# PyPI Published articles for PyPI. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## From guidance to action: Security fundamentals that materially reduce risk DevFeed: [From guidance to action: Security fundamentals that materially reduce risk]() Original publisher: [Read original article]() Author: Ron Pessner Published: 2026-09-17T17:00:00Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Cybersecurity](), [Exposure Management](), [Artificial Intelligence](), [Vulnerabilities](), [Hacking](), [incident]() Tags: [agentic-security](), [ai](), [exposure-management](), [passwords](), [permissions](), [pypi](), [security](), [speed](), [sql]() ### AI overview Microsoft describes how AI is changing the cybersecurity threat landscape and argues that foundational controls remain essential. The article highlights excessive permissions, weak authentication, unpatched systems, exposed execution paths, and gaps between controls, along with guidance for governing agent identities and tools, isolating execution, restricting connectivity, monitoring behavior, and reducing exposure. ### Source excerpt AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats. The post From guidance to action: Security fundamentals that materially reduce risk appeared first on Microsoft Security Blog. ## Собрать прошлое: как архивировать весь трафик сборки SONiC DevFeed: [Собрать прошлое: как архивировать весь трафик сборки SONiC]() Original publisher: [Read original article]() Author: denballakh (Яндекс, Yandex Cloud & Yandex Infrastructure) Published: 2026-07-20T07:03:18Z Content type: tutorial Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [Docker](), [Debian](), [HTTP](), [docker registry](), [GitHub](), [PyPI](), [Python]() Tags: [build](), [debian](), [docker](), [docker-registry](), [github](), [http](), [infrastructure](), [mitm](), [proxy](), [pypi](), [reproducibility](), [sonic]() ### AI overview This article explains how Yandex Infrastructure developed a caching MITM proxy for SONiC and YaSONiC builds. The proxy captures HTTP/HTTPS traffic and serves previously saved responses to improve build reproducibility when external dependencies change or disappear. ### Source excerpt Интернет -- это зависимость без зафиксированной версии. Сегодня он возвращает одно, завтра -- другое, а послезавтра -- ничего. Поэтому мы решили сохранить для сборки тот интернет, который она однажды увидела. Для этого пришлось перехватывать HTTPS, выпускать собственные сертификаты, переподписывать индексы Debian и выяснять, почему Docker отправляет "случайные" заголовки. В этой статье я расскажу, как разрабатывал кеширующую MITM-проксю, которая перехватывает весь HTTP/HTTPS-трафик и отдаёт ранее сохранённые ответы. Разберём также неочевидные технические проблемы, с которыми пришлось столкнуться. Читать далее ## Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026 DevFeed: [Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-02T02:34:08Z Content type: news Language: en Sources: [T.J. Maher]() Topics: [open-source-security](), [supply-chain-security](), [Malware](), [npm](), [PyPI](), [GitHub](), [software composition analysis](), [Security]() Tags: [github](), [malware](), [npm](), [open-source](), [pypi](), [sca](), [security](), [software-supply-chain](), [sqgne](), [supply-chain](), [supply-chain-attacks]() ### AI overview The Software Quality Group of New England will host a June 17, 2026 meeting featuring Bryan Whyte of Sonatype on open-source malware and software supply chain defense. The session will cover threats targeting npm, PyPI, GitHub, and development pipelines; differences between open-source malware and traditional malware or vulnerabilities; and common tactics used in software supply chain attacks. ### Source excerpt "Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats" will be the topic of the next Software Quality Group of New England (sqgne.org) meeting. Speaker: Bryan Whyte, CISSP Director, Solutions Engineering @Sonatype Date: June 17, 2026 @ 6:00 pm Join us on Zoom or in person at Burlington, MA ( Register Here ) "Bryan Whyte breaks down the latest wave of open source malware, explains how these threats diverge from traditional vulnerabilities, and shares actionable steps for organizations to defend mission-critical software. "As organizations deepen their reliance on open-source software, evolving security threats are reshaping the landscape at an unprecedented pace. "Threat actors are now increasingly targeting development pipelines and trusted ecosystems like npm to orchestrate supply chain attacks with significant downstream impact. Incidents such as the 2025 Shai-Hulud npm campaign, the XZ Utils backdoor, and the widespread compromise of over 23,000 GitHub