Michael Kennedy: Hello and welcome to Python Bytes, where we deliver Python news and headlines directly
Michael Kennedy: to your earbuds. This is episode 483, recorded June 9th, 2026. I'm Michael Kennedy.
Michael Kennedy: I'm Calvin Hendryx-Parker.
Michael Kennedy: And this episode is brought to you by us, All of Our Things. We'll talk a little bit about that in
Michael Kennedy: the introduction bit here in just a second. If you want to follow us on social media,
Michael Kennedy: we're on all the socials. We'll have those in the show notes for you. Sign up for the newsletter
Michael Kennedy: at pythonbytes.fm/newsletter
Michael Kennedy: or just domain click on newsletter.
Michael Kennedy: You always get a bunch of interesting things
Michael Kennedy: as well as some extra announcements
Michael Kennedy: for fun stuff that we have going on.
Michael Kennedy: And with that, I actually, Calvin,
Michael Kennedy: have a pretty big announcement.
Michael Kennedy: So I want to say thank you to Brian Okken.
Michael Kennedy: The big news is that Brian has stepped back from the show.
Michael Kennedy: He's been working on it for almost 10 years,
Michael Kennedy: just a few months short of 10 years.
Michael Kennedy: That's incredible.
Michael Kennedy: That's a great run.
Michael Kennedy: That's an incredible run.
Michael Kennedy: That is an incredible run.
Michael Kennedy: Obviously, the world has changed a lot over the last 10 years,
Michael Kennedy: and Brian just needs more time to focus on some of his other projects.
Michael Kennedy: Not stepping away from programming.
Michael Kennedy: He's not going to go become like an organic farmer in Eastern Oregon.
Michael Kennedy: Forest ranger.
Michael Kennedy: Exactly.
Michael Kennedy: You know what?
Michael Kennedy: I'm retiring from tech.
Michael Kennedy: That's it.
Michael Kennedy: No, but he's moved on from the show,
Michael Kennedy: and I just want to take a moment and say,
Michael Kennedy: Brian, thank you very much.
Michael Kennedy: You've made the show what it is over the years,
Michael Kennedy: and it's been great to work with you,
Michael Kennedy: And it's been really, really awesome.
Michael Kennedy: And I know a lot of people in the audience are going to miss you.
Calvin Hendryx-Parker: Yeah, I agree.
Calvin Hendryx-Parker: I've gotten to know Brian over the years as well.
Calvin Hendryx-Parker: And I really appreciate him being on the show and just being a part of the Python community.
Calvin Hendryx-Parker: So I've enjoyed having Brian around as well.
Calvin Hendryx-Parker: Not that he's going to go away, but he's just not here right now.
Michael Kennedy: Yeah, maybe we'll have him back as a guest sometime.
Michael Kennedy: Yes, absolutely.
Michael Kennedy: So Brian, thank you very much.
Michael Kennedy: And Calvin, welcome to the show.
Calvin Hendryx-Parker: I'm glad to be here.
Calvin Hendryx-Parker: I'm excited.
Calvin Hendryx-Parker: This is a new, the next generation of Python Bytes.
Calvin Hendryx-Parker: Let's do it.
Michael Kennedy: Yeah, absolutely.
Michael Kennedy: The next generation.
Michael Kennedy: So I know you have your pulse on the industry in so many ways, and you have a ton to contribute.
Michael Kennedy: And so we're going to work together on Python Bytes for a while.
Michael Kennedy: And yeah, it's awesome.
Michael Kennedy: So thanks for coming on the show.
Michael Kennedy: It's really great to have you.
Michael Kennedy: Thank you, Brian, for being here.
Michael Kennedy: Calvin, welcome.
Michael Kennedy: Normally, we just kick off the show.
Michael Kennedy: Hey, I'm Brian, I'm Michael, or whatever.
Michael Kennedy: But this time, at least you've been on the show on this show before, as well as Talk Python.
Michael Kennedy: But just give people a real quick introduction since you're kind of new to a lot of people.
Calvin Hendryx-Parker: Sure, sure.
Calvin Hendryx-Parker: So I'm Calvin Hendryx-Parker.
Calvin Hendryx-Parker: I'm co-founder and CTO of Six Feet Up.
Calvin Hendryx-Parker: We are a Python agency that loves specializing in solving hard problems and helping impactful
Calvin Hendryx-Parker: leaders build a better world out there and do things to benefit humankind in some way.
Calvin Hendryx-Parker: I also am a co-founder of the IndiePy meetup here in Indianapolis.
Calvin Hendryx-Parker: So very involved in the community.
Calvin Hendryx-Parker: I love going to PyCon and being around all the folks.
Calvin Hendryx-Parker: So this definitely fits well with like kind of my mission,
Calvin Hendryx-Parker: which is to bring more to the Python community if I can.
Michael Kennedy: And you're also an AWS hero, is that right?
Calvin Hendryx-Parker: Oh yeah, I am.
Calvin Hendryx-Parker: AWS hero since 2018 or 2019, I think.
Calvin Hendryx-Parker: Yeah.
Calvin Hendryx-Parker: So basically means AWS thinks I'm kind of a,
Calvin Hendryx-Parker: I guess a big deal.
Calvin Hendryx-Parker: I don't know.
Calvin Hendryx-Parker: He's a big deal.
Calvin Hendryx-Parker: Yeah, right.
Calvin Hendryx-Parker: Yeah, there's only a few of them around the globe.
Calvin Hendryx-Parker: And it's kind of cool because you can't be an Amazon employee or employed by a competitor.
