally, if we go to the blog, it's originally from 2014.
17:55 He started writing these and he's kept them updated.
17:57 So last update was five years ago, but original 2014.
18:01 Anyway, how you implement your Python decorators is wrong.
18:04 I was interested. One of the reasons why I was interested in this is the idea that it was around monkey patching and monkey patching is the original thought process as to why he wrote this is he was monkey patching things and it was incorrect.
18:18 And interesting discussion over there on the blog about monkey patching and why why it's not just for testing.
18:25 I use it a lot for testing, but it could be there's a lot of other use cases to interesting block series of blog posts about it.
18:31 So pretty fun to take a look.
18:35 One of the amazing examples in the docs, which I thought was really pretty awesome,
18:40 there's some really easy examples that you'll get right away.
18:42 And then it goes like pretty deep.
18:44 So let's say you've got asynchronous code or multi-threaded code, and you want to synchronize those with locks.
18:54 He's got this write-up, which is, you know, it's a kind of a lengthy write-up, but it's not too bad.
19:00 And the end result, if you scroll to the answer at the bottom, is you can just have synchronized.
19:07 You set up these locks and you decorate each function that you want synchronized with a synchronized decorator, and it just works.
19:13 So it's kind of fun to be able to do things like put extra abilities around something like lock, grabbing a lock or something like that.
19:22 Yeah, that's really cool.
19:23 We're going to need more of that as free-threaded Python becomes the thing.
19:26 People have to get used to those concerns.
19:28 Yeah, and also one of my concerns with jumping from functools-wrapt to WRAPT,
19:39 was I was worried about speed because it's doing a lot, so is it kind of slow?
19:45 And apparently not.
19:47 To ensure the overhead is minimal as possible, a C extension module is used.
19:51 If it's available, an automatic fallback to a Python implementation is provided
19:55 if the target system isn't extended for that target system.
19:59 But for my use cases, as we've seen, most of my users are on Linux, so we're probably fine there.
20:06 Yeah, that's really neat.
20:08 Very neat, very neat.
20:10 Let's see, what is next?
20:12 Owen Lamont is back with a good recommendation for us.
20:15 Okay.
20:16 Yeah, he says, you should check out PySentry.
20:20 So I did check out PySentry, and it's quite neat.
20:23 So what is PySentry?
20:24 It scans your Python dependencies for known vulnerabilities.
20:28 And it's Rust-based, so it's fast and it might get VC funny.
20:31 So what it does is you go into a folder, a project.
20:38 I'm not sure if it needs an active virtual environment or just the files,
20:42 but it will scan uvlock, poetrylock, piplock, pyproject.toml, pipfile, and requirements.txt.
20:48 Look for specific versions of dependencies that you are specifying there.
20:54 and it'll cross-check them with a bunch of vulnerability databases.
20:58 Not just typo squatting type stuff, but just, hey, there was this vulnerability reported in the Django admin.
21:05 You should update because you don't want to participate in that kind of fun.
21:09 You're not about that life.
21:10 So pretty cool.
21:12 Yeah, it has multiple data sources, the PyPA advisory database, PyPI JSON API,
21:17 OSV dev open source vulnerabilities, and so on.
21:21 Yeah, and it's pretty neat.
21:22 So you can specify different levels.
21:25 Dependency scopes are supported like dev versus main, direct versus transitive dependencies,
21:31 and that kind of thing.
21:32 I ran it on our setup on pythonbytes.fm, which apparently, now one thing really quick here
21:39 is it actually has more than, it says PySentry security audit.
21:44 Summary, 89 packages scanned, one vulnerable, one vulnerability found.
21:49 Ah, Brian, what's going on?
21:50 There's actually more than 89 packages.
21:52 for our website, but I don't know why.
21:54 Maybe there's just no information about some unpopular ones, and so that's why they didn't show up.
21:59 They weren't scanned.
22:00 I don't know.
22:01 I don't know why it's less, but that's my conjecture.
22:03 It says there's one unfixed low severity CVE found, and it's unfixable.
22:10 Great, that's why it's still there.
22:12 What is it?
22:12 It is an aiohttp.
22:15 If an invalid IPv6 URL is passed to it, it will go bonkers.
22:20 I don't care.
22:21 This is the dependency of a dependency of a dependency that internally calls an API to its own service.
22:27 And it uses aiohttp to do that.
22:31 No one's going to pass a invalid IPv6 URL to that thing because it's not even part of our code.
22:37 It just happens to be we ask the service to do something.
22:40 It goes, OK, I got to call my API in the cloud and do that.
22:43 Right. But here it is.
22:44 So you can decide is that an issue or not.
22:46 But still, that's pretty cool.
22:47 Right. You could just run this in your project out periodically.
22:50 or you could maybe run as part of CICD and get like warnings.
22:54 Hey, maybe I shouldn't put this in production.
22:56 It says there's a CVE severity level 10 out of 10 remote code execution,
23:00 no auth required.
23:01 Let's not do that.
23:02 Yeah.
23:02 Interesting.
23:03 Yeah.
23:04 One thing to be aware of, you don't uv tool install PyCentury.
23:09 You install PyCentury-RS.
23:13 So just be careful on the install.
23:14 I don't know what's at PyCentury, but I presume it's not this.
23:17 Oh, okay.
23:18 So you have to be careful what you're installing.
23:20 Yeah.
23:20 Just look at the website and there's the same, the name of the command and the package are different.
23:27 Yeah.
23:27 And I know that that happens, but it always like, I don't like it.
23:31 I don't like it.
23:32 Just pick a different package name, people.
23:33 Come on.
23:36 One quick extra for me is that we, I talked about this last week that our testing code is being offline to
23:44 archived or whatever.
23:46 It's not going offline.
23:47 I don't think.
23:48 So last week, Michael convinced me to think about archiving it away.
23:53 So you'll be able to go to testandcode.com and find it.
23:59 For the foreseeable future, I think, looking into ways to offload it to somewhere else.
24:05 But there's some pretty cool things that make it seamless.
24:08 So I think that as I get time in the next couple of months, it'll transition over and nobody will know the difference,
24:15 except for maybe the website will look different other than that.
24:17 Also, I've gotten a whole bunch of great comments.
24:20 So a lot of people have gone over to the contact page.
24:26 And so in the episodes, I've said, hey, you can go over to pythontest.com,
24:31 and there's a contact page, and you can reach me if you want.
24:34 I'm not really fishing for compliments, but a lot of people have said, hey, I've enjoyed this podcast, and thanks.
24:41 And just some nice emails have come in.
24:44 So that's cool.
24:44 So thank you, everybody.
24:46 Very nice.
24:46 And I'm glad to see you're keeping it online.
24:48 That's cool.
24:50 Actually, somebody contacted me and said that I was worried, so I downloaded all the episodes.
24:57 So you don't have to do that.
24:59 Very proactive.
25:01 Okay, Michael, how about extras for you?
25:03 I have some extras.
25:04 I have some rumdoll follow-up.
25:06 This is the Markdown Lentor that we talked about previously.
25:12 Let me do it in reverse order.
25:14 So I'm actually almost ready to release my Talk Python in Production book, which I've been working on.
25:21 It's about 300 pages now.
25:22 I'm going to release it as an e-book initially.
25:24 If it's worthwhile, I'll eventually do a print.
25:26 But certainly an e-book that you can get.
25:29 So you can read about the first third of it online, which is fun.
25:34 So if people are interested, they can go through and read the first seven chapters, I think,
25:39 which is exactly what's in the book.
25:42 and then you'll be able to actually buy the rest of the book pretty soon.
25:47 So why am I starting out with this?
25:48 One, I encourage you right now, it's not quite released yet, go click on buy the book.
25:53 Please put your name in and email address.
25:54 Say, I'm interested when this comes out and I'll email you very, very soon.
25:58 But the reason I'm talking about this is I've been grinding on that thing
26:02 with like 45,000 words worth of markdown with a rumble.
26:06 And I have some reports.
26:07 It's been going really well, actually.
26:09 The thing works great.
26:11 It's found some issues, some of them I didn't like.
26:14 I didn't like the fixes it was proposing.
26:16 We talked about it word wrapping at line 80 or whatever you set it at.
26:21 And I'm like, no.
26:22 My Markdown editors, it shows that kind of formatting.
26:25 I want it to just wrap around and not be weird, no wrapping, wrapping.
26:30 So you can turn those kinds of things off.
26:31 Yeah, exactly.
26:33 The other thing is I pointed out that there was a bug and not sort of looking up the directory tree
26:40 to find the config file if you're down in the guts.
26:42 And so Ruben very kindly said, you know what, that's a good idea.
26:46 I'll fix it and just released a fix that made it a little bit better.
26:49 There's a lot of traction going on here.
26:51 Yeah, so-
26:51 That would have bugged me too, yeah.
26:53 Yeah, I'm like, well, the reason it bugged me is I was, there's like the book
26:56 and then there's a source folder full of all the markdown and then there's other folders that are like output
27:01 and assets and so on.
27:02 And I was down in the lower one and I ran it on accident and it completely formatted and changed everything
27:07 based on the defaults of the tool, not all the specs I set.
