WEBVTT 00:00:00.100 --> 00:00:04.220 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly 00:00:04.740 --> 00:00:13.980 to your earbuds. This is episode 464, recorded January 5th, 2026. Brian, it's 2026. Amazing. 00:00:14.600 --> 00:00:15.160 It is amazing. 00:00:15.560 --> 00:00:16.100 I'm Michael Kennedy. 00:00:16.480 --> 00:00:17.080 I'm Brian Okken. 00:00:17.400 --> 00:00:22.860 We're here to bring you another year of awesome Python news, and we've got a bunch of good ones 00:00:23.260 --> 00:00:27.699 queued up here. I've got a pretty interesting spy story to tell people, Brian. It's going to be 00:00:27.640 --> 00:00:32.439 very fun. Cool. Yes. If you're listening and you're not subscribed to the newsletter, you 00:00:32.560 --> 00:00:37.140 definitely should. It's super high quality. We put a lot of extra details, extra information, 00:00:37.420 --> 00:00:42.760 not just a emailing version of the show notes. Follow us on the socials. You'll find them on 00:00:43.100 --> 00:00:46.740 probably in the newsletter. I believe they're right there at the top, but also in the show notes. 00:00:47.420 --> 00:00:51.880 And yeah, with that, Brian, how would you like to kick things off for the new year? 00:00:52.400 --> 00:00:56.080 Ty, I think I'm pronouncing it Ty. I don't know how it's supposed to be. 00:00:56.100 --> 00:00:57.040 I've asked Charlie Marsh. 00:00:57.450 --> 00:00:57.940 No, it's ty. 00:00:58.440 --> 00:00:58.520 TY. 00:00:58.720 --> 00:00:59.080 It's ty. 00:00:59.550 --> 00:00:59.660 Okay. 00:00:59.780 --> 00:01:00.880 I believe because it's uv. 00:01:01.400 --> 00:01:01.500 TY. 00:01:01.800 --> 00:01:07.220 So now I'm starting to doubt myself, but when I interviewed him about ty, I asked, I'm pretty 00:01:07.220 --> 00:01:07.620 sure it's ty. 00:01:08.000 --> 00:01:08.820 Oh, that makes sense. 00:01:09.000 --> 00:01:10.160 UV and TY? 00:01:10.860 --> 00:01:11.300 TY. 00:01:11.670 --> 00:01:11.780 TY. 00:01:12.380 --> 00:01:12.820 Okay. 00:01:13.880 --> 00:01:20.260 It's an extreme, it says it is an extremely fast Python type checker and LSP, which is 00:01:20.580 --> 00:01:22.660 what a language server protocol. 00:01:23.290 --> 00:01:24.640 I don't know what LSP stands for. 00:01:24.730 --> 00:01:25.000 Do you? 00:01:25.860 --> 00:01:33.080 server protocol uh yeah lsp something yep anyway um it's okay so ty's been out for a while but the 00:01:33.110 --> 00:01:39.800 news as of december 16th is that it's um it's in beta um people have been playing with it for a 00:01:39.800 --> 00:01:46.040 while anyway but i thought um uh so we're gonna link to the uh charlie marsh's announcement of it 00:01:46.160 --> 00:01:52.100 but and this was going to actually to be clear this was going to be an extra um but um i was 00:01:52.120 --> 00:01:59.280 playing with it this weekend and i'm kind of in love i really like uh ty um so really fast type 00:01:59.460 --> 00:02:05.700 checker and language server and um and luckily this is not one where you you it's so fast that 00:02:05.700 --> 00:02:10.259 you say did it actually run because it actually prints something out when you when you run like 00:02:10.500 --> 00:02:16.819 tie check it'll it'll say yeah it even if every if it doesn't find anything it says like all done or 00:02:16.840 --> 00:02:23.160 or so thank you thank you to you astral to actually letting us know that it's finished but it is super 00:02:23.360 --> 00:02:33.140 fast so um type checking i i've used my pi before i think that's pronounced my pie and uh and pyrite 00:02:33.240 --> 00:02:39.900 i tried that and pilance um so actually i remember pilot pailance has been a while but i have tried 00:02:40.040 --> 00:02:44.820 pyrite and my pie because people have submitted issues with some of my projects to say hey these 00:02:44.840 --> 00:02:51.600 these throw problems with mypy can we fix this so we've had some fixes on like a py test check 00:02:51.630 --> 00:02:59.880 has been one project that we've made some changes however okay so installed ty this just the other 00:02:59.890 --> 00:03:08.460 day and yes it is super fast i didn't did i'm using expecting um in they have a graph that shows uh 00:03:08.780 --> 00:03:11.640 Oh, what are they typing? 