repositories illustrate how open-source malware has quickly become a critical, top-tier threat built to evade legacy scanning and exploit trust woven into modern delivery pipelines. "--The shifting tactics of threat actors targeting npm, PyPi, GitHub, and development pipelines "--Key differences between open-source malware and traditional malware or vulnerabilities "--The most prevalent malware types and tactics driving today's software supply chain attacks "After spending 20 years in software development, Bryan started his journey into Application Security in 2015 with the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. In 2018, he expanded his Cybersecurity proficiency, earning the Certified Information Systems Security Professional (CISSP). In 2019, he was excited to join Sonatype due to the explosive growth of open-source software, which has made Software Composition Analysis (SCA) a critical aspect of Application Security". See you there! Happy Testing ## Same-Day Model Integration: ESMC + ESMFold2 in Sheaf v0.11 DevFeed: [Same-Day Model Integration: ESMC + ESMFold2 in Sheaf v0.11]() Original publisher: [Read original article]() Published: 2026-05-27T00:00:00Z Content type: article Language: en Sources: [Alex Korbonits]() Topics: [Large Language Model](), [structure](), [Pydantic](), [backends](), [unit tests](), [Serverless]() Tags: [backend](), [claude-code](), [code](), [language](), [model](), [pypi](), [release](), [serverless](), [structure](), [tests]() ### AI overview The article explains how Sheaf v0.11 integrated ESMC and ESMFold2 on the same day they were released. It attributes the rapid integration to existing typed serving contracts and infrastructure, while describing verification, testing, H100 smoke testing, release work, and documentation. ### Source excerpt Chan Zuckerberg Biohub released a new protein language model and structure predictor this morning. Sheaf v0.11 shipped with both, same day. The story is less about hustle and more about what a typed serving contract buys you when a new model lands. ## Zeta2.1: 3x Fewer Tokens, 50ms Faster DevFeed: [Zeta2.1: 3x Fewer Tokens, 50ms Faster]() Original publisher: [Read original article]() Author: Ben Kunkle, Oleksiy Syvokon Published: 2026-05-08T00:00:00Z Content type: release Language: en Sources: [Zed Industries - Blog]() Topics: [model-deployment](), [hugging face](), [Open Source](), [Code](), [D]() Tags: [efficiency](), [hugging-face](), [model](), [open-source](), [predictions](), [production](), [pypi](), [release](), [running](), [rust](), [tokens]() ### AI overview Zed announces Zeta2.1, an open-weight edit prediction model that uses a new Multi-Region prompt format. Compared with Zeta2, it emits fewer output tokens, delivers faster predictions, and requires fewer servers for the same traffic. The release also supports local use and includes Rust bindings published to PyPI. ### Source excerpt Zeta2.1 is out and it's more efficient than Zeta2. ## Cyber resiliency in practice: Lessons from recent supply chain attacks DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks]() Original publisher: [Read original article]() Published: 2026-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [resiliency](), [supply chain attacks](), [supply-chain-security](), [axios](), [GitHub Actions](), [litellm](), [trivy](), [npm](), [PyPI](), [Python](), [Large Language Model]() Tags: [axios](), [chainguard-libraries](), [cyber-resiliency](), [cybersecurity](), [github-actions](), [litellm](), [malware](), [npm](), [pypi](), [python](), [security](), [security-attacks](), [social-engineering](), [software-supply-chain-security](), [supply-chain-attacks](), [trivy](), [worm]() ### AI overview The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases. ### Source excerpt Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM. ## When Does Compressed Protobuf Actually Beat Compressed JSON? DevFeed: [When Does Compressed Protobuf Actually Beat Compressed JSON?]() Original publisher: [Read original article]() Published: 2026-05-07T00:00:00Z Content type: comparison Language: en Sources: [Gaurav Sarma's Blog]() Topics: [Compression](), [Benchmark](), [JSON](), [data](), [Python](), [GitHub](), [PyPI]() Tags: [benchmark](), [benchmarks](), [code](), [compression](), [data](), [github](), [json](), [pypi](), [python]() ### AI overview This article benchmarks compressed Protobuf against compressed JSON across 19 payload shapes and three compressors. It finds that compression can narrow or reverse Protobuf's raw-size advantage, depending on the data shape, so neither format is consistently smaller. ### Source excerpt . [When Does Compressed Protobuf Beat Compressed JSON... ## Chainguard