Packaging, uv and pip

19+ hour, 36+ min ago   (168+ words) Python makes it remarkably easy to add functionality to a project. A single pip install can bring in a powerful library and get you moving within minutes. The trouble usually starts later. A dependency gets upgraded. A fresh machine produces…...

2+ day, 1+ hour ago   (606+ words) Python’s real strength is not only the language itself but the enormous collection of ready-made libraries around it. Need to call a web API, crunch a dataset, build a website or train a model? Chances are someone has already written…...

2+ day, 1+ hour ago   (780+ words) Every Python developer has typed pip install thousands of times. A few seconds later, a library written by a stranger on the other side of the world is ready to import. It feels like magic, but there is a clear…...

2+ day, 14+ hour ago   (136+ words) When I started writing Python, I thought most mistakes would come from writing bad code. But I eventually realized that some of my biggest problems weren’t caused by Python syntax at all. They came from installing packages globally. Forgetting what…...

3+ day, 16+ hour ago   (94+ words) Apple's coreai-models 0.1.0 is on PyPI right now. Try installing it on Python 3.11: This is the fifth tool in my release-integrity series — the question each one asks is "the release passed, but what actually shipped?" wheelreach is a zero-dependency Python CLI....

5+ day, 4+ hour ago   (908+ words) If your test begins after import, you may already be late. Socket's analysis of the compromised MemTensor packages found that import memos was enough to start a bundled native program. The affected OpenClaw plugin also launched the program when the…...

1+ week, 23+ hour ago   (1130+ words) Anyone who has written a requirements.txt file has probably paused at the line after the package name. Leave it blank, pin it with ==3.0.0, set a floor with >=3.0.0, or split the difference with ~=3.0.0 — they look similar, but each one makes…...

1+ week, 4+ day ago   (287+ words) MPS maintains that the previous system was “consistent with practices implemented at universities across the United States,” the department said in an email statement to The Daily. The University has received no reports of package theft via fraudulent QR codes,…...

1+ week, 5+ day ago   (142+ words) Affected releases include MemoryOS 2.0.34 and OpenClaw npm plugin versions 0.1.21, 0.1.23 and 0.1.25. A supply-chain attack affected two MemTensor tools, and developers should check their installed versions for releases that execute malicious code when loaded. The affected packages are the MemoryOS package on…...

1+ week, 5+ day ago   (892+ words) A new weekly note. The rule is simple: an item makes the list only if we measured something on this machine, or if it changes what you should check before adopting a tool. Plain news does not qualify. Everything below…...