Calvin Hendryx-Parker: And so it allows me to maintain my independence and a little bit of cloud agnosticness.
Michael Kennedy: Yeah. Awesome. All right. Well, with that, how about you kick off our first topic?
Calvin Hendryx-Parker: Oh, sure. I'd love to. So we've got just yesterday, the fine folks at Astral have released some new features that are still in beta for checking for vulnerabilities and also some malware checks.
Calvin Hendryx-Parker: So for example, they've added the new audit subcommand.
Calvin Hendryx-Parker: So as you, this is not an unheard of thing in the community.
Calvin Hendryx-Parker: There's existing tools like it,
Calvin Hendryx-Parker: for example, safety and pip audit.
Calvin Hendryx-Parker: What is different about uv offering this?
Calvin Hendryx-Parker: They have basically said,
Calvin Hendryx-Parker: we have an opinion like they've done in other ways.
Calvin Hendryx-Parker: Astral has basically said,
Calvin Hendryx-Parker: we have opinions about how things should be done.
Calvin Hendryx-Parker: And we're trying to optimize
Calvin Hendryx-Parker: the developer experience workflow
Calvin Hendryx-Parker: to make this not suffer from some of the problems
Calvin Hendryx-Parker: you get with like, for example, npm.
Calvin Hendryx-Parker: When you do an npm install,
Calvin Hendryx-Parker: you get this just overload of warnings for deprecations.
Calvin Hendryx-Parker: And so you just kind of start ignoring it
Calvin Hendryx-Parker: and not paying attention to it.
Calvin Hendryx-Parker: The idea is to be explicit
Calvin Hendryx-Parker: and call it when you want to have these kind of scans run.
Calvin Hendryx-Parker: So you could put it into a pre-commit hook, for example,
Calvin Hendryx-Parker: you can obviously run it in your CI pipeline,
Calvin Hendryx-Parker: but it's meant for the developers to run locally as well.
Calvin Hendryx-Parker: And the add command and sync commands have been updated.
Calvin Hendryx-Parker: Well, optionally right now, they're not enabled,
Calvin Hendryx-Parker: but if you enable the uv malware check,
Calvin Hendryx-Parker: the add and sync commands will proactively tell you
Calvin Hendryx-Parker: if you're adding a potential malware package
Calvin Hendryx-Parker: to your project right now.
Calvin Hendryx-Parker: I actually tried it out today.
Calvin Hendryx-Parker: I actually love that.
Calvin Hendryx-Parker: Yeah, that's really cool.
Calvin Hendryx-Parker: I literally did it today because I was like,
Calvin Hendryx-Parker: oh, I should go check out my last FastAPI project
Calvin Hendryx-Parker: to make sure I'm up to date on things.
Calvin Hendryx-Parker: And I ran the uv audit, again, super fast,
Calvin Hendryx-Parker: as you would expect most of the tools from Astral to be.
Calvin Hendryx-Parker: And I had my Pi coding agent go and fix all the problems.
Calvin Hendryx-Parker: And I released a new prod release just this morning
Calvin Hendryx-Parker: because of the uv audit tool.
Calvin Hendryx-Parker: It seems really, really nice.
Calvin Hendryx-Parker: I'm really excited about it.
Michael Kennedy: Awesome.
Michael Kennedy: I have been, I talked about it maybe six months ago or so,
Michael Kennedy: a couple of security things you can do for the supply chain vulnerability.
Michael Kennedy: And it's just super scary, right?
Michael Kennedy: Because you're just working normally on your projects.
Michael Kennedy: And if you time it wrong, well, bad things happen.
Michael Kennedy: And they have happened to people, right?
Michael Kennedy: Not in great numbers in the Python world, but still enough, you know,
Michael Kennedy: some of the LLM tools I can think of were pretty, that was a pretty bad one.
Calvin Hendryx-Parker: Well, we're paying attention now.
Calvin Hendryx-Parker: I think folks are hopefully paying more attention
Calvin Hendryx-Parker: and tools like this make it easier to pay attention
Calvin Hendryx-Parker: and less friction to be safe.
Calvin Hendryx-Parker: I think it's got options, for example,
Calvin Hendryx-Parker: not to install the latest version of a package.
Calvin Hendryx-Parker: Maybe you want to like a cool off period to say,
Calvin Hendryx-Parker: I think that was already built in to uv,
Calvin Hendryx-Parker: which does have a cool off period.
Calvin Hendryx-Parker: That's a smart thing to do.
Calvin Hendryx-Parker: You don't want the package that was released today
Calvin Hendryx-Parker: because it might have a vulnerability
Calvin Hendryx-Parker: from a supply chain attack in there.
Calvin Hendryx-Parker: And you want to make sure,
Calvin Hendryx-Parker: usually in a few days, those are shook out.
Calvin Hendryx-Parker: And so grabbing a seven day old version of it,
Calvin Hendryx-Parker: probably the safe thing to do, for example.
Michael Kennedy: Yeah, and that's what motivated me
Michael Kennedy: to start down that whole path of talking about those things.
Michael Kennedy: I'm like, oh, they just shipped no earlier than whatever it was.
Michael Kennedy: And so that was really excellent.
Michael Kennedy: And then I started using pip Audit as well
Michael Kennedy: and even like share how you bring that into like a Docker world.
Michael Kennedy: And that's great.
Michael Kennedy: I'm feeling like that needs to be, for me,
Michael Kennedy: updated to use uv Audit instead of pip Audit,
Michael Kennedy: which just because like one of the things I see on the screen
Michael Kennedy: is four to 10 times faster.
Calvin Hendryx-Parker: Everything else I'm doing with uv,
Michael Kennedy: but I just couldn't because it didn't support this, right?
Calvin Hendryx-Parker: There's an asterisk there.
Calvin Hendryx-Parker: PIP audit with a fully primed cache is probably about as fast.
Calvin Hendryx-Parker: But if you're going from a CI pipeline,
Calvin Hendryx-Parker: you're going to get the 4 to 10x speed up.
Calvin Hendryx-Parker: So those are the, again, creature comforts
Calvin Hendryx-Parker: that I believe the astral folks have brought to the game.
Calvin Hendryx-Parker: They've just said, we're going to be opinionated.
Calvin Hendryx-Parker: This is how we're going to do it.
Calvin Hendryx-Parker: And we're going to make it better for everybody, hopefully.
Calvin Hendryx-Parker: So if you like those opinions, it's good for you.
Calvin Hendryx-Parker: If you had other opinions, well, this is probably better.
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: Yes, exactly.
Michael Kennedy: So out in the audience, Mike.
Michael Kennedy: Hey, Mike.
Michael Kennedy: points out that this weekend's Miasma Hades attack is timely.
Michael Kennedy: I don't know about it, but okay.
Calvin Hendryx-Parker: I have to research it.
Calvin Hendryx-Parker: If you had a CI pipeline running on the weekend
Calvin Hendryx-Parker: and got that version over the weekend,
Calvin Hendryx-Parker: and these things always happen on a Friday late on a weekend
Calvin Hendryx-Parker: because no one's looking,
Calvin Hendryx-Parker: that's exactly the timing that these kind of things happen.
Calvin Hendryx-Parker: So make sure you've got that cool off period in there.
Michael Kennedy: Yeah, exactly.
Michael Kennedy: So I made the mistake of actually going on vacation for the weekend,
Michael Kennedy: and so I wasn't paying enough attention.
Michael Kennedy: So I got to research this.
Calvin Hendryx-Parker: Wait, you actually took a couple days off?
Michael Kennedy: Yeah.
Michael Kennedy: I sat by the ocean.
Michael Kennedy: It wasn't terrible.
Calvin Hendryx-Parker: Nice.
Michael Kennedy: All right.
Michael Kennedy: Let's talk about, I think this relates a little bit back to the supply chain, but not necessarily
Michael Kennedy: in a vulnerability way.
Michael Kennedy: You also mentioned your Pi coding agent.
Michael Kennedy: We need to speak about this a little bit.
Calvin Hendryx-Parker: Yeah, we should.
Michael Kennedy: Yeah, absolutely.
Michael Kennedy: This is going to have to be one of your whole topics sometime.
Michael Kennedy: But it seems to me like a lot of the projects that people depend upon have these very shallow dependencies.
Michael Kennedy: And by that, I mean, like, yeah, I'm sure I'm using this library that lets me give, I don't know, a zip code and it gives me the state back or something like that.
Michael Kennedy: Right. But I only call the one function.
Michael Kennedy: You know what I mean?
Michael Kennedy: would it be possible to just have some kind of coding agent
Michael Kennedy: or even you just write that into your project
Michael Kennedy: instead of adding maybe that dependency
Michael Kennedy: and three other dependencies it has,
Michael Kennedy: then you're worried about like cool down periods
Michael Kennedy: and supply chain and just like,
Michael Kennedy: oh, this one only works on 3.14.
Michael Kennedy: This one only works or lower
Michael Kennedy: and this other one only works in 3.15 and above.
Michael Kennedy: Like, what do I do?
Michael Kennedy: You know, those kinds of issues.
Michael Kennedy: So I want to highlight this article called
Michael Kennedy: HTTP GET requests with Python standard library.
Michael Kennedy: by Alex Chan. And so Alex basically says, there's been all this stuff going on with HTTPX. I'm going
Michael Kennedy: to talk about that at the end of the show a little bit more. But we've also got requests, we've got
Michael Kennedy: URLib, we've got NyQuest, which is a little bit like a modernized request compatible API. But,
Michael Kennedy: you know, built into the library, we've got URLib requests, could we just put the three or four
Michael Kennedy: functions that we want to write but turn that and just instead of having actually htpx or requests
Michael Kennedy: just have it use the built-ins right so build a little facade adapter layer on top of stuff that's
Calvin Hendryx-Parker: already there what do you think of that idea i think that's smart kind of a little bit of shift
Calvin Hendryx-Parker: left or first principles like if you don't need to bring along those whole packages you don't bring
Calvin Hendryx-Parker: along a lot of complexity frameworks are nice when they solve you know they usually do like an 80
Calvin Hendryx-Parker: kind of problem if you get a 10 kind of problem i wouldn't bring those kind of dependencies
Calvin Hendryx-Parker: into your project because now you're on the treadmill.
Calvin Hendryx-Parker: You've got to keep up with the release cycles
Calvin Hendryx-Parker: and security vulnerabilities, et cetera,
Calvin Hendryx-Parker: versus if you're controlling your own fate here
Calvin Hendryx-Parker: for just a couple little things you need,
Calvin Hendryx-Parker: it's probably cleaner and more explicit than implicit.
Michael Kennedy: You're just not subject to have to deal with
Michael Kennedy: all the stuff that goes with it, right?
Michael Kennedy: And put security aside, just the,
Michael Kennedy: they released a new version or they decided
Michael Kennedy: they were going to do a breaking change
Michael Kennedy: and that's probably worthwhile,
Michael Kennedy: but then you've got to deal with the breaking change.
Michael Kennedy: You know, like if the thing you're doing is not going to change really,
Michael Kennedy: and it's pretty straightforward,
Michael Kennedy: you could just ask Claude or Pyre or whatever,
Michael Kennedy: hey, see this thing, could you just give me the two functions I'm using?
Michael Kennedy: If there's enough foundational stuff in the standard library, right?
Michael Kennedy: So I think this is a pretty interesting thing for people to think through.
Michael Kennedy: I was going down this path.
Michael Kennedy: I'm like, this is pretty cool.
Michael Kennedy: What if I could just make, I think I use three functions from HTTPX.
Michael Kennedy: What if I could do this for HTTPX instead of the thing that they were basing theirs on?
Michael Kennedy: How hard would that be with a little bit of Claude help, right?
Michael Kennedy: And it turns out that the standard library's HTTP call stuff does not have any async support whatsoever.
Calvin Hendryx-Parker: I was going to ask if that was a thing.
Michael Kennedy: No, it's not.
Michael Kennedy: I'm like, wait, what are the use cases for asyncio?
Michael Kennedy: Database, HTTP, API.
Michael Kennedy: Hitting a network.
Michael Kennedy: Wait, it's had that since 3.4, I believe,
Michael Kennedy: is when async was in.
Michael Kennedy: And then async and await came in at 3.5.
Calvin Hendryx-Parker: Michael, you need to submit a PEP now.
Michael Kennedy: You know what?
Michael Kennedy: Very insightful thought.
Michael Kennedy: I actually wrote Brett Cannon a message about this.
Michael Kennedy: Said, hey, what would the steps to be actually submitting a PEP for this?
Michael Kennedy: And he sent me back some stuff.
Michael Kennedy: And Brett, I haven't had it just because I sent that message
Michael Kennedy: and went straight on vacation.
Michael Kennedy: I haven't had a chance to respond,
Michael Kennedy: but it looks like there's some work to be done.
Michael Kennedy: and research to be done.
Michael Kennedy: But I do think that that's a totally reasonable thing.
Michael Kennedy: And DBAPI itself also surely does not support async,
Michael Kennedy: but should, you know?
Calvin Hendryx-Parker: Like, I think there's a few really clear places.
Calvin Hendryx-Parker: Yeah, there's still some hard problems
Calvin Hendryx-Parker: left in the Python core.
Calvin Hendryx-Parker: Yeah, we thought it was all done.
Calvin Hendryx-Parker: It's not.
Calvin Hendryx-Parker: Yeah, yeah.
Calvin Hendryx-Parker: Although it is nice when you've got like HTTPX2
Calvin Hendryx-Parker: and you can just drop in and replace.
Michael Kennedy: Yep, exactly.
Michael Kennedy: Yeah.
Calvin Hendryx-Parker: Nice.
Michael Kennedy: Yeah, we talked about that from the Pydantic folks
Michael Kennedy: and we're going to talk about that some more.
Calvin Hendryx-Parker: Yep, yep, sounds good.
Michael Kennedy: All right, over to you, Calvin, for the next one.
Calvin Hendryx-Parker: So this one's a little bit of a double-edged mixed bag.
Calvin Hendryx-Parker: The bad host vulnerability is a critical vulnerability in Starlet, which is an ASCII framework,
Calvin Hendryx-Parker: underlies a lot of very popular projects right now that are, if you're doing MCP or if you're
Calvin Hendryx-Parker: doing FastAPI, it basically is kind of a core layer for the asynchronous HTTP traffic for
Calvin Hendryx-Parker: building an API server.
Calvin Hendryx-Parker: So this vulnerability was reported.
Calvin Hendryx-Parker: The community responded.
Calvin Hendryx-Parker: there was a little bit of a back and forth but I think that the exploit is trivial for example
Calvin Hendryx-Parker: injecting a single character into an HTTP host header can bypass path-based authentication now
Calvin Hendryx-Parker: there's this is where this gets a little more interesting is that maybe that's not a great
Calvin Hendryx-Parker: pattern for you to do which is path-based authentication that was kind of the pushback
Calvin Hendryx-Parker: from the Starlette maintainers which is this is not really a intended use case for Starlet
Calvin Hendryx-Parker: it is a vulnerability. It has been patched, has been fixed, but I believe they got a little bit of
Calvin Hendryx-Parker: a bum deal from the journalists who are covering it. So actually, in addition to this post here,
Calvin Hendryx-Parker: there's also the maintainer's perspective, which I thought was a very interesting view into both
Calvin Hendryx-Parker: sides of the situation. Not often do you get to see when there's a vulnerability or a CVE announced
Calvin Hendryx-Parker: that the maintainers get to kind of post their response. And I think they post the response
Calvin Hendryx-Parker: and it's well written, well thought out,
Calvin Hendryx-Parker: explaining why this is probably not something that's common.
Calvin Hendryx-Parker: Many people probably weren't as vulnerable
Calvin Hendryx-Parker: as they thought they might be,
Calvin Hendryx-Parker: but it would affect some really major projects.
Calvin Hendryx-Parker: And if major projects were doing a pattern
Calvin Hendryx-Parker: that was not originally intended
Calvin Hendryx-Parker: by the maintainers of Starlet,
Calvin Hendryx-Parker: then you end up in this bad spot.
Calvin Hendryx-Parker: And it could end up in remote code execution
Calvin Hendryx-Parker: as a worst case scenario or data exfiltration
Calvin Hendryx-Parker: that you weren't expecting because of this,
Calvin Hendryx-Parker: but it probably wasn't the way
Calvin Hendryx-Parker: you should be architecting your application.