00:03:12.000 --> 00:03:15.400 Oh, they checked home assistant project, which is a pretty big project. 00:03:15.980 --> 00:03:22.920 And my pie takes 45 seconds to run and ty takes two seconds. 00:03:23.660 --> 00:03:26.320 And I didn't have anything that large. 00:03:26.720 --> 00:03:30.220 It just ran instantly and spit out a ton of stuff. 00:03:30.510 --> 00:03:33.360 So I tried actually went back and tried a couple other projects. 00:03:33.920 --> 00:03:36.880 So here's another project running it. 00:03:37.260 --> 00:03:38.800 Let's see, in the Torch project. 00:03:39.120 --> 00:03:40.300 Oh, recompute. 00:03:40.380 --> 00:03:41.680 I'm getting ahead of myself. 00:03:42.220 --> 00:03:45.240 So it's really fast, but that's not the coolest part. 00:03:45.400 --> 00:03:47.980 The coolest part is it's really fast just the first time. 00:03:48.080 --> 00:03:50.680 And then it's even faster when you run it again, 00:03:51.140 --> 00:03:55.640 because they're doing regenerative stuff. 00:03:55.820 --> 00:03:58.720 So when you, after, what did they write down? 00:03:59.400 --> 00:04:03.160 It was designed from the ground up to be incremental. 00:04:03.760 --> 00:04:09.620 to have incrementality. I don't think that's a word guys, but, to incrementally, just, 00:04:10.040 --> 00:04:15.660 just check the things you've changed to make it faster. And the reason why is to try to get it 00:04:15.900 --> 00:04:22.200 running within your editor as well. So, yeah, so it's pretty, pretty fun. I actually ran it. 00:04:22.480 --> 00:04:27.900 So, like I said, I ran it on some small projects and it, it, a couple of things I'm like, 00:04:27.980 --> 00:04:33.720 why is it bugging me about this? But I just tried to fix the suggestions and I found that 00:04:33.740 --> 00:04:38.580 So it was making easier to read code, even though I didn't, some of the things I didn't 00:04:38.720 --> 00:04:40.400 quite get, like here's one that tripped me up. 00:04:40.720 --> 00:04:46.200 So if you, if you declare, if you've got a function with a input parameter and you declare 00:04:46.290 --> 00:04:49.060 the input type, I always think of that as like the input type. 00:04:49.110 --> 00:04:54.360 I expect the user to call this function with, but once I'm in the function, I can, I can 00:04:54.420 --> 00:04:55.260 like change the type. 00:04:55.330 --> 00:05:00.360 If I, it came in as a list of strings and I wanted to turn it into just a concatenated 00:05:00.600 --> 00:05:01.000 full string. 00:05:01.960 --> 00:05:04.020 That was actually the example I had. 00:05:04.380 --> 00:05:06.200 And it said, yeah, that's the wrong type. 00:05:06.380 --> 00:05:08.860 You said list of strings, but then you assigned it a string. 00:05:09.360 --> 00:05:14.420 And I'm like, well, okay, would it be more clear if I add a new variable? 00:05:14.700 --> 00:05:16.260 And I actually just tried to clean it up. 00:05:16.260 --> 00:05:17.880 And I'm like, yeah, this is easier to read, actually. 00:05:18.120 --> 00:05:18.900 It'll be better to maintain. 00:05:19.500 --> 00:05:24.660 So I'm trying to embrace the error messages as something that might make it easier to read, 00:05:24.750 --> 00:05:26.720 even and not become combative. 00:05:26.960 --> 00:05:33.500 But I tried installing, there's an extension that they released also to the ty extension for VS Code. 00:05:33.960 --> 00:05:36.060 And this does a ton of stuff. 00:05:36.780 --> 00:05:39.340 Inlay type hints, go to definition information. 00:05:40.620 --> 00:05:43.260 I'm pointing this out because I know people will try it out. 00:05:43.640 --> 00:05:51.380 But you'll have to be sure to read the documentation because there's a warning in there to say it's a language server also. 00:05:51.480 --> 00:05:55.400 So you need to either turn off the default language server 00:05:55.720 --> 00:05:58.020 or turn off TY's language server. 00:05:58.480 --> 00:06:00.320 Having two at the same time don't work great. 