# python dependencies

Published articles for python dependencies.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Why Backporting Python Security Fixes Is Complex and Risky

DevFeed: [Why Backporting Python Security Fixes Is Complex and Risky](<https://devfeed.tech/articles/this-shit-is-hard-the-complexities-of-fixing-python-library-security-issues-at-scale-13290.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/this-shit-is-hard-the-complexities-of-fixing-python-library-security-issues-at-scale>)

Published: 2026-02-27T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Python](<https://devfeed.tech/topics/python.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [cve](<https://devfeed.tech/tags/cve.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [python-libraries](<https://devfeed.tech/tags/python-libraries.md>), [python-packages](<https://devfeed.tech/tags/python-packages.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cve-python-libraries](<https://devfeed.tech/tags/zero-cve-python-libraries.md>)

### AI overview

The article explains why updating vulnerable Python dependencies can be difficult when compatibility constraints prevent immediate upgrades. It argues that manually backporting security patches is complex, time-consuming, and risky, and presents Chainguard Libraries as a source of tested and verified patched packages.

### Source excerpt

Backporting Python CVE fixes is complex and risky. Chainguard Libraries delivers source-built, tested, and verified patched packages you can trust.

## Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195)

DevFeed: [Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195)](<https://devfeed.tech/articles/understanding-and-mitigating-the-jinja2-xss-vulnerability-cve-2024-22195-7992.md>)

Original publisher: [Read original article](<https://snyk.io/blog/jinja2-xss-vulnerability/>)

Author: Liran Tal

Published: 2024-01-18T06:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [Python](<https://devfeed.tech/topics/python.md>), [Library](<https://devfeed.tech/topics/library.md>), [Scripting](<https://devfeed.tech/topics/scripting.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [cve](<https://devfeed.tech/tags/cve.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [xss](<https://devfeed.tech/tags/xss.md>)

### AI overview

This article explains the Jinja2 cross-site scripting vulnerability CVE-2024-22195, which affects versions before 3.1.3. It describes the vulnerable filter behavior, the potential for injecting arbitrary HTML attributes and executing untrusted scripts in a browser, and ways to check project dependencies and scan them with Snyk.

### Source excerpt

On January 11th, 2024, a significant security vulnerability was disclosed in Jinja2, a widely used Python templating library. Identified as CVE-2024-22195, this cross-site scripting (XSS) vulnerability has raised concerns due to its impact on numerous projects.

## Using Python AST to resolve dependencies

DevFeed: [Using Python AST to resolve dependencies](<https://devfeed.tech/articles/using-python-ast-to-resolve-dependencies-39624.md>)

Original publisher: [Read original article](<https://www.gauravsarma.com/posts/2023-06-30_Using-Python-AST-to-resolve-dependencies-c849bd184020>)

Published: 2023-06-30T00:00:00Z

Content type: tutorial

Language: en

Sources: [Gaurav Sarma's Blog](<https://devfeed.tech/sources/gaurav-sarma-s-blog.md>)

Topics: [Python](<https://devfeed.tech/topics/python.md>), [Parsing](<https://devfeed.tech/topics/parsing.md>), [syntax](<https://devfeed.tech/topics/syntax.md>), [modules](<https://devfeed.tech/topics/modules.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [ast](<https://devfeed.tech/tags/ast.md>), [code](<https://devfeed.tech/tags/code.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [import](<https://devfeed.tech/tags/import.md>), [modules](<https://devfeed.tech/tags/modules.md>), [object](<https://devfeed.tech/tags/object.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [repository](<https://devfeed.tech/tags/repository.md>), [resolver](<https://devfeed.tech/tags/resolver.md>), [startup](<https://devfeed.tech/tags/startup.md>), [syntax](<https://devfeed.tech/tags/syntax.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [trees](<https://devfeed.tech/tags/trees.md>), [unit-tests](<https://devfeed.tech/tags/unit-tests.md>)

### AI overview

This tutorial explains how to use Python's Abstract Syntax Trees to resolve dependencies among objects imported across modules in a complex repository. It proposes recursively analyzing imports and copying required object code and dependencies into a destination folder.

### Source excerpt

This article covers how to resolve python dependencies using Python's Abstract Syntax Trees (AST). There are different and maybe better ways to understand the scope of your python dependencies...

## Understanding Docker Multi Stage Builds - Installing Python and Ruby in the Same Dockerfile

DevFeed: [Understanding Docker Multi Stage Builds - Installing Python and Ruby in the Same Dockerfile](<https://devfeed.tech/articles/understanding-docker-multi-stage-builds-installing-python-and-ruby-in-the-same-dockerfile-28156.md>)

Original publisher: [Read original article](<http://fuzzyblog.io/blog/docker/2019/11/22/understanding-docker-overlays-multiple-from-statements.html>)

Author: Fuzzygroup

Published: 2019-11-22T00:00:00Z

Content type: tutorial

Language: en

Sources: [Scott Johnson](<https://devfeed.tech/sources/scott-johnson.md>)

Topics: [Docker](<https://devfeed.tech/topics/docker.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>), [Python](<https://devfeed.tech/topics/python.md>), [Ruby](<https://devfeed.tech/topics/ruby.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Development](<https://devfeed.tech/topics/development.md>)

Tags: [apt](<https://devfeed.tech/tags/apt.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-container](<https://devfeed.tech/tags/docker-container.md>), [docker-multi-stage-builds](<https://devfeed.tech/tags/docker-multi-stage-builds.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [rails](<https://devfeed.tech/tags/rails.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

### AI overview

This tutorial explains how to use Docker multi-stage builds to run Python and Ruby together in one Dockerfile. It describes isolating stages created by multiple FROM statements and intentionally copying the required executable and Python libraries into the Ruby-based image.