Calvin Hendryx-Parker: They also got a little bit of a complaint against the Ars Technica reporter.
Calvin Hendryx-Parker: Basically, they asked really demanding questions and wanted an immediate response.
Calvin Hendryx-Parker: That's back here down at the bottom, which was kind of rude.
Calvin Hendryx-Parker: They were very demanding, and they only gave them, I don't know, hours, maybe an hour or
Calvin Hendryx-Parker: two notice that they were going to publish this article on the website.
Calvin Hendryx-Parker: And the website went on, the Ars Technica website went on to say that they had contacted
Calvin Hendryx-Parker: the maintainers but hadn't heard back.
Calvin Hendryx-Parker: There was no comment from the maintainers, which people can read into that how they want.
Calvin Hendryx-Parker: So I'm glad.
Calvin Hendryx-Parker: Yeah, it sounds really bad.
Michael Kennedy: Like Marcello is just going to go, ah, forget you.
Michael Kennedy: I have no comment, right?
Calvin Hendryx-Parker: Because these are open source maintainers who are doing this for the community.
Calvin Hendryx-Parker: They don't have a security team under the covers waiting to respond to journalists and security researchers.
Calvin Hendryx-Parker: I mean, they did work with the security researchers.
Calvin Hendryx-Parker: They did negotiate a shared disclosure or a mutual disclosure timeframe.
Calvin Hendryx-Parker: This ended up for the best for everyone involved, except how he got portrayed.
Calvin Hendryx-Parker: Now, luckily, I think folks in the comments stood up for Marcelo and the team.
Calvin Hendryx-Parker: So I think people in the community understand.
Calvin Hendryx-Parker: But someone who's just coming to that article on Ars Technica may think differently of that project.
Calvin Hendryx-Parker: And I think they should read this article as a response to that.
Calvin Hendryx-Parker: Very interesting.
Michael Kennedy: I generally enjoy reading Dan Gooden's work, and I like Ars Technica.
Michael Kennedy: Yeah, I was surprised.
Michael Kennedy: I was surprised.
Michael Kennedy: You can just see the incentives at play here.
Michael Kennedy: Like, hey, you got to do an article this week,
Michael Kennedy: or we got to be the first to publish on this.
Calvin Hendryx-Parker: Well, and I think because MCP servers were the prime target.
Calvin Hendryx-Parker: If you're running an MCP server,
Calvin Hendryx-Parker: you were probably using a Starlet-based framework under the covers.
Calvin Hendryx-Parker: And so a lot of credentials are stored in there.
Calvin Hendryx-Parker: And if they were slop-coded, vibe-coded versions of those servers out there,
Calvin Hendryx-Parker: they could have used a path-based protection like this.
Michael Kennedy: Sure.
Michael Kennedy: And probably, I don't know how it links back to FastMCP,
Michael Kennedy: but I think that's probably based on Starlet.
Calvin Hendryx-Parker: That's what I was thinking too.
Calvin Hendryx-Parker: I didn't go double check that though.
Michael Kennedy: Yeah, I will leave that as a exercise to the audience.
Calvin Hendryx-Parker: But I think it is.
Calvin Hendryx-Parker: These open source maintainers
Calvin Hendryx-Parker: are getting near daily security reports,
Calvin Hendryx-Parker: especially when you're seeing projects
Calvin Hendryx-Parker: like Mythos being released.
Calvin Hendryx-Parker: I think this volume is only going to increase.
Calvin Hendryx-Parker: So a lot of it's AI generated noise
Calvin Hendryx-Parker: and they have to be able to deal with it.
Calvin Hendryx-Parker: So you're seeing a lot of pushback
Calvin Hendryx-Parker: from the open source communities
Calvin Hendryx-Parker: against AI pull requests and security posts.
Michael Kennedy: Absolutely.
Michael Kennedy: Yep.
Michael Kennedy: We could go down that a lot, but let's instead.
Michael Kennedy: Yeah, yeah, yeah, I know.
Michael Kennedy: Let's talk about merges.
Michael Kennedy: Merges.
Michael Kennedy: Let's talk about merging.
Michael Kennedy: So are you an Alembic sort of person?
Michael Kennedy: Do you Alembic?
Michael Kennedy: Do you, SQLAlchemy is really the question.
Calvin Hendryx-Parker: I do, actually.
Calvin Hendryx-Parker: On that FastAPI project that I was mentioning from this morning,
Calvin Hendryx-Parker: I have Alembic in there.
Michael Kennedy: Okay, very interesting.
Michael Kennedy: Yeah, I think FastAPI, sorry.
Michael Kennedy: I think SQLAlchemy is pretty neat.
Michael Kennedy: And this project, you know, Julian Fianjo
Michael Kennedy: also does this quite a bit.
Michael Kennedy: So he is one of the founders of Mergeify,
Michael Kennedy: which is all about making sure that merges,
Michael Kennedy: PRs emerge faster.
Calvin Hendryx-Parker: That's good advice right there.
Calvin Hendryx-Parker: Stop breaking main.
Michael Kennedy: Exactly.
Michael Kennedy: Stop breaking main.
Michael Kennedy: It's a platform that allows you to handle merges better, right?
Michael Kennedy: So, but one of the problems,
Michael Kennedy: let me see, there we go.
Michael Kennedy: One of the problems they ran into is the way Alembic,
Michael Kennedy: so what is Alembic?