00:06:00.580 --> 00:06:03.920 So I'm super happy with the project so far, but yeah. 00:06:04.140 --> 00:06:04.460 That's cool. 00:06:04.710 --> 00:06:06.880 I definitely want to give the extension a try. 00:06:07.240 --> 00:06:10.240 I've been using PyRite as well, and it's also, sorry, PowerFly, 00:06:10.570 --> 00:06:13.720 all the PIs, PowerFly, and it has the same deal. 00:06:14.080 --> 00:06:17.920 You've got to go disable a bunch of stuff in the Visual Studio editors 00:06:18.500 --> 00:06:19.800 and, you know, like Cursor and others. 00:06:20.340 --> 00:06:22.080 And it's annoying that you got to do it. 00:06:22.080 --> 00:06:26.060 I feel like that is a fault of Visual Studio code. 00:06:26.520 --> 00:06:29.140 Why would it let you run two language servers for the same language? 00:06:29.900 --> 00:06:32.240 That should be like, which one do you want to use? 00:06:32.880 --> 00:06:33.600 Just tell me, right? 00:06:33.680 --> 00:06:34.940 I detected that two are running. 00:06:35.440 --> 00:06:37.220 It's kind of the nature of Visual Studio 00:06:37.440 --> 00:06:39.820 being just composed out of a bunch of disjointed things. 00:06:41.260 --> 00:06:42.720 But once you get it set up, it's super nice. 00:06:42.960 --> 00:06:43.560 I totally agree. 00:06:44.120 --> 00:06:46.839 One thing I wanted to bring up that I haven't yet also 00:06:46.860 --> 00:06:50.520 is when I ran it on pytestCheck, it ran it like, 00:06:50.780 --> 00:06:52.700 and actually I've known that the pytestCheck 00:06:52.720 --> 00:06:55.940 is kind of a fun plugin, but it has some, 00:06:56.260 --> 00:06:58.000 like I'm hacking Python with this. 00:06:58.180 --> 00:06:59.680 I'm like overloading a bunch of stuff 00:07:00.180 --> 00:07:03.840 and a package that's also a context manager 00:07:04.060 --> 00:07:04.600 and stuff like that. 00:07:05.400 --> 00:07:08.880 I do plan on like, it's noting a whole bunch of errors 00:07:09.120 --> 00:07:10.260 and I do want to fix all those 00:07:10.340 --> 00:07:12.100 that just have a lot of other stuff going on. 00:07:12.780 --> 00:07:15.840 And so I'm not like a really, 00:07:16.160 --> 00:07:18.160 I didn't intend for this to be an apology. 00:07:18.600 --> 00:07:21.300 What I'm meaning is when I go to check these, 00:07:22.340 --> 00:07:23.760 TY has a whole bunch of settings. 00:07:23.920 --> 00:07:25.240 You can turn off any check. 00:07:25.660 --> 00:07:26.740 So that's what I think I'll do. 00:07:26.840 --> 00:07:28.880 I'll probably like any of them that are failing, 00:07:29.320 --> 00:07:30.280 I'll probably turn them off 00:07:30.580 --> 00:07:33.040 and then fix them one at a time and go through. 00:07:33.280 --> 00:07:35.060 And I like that they just said, 00:07:35.360 --> 00:07:35.780 you know what? 00:07:35.980 --> 00:07:37.900 People might want to like turn any of these off. 00:07:38.060 --> 00:07:40.380 So we'll just give you access to all of them. 00:07:40.580 --> 00:07:41.760 So yeah, that's very cool. 00:07:42.100 --> 00:07:44.300 I'd like to throw out one more thing about the fast, 00:07:44.420 --> 00:07:46.060 like, well, my editor's fast enough. 00:07:46.180 --> 00:07:47.200 I don't really care, right? 00:07:47.320 --> 00:07:49.900 Or what's it matter if it takes 20 seconds 00:07:50.220 --> 00:07:51.180 for Pyright to run? 00:07:51.740 --> 00:07:53.360 One of the things that you can do with these 00:07:53.580 --> 00:07:54.860 that I don't think a lot of people are doing, 00:07:55.220 --> 00:07:57.280 but you can tell, you can set up rules 00:07:57.480 --> 00:07:59.040 and tell your agentic coding tools, 00:07:59.240 --> 00:08:00.800 like whenever you make a change, 00:08:01.200 --> 00:08:03.740 please run ty or Pyright or whatever 00:08:04.260 --> 00:08:05.680 against my code base 00:08:05.980 --> 00:08:08.260 and verify that you haven't made any typing mistakes. 00:08:08.860 --> 00:08:10.060 Everything's hanging together, right? 00:08:10.360 --> 00:08:12.500 And those tools will do that like over and over 00:08:13.100 --> 00:08:15.240 and it can just make it super slow, right? 00:08:15.540 --> 00:08:17.000 So you're not sitting there waiting 00:08:17.500 --> 00:08:18.920 for the thing to run and run, you know, 00:08:19.180 --> 00:08:22.400 just reanalyze, reanalyze, just tell it to use TY 00:08:22.510 --> 00:08:24.000 and it'll just be nearly instant. 00:08:24.100 --> 00:08:24.880 Nope, it's fine. 00:08:25.040 --> 00:08:26.080 Oh, I got to fix something, right? 00:08:26.260 --> 00:08:27.460 So one more use case here. 00:08:27.680 --> 00:08:30.280 Yeah, and like we said, since it's incremental, 00:08:30.620 --> 00:08:32.640 it'll be like milliseconds to rerun it. 00:08:32.840 --> 00:08:33.260 Yeah, exactly. 00:08:33.919 --> 00:08:34.580 Exactly, super cool. 00:08:35.000 --> 00:08:39.500 All right, I have a scary story for you, Brian. 00:08:39.820 --> 00:08:40.060 Okay. 00:08:40.159 --> 00:08:49.080 So I want to talk about a pair of articles I wrote, and I think they're very, very constructive, very helpful for people to use. 00:08:49.540 --> 00:08:56.220 So increasingly in open source, we're dealing with issues around supply chain problems, right? 00:08:56.600 --> 00:09:06.400 This first surfaced most prominently with typosquatting, and I'm sure people have heard of that word by now, but it's like Django without the J or whatever. 00:09:06.560 --> 00:09:15.420 And if people don't really know and they type, you know, pip install dango or whatever, it might go and find nothing and say that's there. 00:09:15.610 --> 00:09:22.400 Or it might find something that someone put up there to look like Django, but also bring down some kind of malicious badness, right? 00:09:22.680 --> 00:09:23.440 And that's a problem. 00:09:23.880 --> 00:09:24.880 You can fix it by being careful. 00:09:25.420 --> 00:09:31.760 The PyPI folks are doing a lot of work to fight that and to like preserve misspellings of common, common things. 00:09:32.030 --> 00:09:33.380 But it's still, it's an issue, right? 00:09:33.660 --> 00:09:44.460 I mean, it's gone so far that there are people trying to see what agent encoding and LLMs would recommend because sometimes they would make up package names and then they would go put stuff there. 00:09:44.980 --> 00:09:49.040 So that when the next time it recommends that non-existing thing, it actually exists as a virus. 00:09:49.420 --> 00:09:49.540 Right. 00:09:49.640 --> 00:09:50.180 So you got to be careful. 00:09:50.800 --> 00:10:07.680 But way more serious than that is there was some announcements that some folks had been phished who worked on some project and their PyPI credentials were hacked and their projects were replaced with lookalike projects, but that also had bad things in it, right? 00:10:07.680 --> 00:10:08.780 And that's way worse. 00:10:09.140 --> 00:10:21.980 So if I use some library and it uses a library, which itself uses a less known library way down the chain and that third level gets hacked and I pip install the new version of my library, I'm toast. 00:10:22.490 --> 00:10:25.480 Right. And it's not because I misspelled something and nobody misspelled anything. 00:10:25.940 --> 00:10:30.400 It's because somewhere along the way, somebody's computer got taken over in some way. 00:10:30.710 --> 00:10:31.780 Off it goes. This is bad. 00:10:32.080 --> 00:10:34.880 So I thought I was thinking about this over winter break. 00:10:34.990 --> 00:10:36.180 I'm like, well, what can we do about it? 00:10:36.300 --> 00:10:39.200 So I wrote two articles with concrete advice. 00:10:39.800 --> 00:10:42.320 First one, Python supply chain made easy, right? 00:10:42.620 --> 00:10:43.220 And what are you going to do? 00:10:43.220 --> 00:10:44.160 I gave out some examples. 00:10:44.840 --> 00:10:45.680 So here's the thing. 00:10:46.060 --> 00:10:48.820 We have this tool called pip Audit, right? 00:10:49.120 --> 00:10:49.940 Pip Audit is cool. 00:10:50.120 --> 00:10:51.300 It audits Python environments. 00:10:51.580 --> 00:10:52.880 It's officially part of the PyPA. 00:10:53.460 --> 00:10:54.880 It's under their GitHub organization, 00:10:55.510 --> 00:10:57.160 even though it's Trellabits and Google 00:10:57.340 --> 00:10:58.960 have also had influence on it. 00:10:59.240 --> 00:11:01.580 It audits Python environments, requirement files, 00:11:01.880 --> 00:11:04.080 and dependency trees for known security vulnerabilities, 00:11:04.860 --> 00:11:05.840 and it can even fix them. 00:11:05.960 --> 00:11:08.140 I don't care about fixing them because it may be too late. 00:11:08.190 --> 00:11:09.100 I just want that to not happen. 