Using pip-audit vs uv audit in CI

• Starlette 1.0.0
• Astral to join OpenAI
• uv audit
• Fire and forget (or never) with Python’s asyncio
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python Training
• The Complete pytest Course
• Patreon Supporters Connect with the hosts
• Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky)
• Brian: @brianokken@fosstodon.org / @brianokken.bsky.social
• Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: Starlette 1.0.0

• As a reminder, Starlette is the foundation for FastAPI
• Starlette 1.0 is here! - fun blog post from Marcello Trylesinski
• “The changes in 1.0 were limited to removing old deprecated code that had been on the way out for years, along with a few bug fixes. From now on we'll follow SemVer strictly.”
• Fun comment in the “What’s next?” section:
  • “Oh, and Sebastián, Starlette is now out of your way to release FastAPI 1.0. 😉”
• Related: Experimenting with Starlette 1.0 with Claude skills
  • Simon Willison
  • example of the new lifespan mechanism, very pytest fixture-like

    @contextlib.asynccontextmanager
    async def lifespan(app):
    async with some_async_resource():
        print("Run at startup!")
        yield
        print("Run on shutdown!")
    app = Starlette(
    routes=routes,
    lifespan=lifespan
    )
    

Michael #2: Astral to join OpenAI

• via John Hagen, thanks
• Astral has agreed to join OpenAI as part of the Codex team
• Congrats Charlie and team
• Seems like **Ruff** and uv play an important roll.
• Perhaps ty holds the most value to directly boost Codex (understanding codebases for the AI)
• All that said, these were open source so there is way more to the motivations than just using the tools.
• After joining the Codex team, we'll continue building our open source tools.
• Simon Willison has thoughts
• discuss.python.org also has thoughts
• The Ars Technica article has interesting comments too
• It’s probably the death pyx
  • Simon points out “pyx is notably absent from both the Astral and OpenAI announcement posts.”

Brian #3: uv audit

• Submitted by Owen Lemont
• Pieces of uv audit have been trickling in. uv 0.10.12 exposes it to the cli help
• Here’s the roadmap for uv audit
• I tried it out on a package and found a security issue with a dependency
  • not of the project, but of the testing dependencies
  • but only if using Python < 3.10, even though I’m using 3.14
• Kinda cool
• Looks like it generates a uv.lock file, which includes dependencies for all project supported versions of Python and systems, which is a very thorough way to check for vulnerabilities.
• But also, maybe some pointers on how to fix the problem would be good. No --fix yet.

Michael #4: Fire and forget (or never) with Python’s asyncio

• Python’s asyncio.create_task() can silently garbage collect your fire-and-forget tasks starting in Python 3.12
• Formerly fine async code can now stop working, so heads up
• The fix? Use a set to upgrade to a strong ref and a callback to remove it
• Is there a chance of task-based memory leaks? Yeah, maybe.

Extras

Brian:

• Nobody Gets Promoted for Simplicity - interesting read and unfortunate truth in too many places.
• pytest-check - All built-in check helper functions in this list also accept an optional xfail reason.
  • example: check.equal(actual, expected, xfail="known issue #123")
  • Allows some checks to still cause a failure to happen because you no longer have to mark the whole test as xfail Michael:
• TurboAPI - FastAPI + Pydantic compatible framework in Zig (see follow up)
• Pyramid 2.1 is out (yes really! :) first release in 3 years)
• Vivaldi 7.9 adds minimalist hide mode.
• Migrated pythonbytes.fm and talkpython.fm to Raw+DC design pattern
• Robyn + Chameleon package

Joke: We now have translation services