Michael Kennedy: Alembic is a system that allows different developers
Michael Kennedy: in production or Q&A or whatever
Michael Kennedy: to have an older version of the database,
Michael Kennedy: change the classes that map over to the ORM to the database,
Michael Kennedy: and then apply this automation to restructure or migrate the database
Michael Kennedy: such that it's now consistent with this new world, right?
Michael Kennedy: And the way it works is every change you make,
Michael Kennedy: you check in an up and a down set of changes,
Michael Kennedy: like add this column, delete this column, right?
Michael Kennedy: And so on, you know, like the up would be add a column
Michael Kennedy: and then the down would be delete the column.
Michael Kennedy: And there's this set of revisions that pile up for these projects.
Michael Kennedy: The problem is each revision says the one that came before me was some hash or something
Michael Kennedy: or another, right?
Michael Kennedy: And if two people create a PR off of the same base and that PR needs a migration in it,
Michael Kennedy: they both point back to the same one, but they really need to be done one and then the other,
Michael Kennedy: right?
Michael Kennedy: Like you need a linear chain of migrations, not some kind of complex hierarchy of migrations.
Michael Kennedy: And so that is a problem, right?
Michael Kennedy: And they saw that, Julian and all of them saw that a lot with their merging tools, right?
Michael Kennedy: So this project here called Alembic Git Revisions.
Michael Kennedy: So instead of using a, when you run an Alembic migrate or whatever, instead of having to just capture the back version, what it uses is Git history to figure out the orders of when those actual migrations landed in the migration series.
Michael Kennedy: And say, well, they look like they pointed the same one, but this one came in this time.
Michael Kennedy: And then the next one came in after that.
Calvin Hendryx-Parker: So is the blockchain craze officially over
Calvin Hendryx-Parker: that they didn't use blockchain to solve this?
Calvin Hendryx-Parker: Exactly.
Michael Kennedy: I think we should use BitTorrent and blockchain
Michael Kennedy: and all these things.
Michael Kennedy: So yeah, I think this is a pretty neat one.
Michael Kennedy: So I just want to give it a shout out.
Michael Kennedy: So if you use...
Michael Kennedy: That's smart.
Calvin Hendryx-Parker: That's totally smart.
Michael Kennedy: Why would we not do this?
Michael Kennedy: I know.
Michael Kennedy: This is quite new.
Michael Kennedy: You can see it's been updated seven hours ago.
Michael Kennedy: It's about a month old.
Michael Kennedy: I know four months old when the repo was created.
Michael Kennedy: I think probably it was released just very, very recently, right?
Michael Kennedy: So check it out.
Michael Kennedy: If this sounds like it's a problem that you have, here's a really nice fix for it.
Calvin Hendryx-Parker: Yeah.
Calvin Hendryx-Parker: I mean, just putting in place these good guardrails makes sense across our project.
Calvin Hendryx-Parker: So this almost should become the default behavior.
Michael Kennedy: Yeah.
Michael Kennedy: I mean, think of when, how old is SQLAlchemy?
Michael Kennedy: It's pretty old.
Michael Kennedy: And I don't mean that in a pejorative way.
Michael Kennedy: I'm just thinking.
Calvin Hendryx-Parker: No, no, no.
Calvin Hendryx-Parker: It's mature.
Calvin Hendryx-Parker: It's very mature.
Michael Kennedy: It's like saying, well, Jago's old.
Michael Kennedy: Like, Jacob's been around for a long time and is doing awesome stuff.
Michael Kennedy: But the reason I bring that up is it's just Alembic was created in a time before all these crazy PRs.
Michael Kennedy: And think of all the AI PRs going on now as well.
Michael Kennedy: It's got to be worse, you know?
Michael Kennedy: Yeah.
Michael Kennedy: Time for that stuff.
Michael Kennedy: All right.
Michael Kennedy: So if you Alembic, check out Alembic Get Revisions from Julian and the team.
Michael Kennedy: Smart.
Michael Kennedy: Very smart.
Michael Kennedy: Yeah, yeah.
Michael Kennedy: So I think that's it for all of our topics, right?
Michael Kennedy: Yeah, yeah.
Calvin Hendryx-Parker: I did want to add in a little bit of extra here.
Calvin Hendryx-Parker: If you've not checked it out, Library Skills is by Sebastian from the FastAPI project.
Calvin Hendryx-Parker: FastAPI has a great skill included with the library.
Calvin Hendryx-Parker: So if you're using agentic tools to build on top of FastAPI, your tools will now know
Calvin Hendryx-Parker: more about the preferred best practices in that framework because those skills exist in
Calvin Hendryx-Parker: the agents folder.
Calvin Hendryx-Parker: This Library Skills project is a standard and allows you to build out skills for any
Calvin Hendryx-Parker: library you may be using.
Calvin Hendryx-Parker: if you've been using agentic AI Claude Code or others to build your software projects,
Calvin Hendryx-Parker: sometimes they grab old dependencies because that was the popular thing at the time.
Calvin Hendryx-Parker: They go based on what was kind of popular on the internet versus what's the best practice now.
Calvin Hendryx-Parker: And so this helps guide your agents to those best practices.
Calvin Hendryx-Parker: So it's a cool project.
Calvin Hendryx-Parker: It's very, very new and also has a lot.
Calvin Hendryx-Parker: He's already almost a 600 stars.
Calvin Hendryx-Parker: So maybe after this episode, he'll get to pass 600 stars on the library skills repository.
Calvin Hendryx-Parker: Wow.
Calvin Hendryx-Parker: That's pretty cool.