00:11:09.390 --> 00:11:12.900 So what I was thinking is like, well, how do we use that tool? 00:11:13.320 --> 00:11:14.640 And how do we use UV? 00:11:15.300 --> 00:11:19.300 So one thing you can do is with pip audit is you can just say this virtual environment, 00:11:19.580 --> 00:11:21.120 everything installed in here, how's it looking? 00:11:21.520 --> 00:11:23.500 Is it bad or is it not bad, right? 00:11:23.840 --> 00:11:25.560 And you can just uv tool install it. 00:11:25.680 --> 00:11:28.680 So because it doesn't have to be installed in your local environment, not necessarily, 00:11:28.980 --> 00:11:29.080 right? 00:11:29.310 --> 00:11:31.140 You just have that active when you run it. 00:11:31.270 --> 00:11:32.040 So that's pretty cool. 00:11:33.480 --> 00:11:35.880 But what if people don't run it? 00:11:36.360 --> 00:11:42.020 you know like this is always the problem is like I set up this thing this um this way to lint code 00:11:42.020 --> 00:11:45.380 or format it to make sure we always do it right but then there's those people that just don't run 00:11:45.390 --> 00:11:52.300 it right so one thing you can do this nice is I created a unit test py test test which will run 00:11:52.960 --> 00:11:58.780 pip audit on wherever py test is running so like your application is being tested it will also run 00:11:58.950 --> 00:12:04.799 pip audit against that so that's cool it just does a sub process figures out which version of python 00:12:04.820 --> 00:12:06.780 on it is, and then it just runs pip on it. 00:12:06.790 --> 00:12:08.780 For this to work, you've got to actually have it installed 00:12:09.240 --> 00:12:10.340 as part of the virtual environment. 00:12:10.480 --> 00:12:11.460 But that's all good, right? 00:12:11.700 --> 00:12:16.520 So then it will just look at all the stuff you've got installed, 00:12:16.880 --> 00:12:19.900 and your test will fail, which means your CI will fail 00:12:20.290 --> 00:12:21.860 if some kind of vulnerable thing gets in there. 00:12:22.140 --> 00:12:22.700 That's pretty cool. 00:12:22.900 --> 00:12:23.540 Yeah, pretty nice. 00:12:23.680 --> 00:12:25.760 So people can just grab this test and drop it in, 00:12:25.960 --> 00:12:27.200 and there's really not much to it. 00:12:27.520 --> 00:12:27.940 And you run it. 00:12:28.000 --> 00:12:29.060 It's cool. 00:12:29.480 --> 00:12:32.640 Also, you could-- I mean, you could set it up as a git commit 00:12:32.820 --> 00:12:34.040 hook, but it's a little bit slow. 00:12:34.400 --> 00:12:39.020 So next thing you can do is very often something like this will happen. 00:12:39.480 --> 00:12:41.980 A couple of days later, people are like, why is my CPU at a hundred percent? 00:12:42.819 --> 00:12:45.920 And why is it this project I'm working on? 00:12:46.180 --> 00:12:48.000 You know, it'll get discovered, right? 00:12:48.080 --> 00:12:49.440 And these things get ganked pretty quickly. 00:12:49.580 --> 00:12:52.280 That's kind of the positive side is they don't typically last. 00:12:52.560 --> 00:12:56.060 So the other thing you can do was with uv, as you can say, 00:12:56.580 --> 00:13:01.020 UV pip compile or uv sync --upgrade, 00:13:01.180 --> 00:13:05.320 I think is the command for the uv lock file version. 00:13:05.670 --> 00:13:09.980 But regardless, you can always pass a exclude newer than, 00:13:10.510 --> 00:13:13.040 just dash, dash, exclude, dash newer, some timeframe. 00:13:13.410 --> 00:13:14.560 So I chose one week. 00:13:14.960 --> 00:13:16.060 And what that means is, 00:13:16.060 --> 00:13:19.960 if when I say update my requirements in the pinned lock file, 00:13:20.380 --> 00:13:24.120 it will basically pretend anything released in the last week 00:13:24.720 --> 00:13:27.300 doesn't exist and only update them to a week ago. 00:13:27.630 --> 00:13:29.680 That way, because the problem is, 00:13:30.100 --> 00:13:34.660 PipAudit can know that there's a bad one, but if it was released 10 minutes ago, PipAudit, 00:13:34.720 --> 00:13:39.560 no one's going to have reported it and formalized it, right? There's this window in the really early 00:13:39.760 --> 00:13:43.980 days of a package being updated that no one's going to catch it