Description

Topics covered in this episode:

• Python 3.12.14, 3.11.16, 3.10.21 - security releases
• Codeberg’s AI-code ban tests its role as a GitHub alternative
• Brett Cannon: what's missing for reproducible builds on PyPI
• • nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata.
• • recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2.
• Extra extra extra, hear all about it
• Extras
• Joke

Sponsored by Logfire from Pydantic pythonbytes.fm/logfire

This episode is brought to you by Pydantic Logfire. It's observability for AI apps from the team behind Pydantic - agents, LLMs, APIs, database, and infrastructure in a single trace, queried with Postgres-compatible SQL. Your coding agent can query it too, through their MCP server. I'll tell you more later.

Connect with the hosts

• Michael: Mastodon / BlueSky / X / LinkedIn
• Calvin: Mastodon / BlueSky / X / LinkedIn
• Show: Mastodon / BlueSky / X
• 
  Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Calvin #1: Python 3.12.14, 3.11.16, 3.10.21 - security releases

https://blog.python.org/2026/08/python-31214-31116-31021/

• Source-only security releases for the three branches now in security-fix-only mode; release team blamed the European solar eclipse for the timing.
• tarfile hardening. Multiple path-traversal bypasses of the data filter closed, including a symlink escape that bypassed the CVE-2025-4330 fix; extract() now applies the filter to link targets too.
• Four fresh CVEs: CVE-2026-2297 (SourcelessFileLoader not using io.open_code() for .pyc), CVE-2026-4224 (expat crash on deeply nested content models), CVE-2026-3644 (control chars in http.cookies.Morsel), plus the completed CVE-2021-4189 fix in ftplib.ftpcp.
• Quadratic-complexity DoS cleanup across the stdlib: HTMLParser, configparser regexes, unicodedata.normalize(), csv.Sniffer.sniff(), and ElementTree XPath index predicates.
• Header/injection fixes: CR/LF rejected in HTTPConnection.set_tunnel(), control chars blocked in wsgiref.handlers status, and webbrowser now rejects leading dashes (plus a %action prefix bypass).
• http.client now caps chunked trailer lines and 1xx interim responses at 100 each - a hostile server could previously hang the client forever despite a socket timeout.
• Memory-safety odds and ends: stale pointers in lzma/bz2/zlib decompressors after MemoryError, a bz2 stack overflow on reuse-after-error, and bundled libexpat bumped to 2.8.3.
  If you're still on 3.10, 3.11, or 3.12 - and you extract tarballs from anywhere you don't fully control - this one's not optional.

Michael #2: Codeberg’s AI-code ban tests its role as a GitHub alternative

• Armin’s article “Codeberg Divides”
• Armin Ronacher argues that Codeberg’s new terms, which prohibit projects mostly written with generative AI, create a vague and difficult-to-enforce boundary. His larger concern is that a democratically governed host can still be unpredictable or ideologically narrow, weakening Codeberg’s potential as a broad European alternative to GitHub.
  • The strongest question for Python developers is whether repository hosting should judge legal open source by how code was produced, or focus on behavior and resource abuse.
  • “Mostly generated” is hard to measure in modern codebases where developers mix handwritten code, completions, agents, and generated refactors.
  • Ronacher suggests clearer alternatives: ban all LLM involvement, or target autonomous repository spam, abusive resource use, and low-quality generated contributions directly.
  • Codeberg is free to choose a values-driven community, but that may conflict with being predictable, neutral infrastructure and a serious GitHub competitor.
  • Worth discussing: can open-source communities set meaningful AI boundaries without driving maintainers and projects into opposing camps?
• Very first search for these terms lands on this page.
  • Codeberg looked like a viable alternative. … Unfortunately, the latest update to its terms of service seems to mark a first step in changing one part I moved there for, namely the “freedom” part.

Sponsor: Logfire from Pydantic

Your AI agent failed at 2am. Was it the model? A tool call? The database? Most observability tools can't tell you, because they only see part of your stack.
Pydantic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database. Down to the infrastructure: services, Kubernetes, and hosts.
It's built on OpenTelemetry, with SDKs for Python, TypeScript, and Rust, and it works with any OTel-compatible language.
Every prompt, token count, and cost, right next to your vector searches and API calls.
You query everything with Postgres-compatible SQL. And so can your coding agent, through the Logfire MCP server.
Stop guessing. Read the trace.
Pydantic Logfire. AI, it's still just engineering.
Visit pythonbytes.fm/logfire today and sign up today. Get 10M records free every month, no card required. You can even click “Onboard with your coding agent” to copy a prompt to have claude or codex integrate Logfire into your app.
Thanks to Pydantic for supporting the show.

Calvin #3: Brett Cannon: what's missing for reproducible builds on PyPI

• Framing came out of his 2026 Python Packaging Council nomination - the secure-supply-chain gap he found is that Python has no defined way to do reproducible builds at all.
• Design goal is zero friction: producers uploading to PyPI shouldn't have to do anything. The work lands on build backends and installers.
• Gap #1: nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata.
• Gap #2: recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2.
• The replay mechanism already exists: [build-system] in pyproject.toml is a defined entry point, so if backends recorded their own environment, you could reinstall and re-run the build.
• Payoff idea: trusted third parties report successful reproductions back to PyPI, which displays "independently reproduced by X" - surfaced in the index API so installers could prefer reproduced files.
• Explicitly framed as a perk, not a requirement - roughly SLSA build level 1, no shaming projects that don't opt in.
  Verbal kicker option: "And don't think pure-Python wheels are off the hook. Something built that wheel, and if that something was compromised, so is your wheel. SolarWinds was a build-process attack."

Michael #4: Extra extra extra, hear all about it

• Python 3.14.7
• Upgraded the MCP servers to 2026-07-28 v2 protocols (talk python, python bytes)
• Got agentsview running synced via postgres
• Talk Python courses, teams trial offering
• Talk Python courses, government procurement offering
• Lean TDD audio book is out

Extras

Calvin:

• uv now prefers post-quantum key exchange - https://github.com/astral-sh/uv/releases/tag/0.12.4

Joke: Beware of dog