Michael Kennedy: This is super cool.
Michael Kennedy: Well done, FastAPI team.
Calvin Hendryx-Parker: Yeah, I mean, they don't stop.
Calvin Hendryx-Parker: It's pretty cool.
Calvin Hendryx-Parker: So there you go.
Michael Kennedy: Yeah, it's really cool.
Michael Kennedy: And I think this is a brilliant idea.
Michael Kennedy: I actually been working on doing that just for myself
Michael Kennedy: because this is absolutely a problem.
Michael Kennedy: So I'm like, all right, I work on Court and Flask
Michael Kennedy: and I'm working on Pyramid and I use DiscCache.
Michael Kennedy: And some of these are popular, like FastAPI,
Michael Kennedy: but others, not very popular at all.
Michael Kennedy: So I've actually been, every project that I adopt that I think is going to be important for something like Claude is I'll go through and I'll generate this kind of document that says, here's all the stuff you need.
Michael Kennedy: And the way that I get it is I will git cloned the documentation, the latest documentation from the project and the source code until you generate this from the documentation.
Michael Kennedy: Everything you see in the documentation, you need to verify with the active source code of the project, right?
Michael Kennedy: But that's just Michael randomly working on it.
Michael Kennedy: It is on GitHub.
Michael Kennedy: You can check it out.
Michael Kennedy: But it's cool that they've set up this more standard way, right?
Michael Kennedy: That it's just not just everybody trying to solve it for themselves.
Calvin Hendryx-Parker: Yeah.
Calvin Hendryx-Parker: And it makes sense.
Calvin Hendryx-Parker: You want to have good, authoritative information on the versions of the things you're currently working on in your project.
Calvin Hendryx-Parker: Because you may have a version behind, and the AI may tell you a new thing that doesn't exist in your version, and you can't upgrade yet.
Calvin Hendryx-Parker: So again, it helps line up all the pieces and give you the best chance of building great software with these AI agents.
Michael Kennedy: I'm going to avoid a rant.
Michael Kennedy: But I definitely think that people who are not having great AI experiences need to think
Michael Kennedy: of bringing some of these ideas in there and all of a sudden hallucinations just go away.
Michael Kennedy: Go away.
Michael Kennedy: Yeah, it's incredible.
Calvin Hendryx-Parker: It's been told.
Michael Kennedy: Yeah.
Michael Kennedy: Mike asks, how does Django handle migration and serialization conflicts?
Michael Kennedy: I don't know.
Calvin Hendryx-Parker: Do you have any idea?
Calvin Hendryx-Parker: I don't know either off the top of my head.
Calvin Hendryx-Parker: I have not run into it much.
Calvin Hendryx-Parker: I'd have to ask someone on my team if they had.
Michael Kennedy: Yeah.
Michael Kennedy: It's probably pretty similar.
Calvin Hendryx-Parker: My guess is, yeah.
Calvin Hendryx-Parker: So is that all?
Michael Kennedy: It's pretty mature.
Calvin Hendryx-Parker: I have one more extra.
Calvin Hendryx-Parker: Yeah, yeah, let's do it.
Calvin Hendryx-Parker: So this one's a bit old school.
Calvin Hendryx-Parker: If you are a developer and you've ever used the GNU make command,
Calvin Hendryx-Parker: did you know that it has pattern matching on the targets?
Calvin Hendryx-Parker: So you can say train-percent colon and then have a command that runs
Calvin Hendryx-Parker: and it will place into your command like whatever you put in that percent word.
Calvin Hendryx-Parker: So if you said train new model and then the command,
Calvin Hendryx-Parker: it would be like train.py.
Calvin Hendryx-Parker: And then you put a placeholder and it would put new model right there into it for you.
Calvin Hendryx-Parker: That has been there since 1994.
Calvin Hendryx-Parker: Now, there are fancy new tools like Just and Task out there.
Calvin Hendryx-Parker: They don't do this.
Calvin Hendryx-Parker: This is actually, I think, a power move that I only heard about this week.
Calvin Hendryx-Parker: So check it out.
Calvin Hendryx-Parker: Make still very powerful and still very relevant in this day and age for doing task running.
Calvin Hendryx-Parker: We do use Just and Task, but those projects should add this pattern matching to the target.
Calvin Hendryx-Parker: That's really cool.
Michael Kennedy: Yeah, how interesting.
Michael Kennedy: There's just a never-ending source of learning in all these things, right?
Michael Kennedy: You're like, oh, yeah, I'll figure this out.
Michael Kennedy: No, maybe not.
Calvin Hendryx-Parker: And one more thing I want to mention,
Calvin Hendryx-Parker: because we didn't get to mention at the very beginning,
Calvin Hendryx-Parker: or something I want to pitch for everyone to come out and hang out with me.
Calvin Hendryx-Parker: I am going to be doing a LinkedIn Live with Whit Morris from the 6.15,
Calvin Hendryx-Parker: June 17th at 3.30 on, oh, right, it's not a code review.
Calvin Hendryx-Parker: I say, oh, you're right, it's not a code review.
Calvin Hendryx-Parker: What AI proves what it checked.
Calvin Hendryx-Parker: So basically calling the AI out.
Calvin Hendryx-Parker: We'll be doing that on the 17th.
Calvin Hendryx-Parker: So come hang out with me that day.
Calvin Hendryx-Parker: I mean, wit.
Michael Kennedy: You're absolutely right.
Michael Kennedy: That is not what it was supposed to do.
Michael Kennedy: Exactly.