and get it into the ecosystem 00:13:44.040 --> 00:13:49.700 in time, right? And so just having a little bit of time, like let other people try this project 00:13:49.820 --> 00:13:55.219 for a week. If no one freaks out and says, oh my gosh, it's taking over the world, it's more likely 00:13:55.240 --> 00:14:00.900 to be okay, right? Yeah, sure. I mean, look, it's not a complete defense. It's not like, well, 00:14:00.940 --> 00:14:05.280 if it's a week or older, it's never going to be a problem. But almost all of these that are big 00:14:05.420 --> 00:14:09.880 problems are discovered within a week or, you know, put a month, whatever you put a year, like 00:14:10.060 --> 00:14:14.480 whatever you feel is like enough that it's very unlikely you're going to get tied up in it. Right. 00:14:14.680 --> 00:14:19.360 We can put whatever number you want, but the point is you can put a delay. So whenever you say update 00:14:19.500 --> 00:14:23.699 my dependencies, it says, but not the very, very, very new ones. And I've been doing that for a 00:14:23.640 --> 00:14:27.520 and it's been fine for a while. I mean like a week and a half. But I thought, okay, well, what about, 00:14:28.000 --> 00:14:32.260 this is all well and good if you have CI, but what about production? What if you're doing like 00:14:32.860 --> 00:14:39.920 DevOps with Docker or stuff? Also, if you run your pip audit and it tells you that you have a virus 00:14:40.180 --> 00:14:45.460 you've pip installed into your dev machine, too late. Once you've installed a virus, like it could 00:14:45.460 --> 00:14:50.499 have downloaded stuff off the internet. It could put root kits, like you're done, right? That machine 00:14:50.520 --> 00:14:55.120 probably needs formatted. It's very bad. So is there a way that we could do this before we put 00:14:55.120 --> 00:15:01.420 it into our computer with pipaudit, right? You can, under some circumstances, give it like a 00:15:01.600 --> 00:15:05.340 requirements file, but I think a better way is to just install stuff into a virtual environment. 00:15:05.880 --> 00:15:13.359 So I did a follow-up thing here that says, here's how you create a Docker instance that can copy 00:15:13.500 --> 00:15:20.900 whatever lock file you have into your temporary Docker container, install the requirements with 00:15:21.000 --> 00:15:25.940 UV, run pip audit on it, and then give you an answer back. That way, even if it does find something, 00:15:26.440 --> 00:15:32.660 it finds them over there, not in your computer, but in an isolated Docker environment, which should 00:15:32.660 --> 00:15:37.180 be safe. So it talks to you that, which is pretty cool. I'll give you a little Docker file that works 00:15:37.550 --> 00:15:41.959 nice and easy. You can do whatever you want, create an alias so that it'll run with nice 00:15:41.980 --> 00:15:44.040 reporting, you can skip things you don't care about. 00:15:44.170 --> 00:15:51.320 Like this PDF library on Windows, if you give it a SVG file, image file, it has a vulnerability. 00:15:51.450 --> 00:15:53.100 I'm like, well, one, I'm not running on Windows. 00:15:53.960 --> 00:15:55.280 I'm not giving it user input. 00:15:55.430 --> 00:15:58.080 Like I don't care about, like I just, that's not a problem to me. 00:15:58.180 --> 00:16:00.060 No, there's certain things you might want to just ignore. 00:16:00.480 --> 00:16:06.839 And then finally, you can put, I'll show you how to use like super good build time caching 00:16:06.840 --> 00:16:10.920 to actually run as part of your Docker build pip audit 00:16:11.260 --> 00:16:13.520 so that you can't even build a container 00:16:13.720 --> 00:16:14.520 that has a vulnerability. 00:16:14.860 --> 00:16:16.320 Like it will fail the Docker build 00:16:16.630 --> 00:16:18.300 if it has a problem, according to pip audit. 00:16:18.580 --> 00:16:20.100 I mean, for some definition of a problem. 00:16:20.360 --> 00:16:20.500 Yeah. 00:16:20.820 --> 00:16:24.120 So that whole series I wrote over winter break, 00:16:24.260 --> 00:16:25.240 and I think it'll help people. 00:16:25.640 --> 00:16:26.500 Super easy to adopt. 