27:11 And I'm like, no, no, no, no.
27:14 You know how much work is this going to?
27:16 Luckily, I just rolled it back in Git, but I'm like, it was easier to apply the few changes
27:21 that I wanted to keep than to redo all those things.
27:25 Anyway, that's fixed now.
27:26 So it's awesome.
27:27 And then finally, I thought maybe people would be interested in the config that I was using,
27:32 that I am using, And I turned off a bunch of things and added comments to what I turned off, like line wrapping, for example.
27:38 And also, I don't know where I got the config file.
27:41 I got it from somewhere, but some of the settings were not right.
27:44 Like, I can't remember exactly what it was, but maybe they were not under a global tag or some weird thing.
27:50 And the TML.
27:51 So I put mine up, and it seems to work if people want to borrow it.
27:54 So anyway.
27:55 Cool.
27:55 So that's in the show notes, right?
27:57 That is all in the, yeah, that's all in the show notes.
27:59 I've made it a gist, and you can get it from the gist.
28:02 It's just that easy.
28:03 It's just that easy.
28:05 That is right.
28:06 Okay.
28:06 And then I think, oh yeah, one more thing.
28:09 Remember last time I speculated, could Python 3.13.6 be the final 3.13 before 3.14?
28:17 No.
28:17 The answer is no.
28:18 No.
28:19 The answer is a hard no.
28:21 The answer is actually no.
28:23 3.17 was released before you talked about 3.16.
28:27 Because 3.16 came out, I wrote it in the show notes, and then I didn't look for a few days.
28:32 We did the show and 3.17 had already come out.
28:34 So that's a hard no.
28:36 3.13.7.
28:38 Yeah, sorry, 3.13.7.
28:40 But here's the thing interesting.
28:42 Why?
28:43 Why is that the case?
28:44 It is a emergency bug fix for an issue or a problem introduced in 3.13.6.
28:54 So in 3.13.6, there was something that went wrong.
28:58 And they're like, ah, what was it?
29:00 a regression in the SSL module between 3.13.5, 3.13.6, reading from a TLS encrypted connection block.
29:07 That actually sounds like you really want that to work.
29:09 Yeah.
29:10 Well, so don't predict it again, because the next one will just be, the reason will be to make Michael wrong.
29:16 Exactly.
29:17 Yeah.
29:18 How about that for a release note, huh?
29:21 Okay.
29:21 That's it for all my extras.
29:23 Okay.
29:24 Are you ready for a joke, or you got something else for us first?
29:27 It's like 98 degrees here.
29:28 Yes, I'm ready for a joke.
29:30 so i know neither of us have air conditioning in our current setup right now i'm above the garage
29:35 in this separate building that has literally no ac i have to close the windows because the road noise
29:40 is my little spa time my sauna time and i am in a house that used to have lovely air conditioning
29:46 and it picked the hottest weekend of the year to break so because when else would it break
29:51 all right well it's gonna be fine brian don't you worry about it you know why why because the
29:56 this planet is marked for death.
29:59 Okay.
30:00 So says the Silver Surfer.
30:02 Now, I don't even know what show the Silver Surfer is from.
30:05 No, it's one of those like Marvel or Avenger type shows.
30:08 But the Silver Surfer appears and says, your planet is marked for death.
30:12 And people say, can we ask why?
30:14 Well, the Silver Surfer says, because your planet's beings chose JavaScript
30:19 as the primary language of web development.
30:22 Clearly a fatal flaw.
30:23 What is wrong with him?
30:25 We're going to have to just finish you off.
30:27 You're clearly not worthy.
30:31 That's good.
30:32 Yeah.
30:33 I can come up with some other reasons that it might pick as well right now.
30:37 You know what?
30:38 The Silver Surfer is not a fan of front-end frameworks.
30:42 I'll tell you what, though.
30:44 At least my frustration with all this kind of stuff is not that JavaScript is a language for front-end development.
30:50 It's that it's the only language ever.
30:52 after 25, 30 years of code running in browsers, that it's the only language that's...
31:00 And we've had WebAssembly for 10 years.
31:02 It's fairly ridiculous.
31:03 Anyway, thank you, Silver Surfer, for putting us out of our misery.
31:06 Yeah.
31:08 Maybe not.
31:08 No, no.
31:11 Pat says you should come visit Iowa, by the way.
31:13 Lovely weather and not melting there.
31:15 All right.
31:16 Thank you, Pat.
31:16 I like Iowa.
31:18 Indeed.
31:19 And with that, Ryan, thanks for a lovely show as always.
31:22 Bye, everyone.
31:23 Bye.