Michael Kennedy: Let me try again.
Calvin Hendryx-Parker: Yeah, that's exactly it.
Michael Kennedy: All right.
Michael Kennedy: I got a couple of extras for us to jump on.
Michael Kennedy: So I had recently, I had both Michael Chow and Rich Ione on Talk Python to talk about great docs.
Michael Kennedy: Are you familiar with this?
Michael Kennedy: I'm not familiar with great docs.
Michael Kennedy: It's a document generator plus static site generator.
Michael Kennedy: That's super mature because it's based on Quarto, which itself is pretty mature, right?
Michael Kennedy: So I did my first project documentation on top of this, and I think it is really neat.
Michael Kennedy: So this is just, I'm showing you the great docs documentation, but I haven't published mine yet.
Michael Kennedy: I've got Nginx settings to set first, and then they'll be up.
Michael Kennedy: But this is really cool because the reason I wanted to highlight this is you're talking about the library stuff
Michael Kennedy: and how libraries can basically set up skills
Michael Kennedy: that AIs can use to work with that library, right?
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: Well, one of the things that's really cool about Great Docs
Michael Kennedy: is it automatically generates skills for your library.
Calvin Hendryx-Parker: Very relevant.
Michael Kennedy: And you can even write extra ones.
Michael Kennedy: And then you can just say install through like NPX skills from wherever
Michael Kennedy: or run their CLI to install it for like Clot or Codex or whatever,
Michael Kennedy: which is already neat.
Michael Kennedy: It also generates an LLMs and an LLMs.txt, but also a full one that has all the API documentation in there.
Michael Kennedy: And when you go to one of your references or whatever, you pull it up, you can go and view every bit of documentation as a markdown file that you can get.
Michael Kennedy: And so I'm thinking that this is going to become a pretty popular way to document projects because it's without doing anything at all.
Michael Kennedy: It's very sort of AI coding complete, I think you would say.
Michael Kennedy: What do you think of that?
Calvin Hendryx-Parker: I love it.
Calvin Hendryx-Parker: I mean, the more context we can provide to these agents and tooling, the better off we are.
Calvin Hendryx-Parker: And actually, the nicer it is for humans, too.
Calvin Hendryx-Parker: I love Markdown, like reading Markdown so much.
Calvin Hendryx-Parker: I find it to be very easy, and I can then format it how I want.
Calvin Hendryx-Parker: So it's kind of a twofer there.
Michael Kennedy: Yeah, 100%.
Michael Kennedy: Yeah.
Michael Kennedy: All right.
Michael Kennedy: So you mentioned HTTPX2.
Michael Kennedy: We talked about it previously on the show as well.
Michael Kennedy: And I looked at the Talk Python Courses site.
Michael Kennedy: And I thought, man, could I switch to HTTPX2?
Michael Kennedy: Like technically, yes, but what is the value of it?
Michael Kennedy: So I looked at my requirements file and I saw, well, there's five projects using HTTPX.
Michael Kennedy: So if I just switch mine to HTTPX2, like still I'm primarily using just HTTPX.
Michael Kennedy: So like if the libraries themselves don't swap over, no matter how much you don't, you want to use a different library, you're still using that one, right?
Michael Kennedy: Because you want to use those libraries.
Michael Kennedy: So I went through as well, let's walk the walk.
Michael Kennedy: So I went through my ListMonk one, my Umami one, a memberful one, and they all now are using HPX2.
Michael Kennedy: So if anybody uses those and they want to use HPX2.
Calvin Hendryx-Parker: You'll now get HPX2.
Michael Kennedy: Absolutely.
Michael Kennedy: Very nice.
Michael Kennedy: Well, how about we close this episode out with a joke?
Calvin Hendryx-Parker: All right.
Calvin Hendryx-Parker: What do you got for me, Michael?
Michael Kennedy: So I've named this one accurate.
Michael Kennedy: Tell me what you think about these different classifications of types of like problem solving.
Michael Kennedy: You know, maybe this is a CS sort of conversation.
Michael Kennedy: You know, we've got algorithms.
Michael Kennedy: This is when programmers don't want to explain what they did.
Calvin Hendryx-Parker: You'll get me every time with these kind of jokes.
Michael Kennedy: We have a heuristic, which is very interesting.
Michael Kennedy: Less common and less provable, but often very interesting.
Michael Kennedy: The heuristic is when programmers can't explain what they did.
Michael Kennedy: And then machine learning, when programmers don't know what they did.
Calvin Hendryx-Parker: Very black box.
Michael Kennedy: Exactly.
Michael Kennedy: And it won't do it again, but maybe it'll do something else also interesting.
Calvin Hendryx-Parker: I appreciate that.
Michael Kennedy: Yeah, absolutely.
Michael Kennedy: And I just also, Marco out of the audience just says,
Michael Kennedy: much appreciation for Posit's open source contributions.
Michael Kennedy: Yeah, so great docs is from the folks from Posit,
Michael Kennedy: the Shining, or Studio,
Michael Kennedy: but they're also doing like Shiny for Python,
Michael Kennedy: lots of Python stuff these days.
Michael Kennedy: Yeah.
Calvin Hendryx-Parker: Very nice.
Michael Kennedy: All right, well, that is a wrap, Calvin.
Michael Kennedy: That was fun.
Michael Kennedy: Thank you for being here.
Michael Kennedy: Awesome show with you.
Michael Kennedy: We'll do it again.
Michael Kennedy: We will.
Michael Kennedy: Thanks, Michael.
Michael Kennedy: Yep, bye, everyone.