customers safe from elementary-data compromise DevFeed: [Chainguard customers safe from elementary-data compromise]() Original publisher: [Read original article]() Published: 2026-04-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Malware](), [data observability](), [Data Quality](), [chainguard containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-customers](), [chainguard-libraries](), [data-observability](), [data-quality](), [elementary-data-compromise](), [malware](), [pypi](), [pypi-malware]() ### AI overview Chainguard reports that customers using its Python Libraries and Container images were unaffected by the compromised elementary-data 0.23.3 package on PyPI. Chainguard detected malicious patterns before building the package, while the compromised release was quarantined and related GitHub and Docker artifacts were removed. ### Source excerpt Malicious elementary-data version hit PyPI. Chainguard customers stayed protected by detecting malware pre-build and serving only verified safe versions. ## Supply chain attacks expose weaknesses in open-source software trust DevFeed: [Supply chain attacks expose weaknesses in open-source software trust]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [vulnerability](), [Exploit](), [npm]() Tags: [ai-coding](), [attacks](), [chainguard](), [code](), [dependency](), [hardening](), [npm](), [open-source](), [open-source-security](), [oss](), [pypi](), [scanner](), [secrets](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [trust](), [vibe-coding](), [vulnerability](), [vulnerability-scanner]() ### AI overview This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening. ### Source excerpt Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix. ## Apache Airflow 3.2.0: Data-Aware Workflows at Scale DevFeed: [Apache Airflow 3.2.0: Data-Aware Workflows at Scale]() Original publisher: [Read original article]() Author: Apache Airflow Published: 2026-04-07T00:00:00Z Content type: release Language: en Sources: [Apache Airflow Blog]() Topics: [airflow](), [releases](), [data](), [Orchestration](), [Release notes](), [SDK](), [Amazon S3](), [BigQuery]() Tags: [airflow](), [apache](), [apache-airflow](), [bigquery](), [data](), [docker-image](), [orchestration](), [pypi](), [release](), [release-notes](), [s3](), [sdk](), [workflows]() ### AI overview Apache Airflow 3.2.0 introduces asset partitioning for more granular data-aware scheduling, along with multi-team deployments, synchronous deadline alert callbacks, and continued Task SDK separation. Partition-aware workflows trigger downstream DAGs only when the relevant partition is updated. ### Source excerpt We're proud to announce the release of Apache Airflow 3.2.0! Airflow 3.1 puts humans at the center of automated workflows. 3.2 brings that same precision to data: Asset partitioning for granular pipeline orchestration, multi-team deployments for enterprise scale, synchronous deadline alert callbacks, and continued progress toward full Task SDK separation. Details: 📦 PyPI: https://pypi.org/project/apache-airflow/3.2.0/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.2.0/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.2.0/release_notes.html 🐳 Docker Image: docker pull apache/airflow:3.2.0 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.2.0 🗂 Asset Partitioning (AIP-76): Only the Right Work Gets Triggered Asset partitioning has been one of the most requested additions to data-aware scheduling. If you work with date-partitioned S3 paths, Hive table partitions, BigQuery partitions, or really any partitioned data store, you've dealt with this: An upstream task updates one partition, and every downstream Dag fires regardless of which slice actually changed. It's wasteful, and for large deployments it creates real operational noise. Asset partitioning in 3.2 makes this granular. Downstream Dags trigger only when the specific partition they care about gets updated. It's the biggest change to data-aware scheduling since Assets were introduced, and it turns partition-driven orchestration into something Airflow handles natively rather than something you work around. Key Capabilities Partition-driven scheduling: Dags trigger on specific partition updates, not every asset change CronPartitionTimetable: Schedule Dags against partitions using cron expressions. Also available in the Task SDK Backfill for partitioned Dags: Backfill historical partitions without re-triggering everything downstream (#61464) Multi-asset partitions: A single Dag can listen for partitions across multiple assets, which matters when your downstream work depe ## Your riskiest supplier isn't a vendor. It's a registry. DevFeed: [Your riskiest supplier isn't a vendor. It's a registry.]() Original publisher: [Read original article]() Published: 2026-04-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Open Source](), [npm](), [Maven](), [pip]() Tags: [apra](), [apra-compliance](), [auditability](), [chainguard-libraries](), [cps-230](), [cps-234](), [maven-central](), [npm](), [pypi](), [resilience](), [security](), [supply-chain]() ### AI overview The article argues that public package registries such as npm, PyPI, and Maven Central create an assurance gap for APRA-regulated institutions because organizations may consume artifacts without independently verifying their source or build process. It recommends source-built libraries as a more defensible approach to managing malware risk, operational resilience, and auditability. ### Source excerpt Public registries create supply chain risk. Learn how source-built libraries help APRA-regulated teams improve security, resilience, and auditability. ## Security Week 2614: атака класса supply chain на библиотеку LiteLLM DevFeed: [Security Week 2614: атака класса supply chain на библиотеку LiteLLM]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-03-30T17:00:04Z Content type: news Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [litellm](), [Security](), [PyPI](), [Python]() Tags: [discord](), [kubernetes](), [litellm](), [pypi](), [python](), [security](), [slack](), [ssh](), [supply-chain](), [tag-9fe8963de219](), [terraform](), [tls]() ### AI overview The article reports a supply-chain compromise affecting LiteLLM versions 1.82.7 and 1.82.8 uploaded to PyPI. The malicious code searched victims' systems for files, credentials, secrets, and cloud infrastructure data, could contact a command server, and included Kubernetes persistence capabilities. Researchers also found similar malware in two Checkmarx extensions; the malicious versions were removed, and affected users were advised to rotate credentials and secrets. ### Source excerpt Громкой новостью прошлой недели стал взлом библиотеки LiteLLM, используемой в качестве посредника для коммуникации с большим количеством языковых моделей (сообщение от разработчиков, новость на Хабре). Через другое вредоносное приложение на Python была взломана учетная запись мейнтейнера проекта, после чего сразу две версии LiteLLM (1.82.7 и 1.82.8) с вредоносными модулями были загружены в репозиторий PyPI. Отчет с анализом вредоносного кода опубликовали эксперты "Лаборатории Касперского". В версии 1.82.7 вредоносный код был встроен в файл proxy_server.py. В версии 1.82.8 дополнительно появился .pth-файл, благодаря которому вредоносный код выполнялся при каждом запуске интерпретатора, даже если зараженная библиотека не использовалась. После запуска зараженный скрипт начинал рекурсивный обход рабочих директорий в системе жертвы. В каждой директории скрипт просматривал содержимое файлов, которое выводил в буфер stdout и сохранял в файл для последующей отправки на командный сервер злоумышленников. Далее скрипт собирал информацию о системе и также сохранял в файл. После этого он переходил к поиску конфиденциальных данных, включая следующие типы: Читать далее ## How to protect your organization from the telnyx PyPI compromise DevFeed: [How to protect your organization from the telnyx PyPI compromise]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [open-source-security](), [SDKs](), [C2](), [Python](), [API keys](), [Encryption](), [Open Source](), [chainguard](), [ssh](), [GitHub Actions]() Tags: [api-keys](), [c2](), [chainguard](), [chainguard-libraries](), [encryption](), [github-actions](), [malware](), [open-source-security](), [pypi](), [pypi-attack](), [pypi-compromise](), [rsa](), [security](), [ssh](), [supply-chain](), [teampcp](), [telnyx](), [telnyx-attack](), [telnyx-compromise](), [trivy]() ### AI overview The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign. ### Source excerpt Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries. ## The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases DevFeed: [The litellm PyPI compromise and how Chainguard Libraries blocked malicious releases]() Original publisher: [Read original article]() Published: 2026-03-24T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [litellm](), [chainguard libraries](), [open-source-security]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [litellm](), [litellm-attack](), [litellm-package](), [litellm-supply-chain-attack](), [open-source-security](), [pypi](), [secure-packages](), [security](), [supply-chain-attacks]() ### AI overview The article describes a litellm compromise on PyPI in which malicious releases were used to steal secrets. It states that Chainguard Libraries prevented exposure by rebuilding only verified source and blocking the malicious releases. ### Source excerpt Hackers compromised litellm on PyPI to steal secrets. Chainguard Libraries prevented exposure by rebuilding only verified source, blocking malicious releases. ## DigitalOcean Gradient™ AI Platform Now Integrates with LlamaIndex DevFeed: [DigitalOcean Gradient™ AI Platform Now Integrates with LlamaIndex]() Original publisher: [Read original article]() Author: Narasimha Badrinath Published: 2026-02-18T20:23:52Z Content type: release Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [llamaindex](), [Retrieval Augmented Generation (RAG)](), [AI Platform](), [Large Language Model](), [Embeddings]() Tags: [ai-platform](), [async](), [digitalocean](), [llamaindex](), [product-updates](), [pypi](), [rag](), [streaming]() ### AI overview DigitalOcean Gradient AI Platform now natively integrates with LlamaIndex through two PyPI packages. The integration connects Gradient Knowledge Bases and hosted LLMs to LlamaIndex workflows, supporting hybrid search, metadata filtering, streaming responses, and asynchronous operations. ### Source excerpt We're excited to announce that DigitalOcean Gradient™ AI Platform now integrates natively with LlamaIndex - one of the most popular frameworks for building RAG applications. This means you can now connect your Gradient AI Platform Knowledge Base and LLMs directly to LlamaIndex workflows, using the abstractions you already know. No additional infrastructure. No complex setup. Just install two packages and start building. Why This Matters If you've built RAG applications before, you know the drill: provision a vector database, set up an embedding pipeline, manage credentials across services, and stitch everything together. It's a lot of overhead before you write a single line of application logic. With these new integrations, we've done the heavy lifting. Your Knowledge Base handles document ingestion, chunking, and embeddings. The LlamaIndex retriever connects directly to it. Add our LLM integration, and you have a complete RAG pipeline running on managed DigitalOcean infrastructure. What's New Two packages are now available on PyPI: llama-index-retrievers-digitalocean-gradientai Connect to your Knowledge Base as a LlamaIndex retriever. Supports hybrid search (keyword + semantic), metadata filtering, and async operations. llama-index-llms-digitalocean-gradientai Use Gradient AI Platform-hosted LLMs in your LlamaIndex workflows. Supports streaming responses and async for high-throughput applications. Both packages work with LlamaIndex query engines, chat engines, callbacks, and the broader ecosystem. Get Started in Minutes Install the packages: pip install llama-index-retrievers-digitalocean-gradientai llama-index-llms-digitalocean-gradientai From there, configure your Gradient AI Platform credentials and drop the retriever and LLM into your existing LlamaIndex code. Check out our documentation for a complete walkthrough and code examples. What You Can Build These integrations open up a range of possibilities: Support assistants grounded in your product documentation ## Introducing automatic, short-lived credentials for Chainguard Libraries for Python DevFeed: [Introducing automatic, short-lived credentials for Chainguard Libraries for Python]() Original publisher: [Read original article]() Published: 2026-01-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Authentication](), [pip](), [developer velocity](), [Usability]() Tags: [authentication](), [chainguard-libraries](), [chainguard-libraries-for-python](), [chainguard-libraries-python](), [chainguard-packages](), [chainguard-python-containers](), [developer-velocity](), [github-actions](), [pypi](), [python-libraries](), [python-packages](), [secure-python-packages](), [security](), [usability]() ### AI overview Chainguard announces integrated authentication for Chainguard Libraries for Python through a keyring package. The package provides short-lived credentials that refresh automatically, enabling secure pip access without repeatedly creating, copying, or managing long-lived tokens. It supports local development and GitHub Actions environments with assumable identities. ### Source excerpt New integrated authentication for Python Libraries with a keyring: use short-lived credentials for pip installs to stay secure without slowing developers down. ## Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas DevFeed: [Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas]() Original publisher: [Read original article]() Author: Steve Poole Published: 2025-12-24T03:03:09Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [Python](), [pip](), [PyPI](), [Maven Central](), [Java](), [Maven]() Tags: [2025](), [attacks](), [dependency](), [developer](), [guide](), [install](), [internet](), [java](), [maven-central](), [mirror](), [model](), [packaging](), [pitfalls](), [pypi](), [python](), [registry](), [trust]() ### AI overview A Java-focused guide to Python package-management risks. It contrasts Maven Central with PyPI, highlighting flat package naming, trusting dependency resolution, typosquatting, dependency confusion, and unsafe installation commands. It recommends version pins, known sources, private registries, and lock files. ### Source excerpt Just like that it happened. You, a disciplined Java developer, are now installing Python. Like everything in 2025, it just arrived. One day, you were running a tidy mvn install, the next, you're learning about virtual environments and fighting an unfriendly pip install that won't explain what it just pulled from the internet. Good news: [...] The post Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas appeared first on JVM Advent. ## Python 3.14.0rc3 is go! DevFeed: [Python 3.14.0rc3 is go!]() Original publisher: [Read original article]() Author: Hugo van Kemenade Published: 2025-09-18T00:00:00Z Content type: release Language: en Sources: [Python Insider]() Topics: [Python 3.14](), [Python]() Tags: [bug-fixes](), [production](), [pypi](), [python](), [python-3-14](), [release](), [releases](), [testing]() ### AI overview Python 3.14.0rc3 is the final release candidate before the scheduled Python 3.14.0 release. It fixes a bytecode magic-number bug without changing the ABI and introduces or includes major Python 3.14 features such as free-threading support, deferred annotation evaluation, template string literals, multiple interpreters, Zstandard compression support, syntax highlighting, and an external debugger interface. ### Source excerpt It's 🪄 finally 🪄 the final 3.14 release candidate! https://www.python.org/downloads/release/python-3140rc3/ Note: It's another magic release. We fixed anot... ## Ansible 12.0 breaks netlab Jinja2 templates; netlab 25.09-post1 pins Ansible to 11.10 or lower DevFeed: [Ansible 12.0 breaks netlab Jinja2 templates; netlab 25.09-post1 pins Ansible to 11.10 or lower]() Original publisher: [Read original article]() Published: 2025-09-14T17:25:00Z Content type: release Language: en Sources: [ipSpace.net blog]() Topics: [Ansible](), [configuration](), [Containerlab topology]() Tags: [ansible](), [configuration](), [core](), [dependency](), [installation](), [netlab](), [pypi](), [release](), [troubleshooting]() ### AI overview Ansible 12.0 requires ansible-core 2.19, whose Jinja2 templating changes broke netlab's Containerlab configuration file template. netlab 25.09-post1 checks the Ansible core version and pins installations to Ansible 11.10 or lower, with the install command available for downgrading. ### Source excerpt On September 9th, the ansible release 12.0 appeared on PyPi. It requires ansible-core release 2.19, which includes breaking changes to Jinja2 templating. netlab Jinja2 templates rely on a few Ansible Jinja2 filters; netlab thus imports and uses those filters, and it looks like those imports pulled in the breaking changes that consequently broke the netlab containerlab configuration file template (details). netlab did not check the Ansible core version (we never had a similar problem in the past), and the installation scripts did not pin the Ansible version (feel free to blame me for this one), which means that any new netlab installation created after September 9th crashed miserably on the simplest lab topologies. This is the workaround we implemented in netlab release 25.09-post1 (released earlier today): Read more ... ## Malware-Resistant Python without the Guesswork DevFeed: [Malware-Resistant Python without the Guesswork]() Original publisher: [Read original article]() Published: 2025-08-01T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Security](), [chainguard](), [Open Source](), [Malware]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [malicious-packages](), [malware](), [num2words](), [provenance](), [pypi](), [python](), [reproducibility](), [sbom](), [secure-packages](), [security](), [signing](), [slsa](), [supply-chain]() ### AI overview The article presents Chainguard Libraries for Python as a way to reduce malware and software supply chain risks in Python package consumption. It describes rebuilding packages from upstream source in an isolated, reproducible SLSA Level 2 environment, and publishing signed SBOMs and provenance information. ### Source excerpt The recent compromise of the num2words package never made it into Chainguard Libraries for Python. Get the breakdown from the team on our packages you can trust. ## Python 3.14 release candidate 1 is go! DevFeed: [Python 3.14 release candidate 1 is go!]() Original publisher: [Read original article]() Author: Hugo van Kemenade Published: 2025-07-22T00:00:00Z Content type: release Language: en Sources: [Python Insider]() Topics: [Python 3.14](), [Python](), [Compression](), [debug](), [Syntax Highlighting]() Tags: [2025](), [bug-fixes](), [compression](), [debugger](), [maintainers](), [production](), [pypi](), [python](), [python-3-14](), [release](), [releases](), [testing]() ### AI overview The article announces Python 3.14.0rc1, the first release candidate and penultimate preview before the planned final release on October 7, 2025. It asks maintainers of third-party projects to test compatibility and publish Python 3.14 wheels on PyPI, while warning that the preview is not recommended for production use. It also highlights major changes including officially supported free-threaded Python, deferred annotation evaluation, template string literals, multiple interpreters, Zstandard compression support, improved syntax highlighting, an external debugger interface, faster UUID generation, and C API improvements. ### Source excerpt It's the first 3.14 release candidate! https://www.python.org/downloads/release/python-3140rc1/ This is the first release candidate of Python 3.14 This relea... ## Google introduces OSS Rebuild for reproducible open-source package artifacts DevFeed: [Google introduces OSS Rebuild for reproducible open-source package artifacts]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2025-07-21T21:34:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [open-source-security](), [Open Source](), [supply chain attacks](), [npm](), [PyPI](), [Rust]() Tags: [announce](), [none](), [npm](), [open-source](), [open-source-security](), [pypi](), [rust](), [slsa](), [supply-chain-attacks]() ### AI overview Google announced OSS Rebuild, a project that reproduces upstream package artifacts to provide build definitions, SLSA provenance, and verification tools for PyPI, npm, and Crates.io packages. ### Source excerpt Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. The project comprises: Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. Challenges Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion, open source software has never been more integral to the global economy. Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. The security community has responded with initiatives like OpenSSF Scorecard, pypi's Trusted Publishers, and npm's native SLSA support. However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. Our Aim Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by makin ## Mitigating malware in the python ecosystem with Chainguard Libraries DevFeed: [Mitigating malware in the python ecosystem with Chainguard Libraries]() Original publisher: [Read original article]() Published: 2025-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [chainguard](), [Malware](), [Python](), [dataset](), [GitHub]() Tags: [backstabber-s-knife-collection](), [chainguard](), [chainguard-libraries](), [libraries](), [malware](), [malware-mitigation](), [pypi](), [pypi-malware](), [python](), [research](), [security]() ### AI overview Chainguard analyzes about 3,025 malicious Python packages from the Backstabber's Knife Collection to assess Chainguard Libraries for Python. The analysis reports that requiring attributable source code and validating source-to-artifact integrity could have prevented about 98% of the packages from being published; excluding packages without source code, the reported mitigation rate is 75%. ### Source excerpt Chainguard recently found that 98% of malicious Python libraries from the Backstabber's Knife Collection could be avoided by using Chainguard Libraries. ## Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks DevFeed: [Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks]() Original publisher: [Read original article]() Published: 2025-05-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Malware](), [PyPI](), [open-source-security](), [supply-chain-security]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [libraries](), [malware](), [open-source-software](), [packages](), [pypi](), [python](), [security](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview The article explains that growing reliance on Python packages from PyPI increases exposure to malware risks. It presents Chainguard Libraries for Python as a more secure package index whose libraries and dependency trees are built from source in hardened infrastructure. ### Source excerpt Chainguard developed Chainguard Libraries for Python to help guard the Python ecosystem against malware attacks. Discover why we did it and how it works. [Next page]()