00:16:26.620 --> 00:16:27.340 There's not much to it. 00:16:27.580 --> 00:16:29.180 If you're using Docker, it's got good things for that. 00:16:29.280 --> 00:16:31.680 If you're not, it also has things you can adopt. 00:16:32.520 --> 00:16:34.260 I'm curious with the, yeah, 00:16:34.700 --> 00:16:46.580 On this topic of dependencies and stuff and possible vulnerabilities, I was trying to remember the name of the word, but basically if you take some other project and just copy its source into yours. 00:16:47.680 --> 00:16:48.220 Vendoring. 00:16:48.620 --> 00:16:49.660 Vendoring, that's it. 00:16:50.700 --> 00:17:04.459 I'm just wondering if that's going to happen more often for production projects because you could have something automatically or have an agent or something checked to see if there's any updates in the project. 00:17:04.600 --> 00:17:05.900 and copy them in and test them. 00:17:06.260 --> 00:17:07.660 Yeah, I think that's going to happen a lot, 00:17:07.939 --> 00:17:09.040 especially for small libraries. 00:17:09.329 --> 00:17:11.480 Like, oh, this one just adds color to your output. 00:17:11.660 --> 00:17:13.060 You're like, hmm, do I really need, 00:17:13.310 --> 00:17:14.959 like how often is that going to change? 00:17:15.140 --> 00:17:15.740 Probably never. 00:17:16.160 --> 00:17:16.420 Yeah. 00:17:16.680 --> 00:17:20.180 Do I need to be subjected to a supply chain story 00:17:20.569 --> 00:17:21.780 or could I just copy it in? 00:17:22.530 --> 00:17:24.280 Or with the agent encoding things, 00:17:24.350 --> 00:17:26.040 you're like, I really just need these two functions. 00:17:26.560 --> 00:17:27.900 Can I just ask it to write these functions? 00:17:28.069 --> 00:17:30.600 And if they're working, like I don't need a library at all. 00:17:30.980 --> 00:17:32.720 You know, I agree 100%. 00:17:32.900 --> 00:17:33.600 I think so. 00:17:34.040 --> 00:17:34.200 Okay. 00:17:34.940 --> 00:17:40.680 I'm going to actually talk about main updates as well in a different sense, I guess. 00:17:41.580 --> 00:17:44.440 So I want to talk about typing extensions. 00:17:44.900 --> 00:17:49.580 And again, this comes out of a suggestion from a listener. 00:17:50.080 --> 00:17:55.040 It was going to be just an extra, but I started using it and it's pretty cool. 00:17:55.400 --> 00:18:00.340 So in December, we were talking about, or I was talking about at least, 00:18:00.460 --> 00:18:06.480 deprecation warnings and the topic of how do you deal with that of deprecated items. 00:18:06.880 --> 00:18:13.880 And one recommendation is, was the deprecated, using the deprecated decorator. 00:18:14.340 --> 00:18:19.080 So you could say warnings import from warnings, import deprecated, 00:18:19.460 --> 00:18:21.200 and decorate a deprecated function. 00:18:21.760 --> 00:18:25.580 However, we were reminded that that's Python 3.13 only. 00:18:26.560 --> 00:18:32.500 Somebody named PrioInv on Mastodon notified us and said, hey, there's the typing extensions 00:18:32.900 --> 00:18:33.560 and they have them. 00:18:33.980 --> 00:18:35.860 And so I was checking this out. 00:18:35.940 --> 00:18:38.540 So the typing extensions, let's see, deprecated. 00:18:40.300 --> 00:18:43.420 We could just say, get it from typing extensions. 00:18:43.880 --> 00:18:46.860 And now we've got it on earlier versions of Python. 00:18:47.220 --> 00:18:53.800 I haven't, like, I don't know if this is a, okay, I'll save my comments, a couple of 00:18:53.800 --> 00:18:54.460 comments for the end. 00:18:54.640 --> 00:18:56.440 But I'm pretty excited about this. 00:18:56.600 --> 00:19:02.420 So I'm hoping that I can just use like the modern type, 00:19:02.830 --> 00:19:05.120 modern typing for different projects. 00:19:05.420 --> 00:19:06.780 And like, why is this important? 00:19:06.960 --> 00:19:08.660 It's important because me as a developer, 00:19:09.160 --> 00:19:12.700 I can kind of remember how to do typing in one version of Python. 00:19:12.850 --> 00:19:14.400 But if I'm trying to remember, 00:19:14.450 --> 00:19:20.460 well, what typing decorators and all that stuff do I use for 3.12 00:19:20.570 --> 00:19:22.320 versus 3.13 versus 3.14? 00:19:23.110 --> 00:19:24.380 And that's hard to keep a track. 00:19:24.660 --> 00:19:27.880 So I'm excited to start using typing extensions. 00:19:28.520 --> 00:19:31.560 And hopefully this cures the trying to keep track of it all. 00:19:31.900 --> 00:19:32.600 So of it. 00:19:32.880 --> 00:19:34.860 So there's a whole bunch of stuff in here. 00:19:34.860 --> 00:19:42.500 We've got, it's got typing primitives, protocols, decorators, functions, enums, pure aliases, 00:19:43.500 --> 00:19:48.220 all sorts of stuff that, and it tells you when things were added and all that. 00:19:48.410 --> 00:19:50.520 So anyway, kind of fun. 00:19:50.640 --> 00:19:50.860 Okay. 00:19:51.260 --> 00:19:51.880 Yeah, that's very nice. 00:19:52.300 --> 00:19:57.380 So hopefully I can get away with just using the deprecated wrapper, even in 3.12. 00:19:58.340 --> 00:20:03.680 So because I mean, like, come on, everybody's got like a project that uses a new, the newest 00:20:03.900 --> 00:20:05.240 because it's my side project. 00:20:05.500 --> 00:20:06.520 It's using the newest version. 00:20:06.940 --> 00:20:13.300 Or I've got a library that I'm supporting that's supporting everything back to 3.12 maybe 00:20:13.360 --> 00:20:15.000 or 3.8 or 3.9 or whatever. 00:20:15.380 --> 00:20:18.960 And then a work project that's using 3.13, stuff like that. 00:20:19.560 --> 00:20:24.700 Yeah, I got a message from somebody saying, what am I open source little smaller libraries? 00:20:25.100 --> 00:20:25.980 They can't get it to work. 00:20:26.080 --> 00:20:28.060 They can't get it to install or something. 00:20:28.679 --> 00:20:31.680 And I'm like, hmm, can't really see what the problem is. 00:20:32.040 --> 00:20:37.740 Oh, you're using 3.9 and it's using some feature of 3.10 and it says it needs 3.10. 00:20:37.880 --> 00:20:38.840 They're like, why doesn't this work? 00:20:38.920 --> 00:20:43.380 I'm like, literally, it sounds new, but that is no longer supported at all. 00:20:44.419 --> 00:20:47.660 It's easy for these to sound like, ah, 3.9 is not that old. 00:20:47.740 --> 00:20:51.580 But it's out of even the bug fixes and security fixes. 00:20:52.040 --> 00:20:54.820 Yeah, so people remember to do a min version 00:20:55.100 --> 00:20:58.940 in your PyProject.toml if you're doing a library 00:20:59.180 --> 00:21:01.440 that other people install so that it just doesn't even 00:21:01.900 --> 00:21:02.680 update to that version. 00:21:02.940 --> 00:21:03.360 Exactly. 00:21:03.860 --> 00:21:04.380 That's what I did. 00:21:04.840 --> 00:21:07.480 But there was not a fallbacks older version they could use, 00:21:07.860 --> 00:21:11.440 because it uses types that are not available, 00:21:11.680 --> 00:21:14.300 like the lowercase d dict of string string 00:21:14.400 --> 00:21:15.040 or something like that. 00:21:15.460 --> 00:21:15.960 Oh, yeah. 00:21:16.480 --> 00:21:16.640 Right. 00:21:17.300 --> 00:21:19.960 Who wants to go back to importing uppercase dict? 00:21:20.170 --> 00:21:20.860 I don't want to do that. 00:21:21.200 --> 00:21:21.460 Exactly. 00:21:21.960 --> 00:21:23.540 I'm like, I will do it when he needs support. 00:21:23.720 --> 00:21:25.760 But like, if it's literally out of support, I'm sorry. 00:21:25.940 --> 00:21:30.040 This is not on me to like make my library work on, you know, as far back as history goes. 00:21:30.400 --> 00:21:30.620 All right. 00:21:31.340 --> 00:21:33.560 Let's talk about my spy story. 00:21:34.100 --> 00:21:34.380 Okay. 00:21:34.750 --> 00:21:35.800 So this is a real short one. 00:21:35.930 --> 00:21:36.880 My first one was really long. 00:21:36.960 --> 00:21:37.560 This one's really short. 00:21:38.040 --> 00:21:43.560 New MI6 chief Blaze Metroeli outlined her vision for a technologically, 00:21:45.560 --> 00:21:50.580 augmented intelligence gathering in her first public speech on December 15th, 00:21:50.760 --> 00:21:53.640 warning that the UK operates in a space between peace and war. 00:21:53.820 --> 00:21:56.140 I mean, MI6, come on, James Bond, pretty cool. 00:21:56.760 --> 00:22:01.920 At the Tameside headquarters, she said previously the UK, 00:22:02.200 --> 00:22:05.260 she was previously in charge of Q, which is kind of cool. 00:22:05.400 --> 00:22:08.120 Anyway, said the headline is, 00:22:08.900 --> 00:22:15.280