### Source excerpt

Now that I've come up to speed on Python, I have an application in production that uses both Python and Ruby. What it does isn't really important but getting it live posed an interesting deployment challenge due to the need to have both Python and Ruby concurrently. My initial attempt to make this was work was a native install using Python 3.7 and a fairly large set of Python dependencies on an Ubuntu 18.04 AWS instance. Unfortunately I kept hitting issues where, well, things just went to hell. This had me turn to Docker and my thinking was that I should be able to easily build a Dockerfile that supported both Python and Rails. chuckle. Nothing in Docker is actually easy but I got there. Note: The reason I needed Python is I was building a Twitter related application and I needed to use the truly excellent Twint library / executable. Python Dockerfile Attempt 1 I don't have a full record of this but I tried to pull in a traditional Python install using apt-get. This worked fairly horribly for reasons that escape me. Welcome to Overlays and Multiple From Statements My first attempt to make this work failed to work and it failed to really adopt the zen of Docker. One of the very cool features is that you can build up a Docker container with bits from different containers by using multiple from statements. This lets you have something like this: FROM continuumio/miniconda3:latest AS python RUN apt-get update && apt-get install build-essential python3-dev -y FROM ubuntu:latest FROM ruby:2.6.4-stretch The term for this is a Docker Multi Stage Build. The trick here is that the output from each FROM statement is logically isolated from each other. The reason for this is actually pretty simple - standard directory structures. Given that most *nix environments use similar top level structures like /opt, you simply can't combine things blindly - it needs to be an intentional choice using, drumroll, copy! Here's what this multi stage build stuff looked like: FROM continuumio/m

## How to Handle your Python packaging in Lambda with Serverless plugins

DevFeed: [How to Handle your Python packaging in Lambda with Serverless plugins](<https://devfeed.tech/articles/how-to-handle-your-python-packaging-in-lambda-with-serverless-plugins-14389.md>)

Original publisher: [Read original article](<https://www.serverless.com/blog/serverless-python-packaging>)

Author: Alex DeBrie

Published: 2017-08-04T00:00:00Z

Content type: tutorial

Language: en

Sources: [Serverless Blog](<https://devfeed.tech/sources/serverless-blog.md>)

Topics: [Python](<https://devfeed.tech/topics/python.md>), [Serverless](<https://devfeed.tech/topics/serverless.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-lambda](<https://devfeed.tech/tags/aws-lambda.md>), [cloud-computing](<https://devfeed.tech/tags/cloud-computing.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [faas](<https://devfeed.tech/tags/faas.md>), [function-as-a-service](<https://devfeed.tech/tags/function-as-a-service.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [lambda](<https://devfeed.tech/tags/lambda.md>), [packaging](<https://devfeed.tech/tags/packaging.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>), [serverless](<https://devfeed.tech/tags/serverless.md>), [serverless-architecture](<https://devfeed.tech/tags/serverless-architecture.md>), [serverless-framework](<https://devfeed.tech/tags/serverless-framework.md>)

### AI overview

A tutorial on handling Python dependencies in AWS Lambda functions using Serverless plugins to maintain development and production parity.

### Source excerpt

Handling Python dependencies in your Lambda functions can be a pain. Here's how I handle Python packaging with Serverless for dev/prod parity.

## logzero - Simplified logging for Python 2 and 3

DevFeed: [logzero - Simplified logging for Python 2 and 3](<https://devfeed.tech/articles/logzero-simplified-logging-for-python-2-and-3-31848.md>)

Original publisher: [Read original article](<https://www.metachris.dev/2017/06/logzero-simplified-logging-for-python-2-and-3/>)

Author: Chris Hager

Published: 2017-06-29T00:00:00Z

Content type: release

Language: en

Sources: [Chris Hager](<https://devfeed.tech/sources/chris-hager.md>)

Topics: [Logging](<https://devfeed.tech/topics/logging.md>), [Python](<https://devfeed.tech/topics/python.md>), [Boilerplate](<https://devfeed.tech/topics/boilerplate.md>), [Documentation](<https://devfeed.tech/topics/documentation.md>)

Tags: [boilerplate](<https://devfeed.tech/tags/boilerplate.md>), [file](<https://devfeed.tech/tags/file.md>), [logger](<https://devfeed.tech/tags/logger.md>), [logging](<https://devfeed.tech/tags/logging.md>), [python](<https://devfeed.tech/tags/python.md>), [python-dependencies](<https://devfeed.tech/tags/python-dependencies.md>)

### AI overview

The article announces logzero, a small Python package for simplified logging in Python 2 and 3. It describes console and file logging, formatting, encoding handling, multiple loggers, rotating log files, installation, and documentation.

### Source excerpt

I've just published logzero, a small Python package which simplifies logging with Python 2 and 3. It is easy to use and robust, and heavily inspired by the Tornado web framework. I've recently released python-boilerplate.com which included this module as a file, and people have been asking for it to be published as a standalone package. Finally I've found some time to do it, and here it is! https://logzero.readthedocs.io https://github.com/metachris/logzero logzero is a simple and effective logging module for Python 2 and 3: