Episodi

  • #490 It’s a vibe coding party
    Jul 28 2026
    Topics covered in this episode: Some more things about Django I've been enjoyingWho cleans up after the vibe-coding party?Where Did All Your AI Tokens Go? AgentsView to the rescue!Careful with phishing allExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Some more things about Django I've been enjoying Julia Evans is learning "2010-style" web dev (Django + SQL + server-rendered HTML) after years of Go backends and JS-heavy frontendsQuery builders: likes defining custom QuerySet classes with chainable filter methods (.approved().future().with_tags()) — more readable than raw SQLTemplate filters: highlights urlize, linebreaksbr, json_script, and especially querystring for building/modifying query-string links in templatesMigrations: still loves Django's auto-generated migrations — 19 and counting on her projectSkips inheritance for class-based views; prefers function-based views for sharing code, though fine using Django's own mixins/interfacesPerformance surprise: CPU profiling (via py-spy) — not slow DB queries — revealed the culprit; she'd accidentally disabled the cached template loader, and re-enabling it took throughput from ~2-3 req/s to ~12 req/s on a $10/mo VM Michael #2: Who cleans up after the vibe-coding party? FT Magazine piece by Sam Learner (July 11) on AI coding tools overwhelming open source maintainers - sent in by listener Dylan McConnell, whose main point was that this ran in the Financial Times, not a dev blog. cURL as the case study - Daniel Stenberg has been the only full-time person on it for years; libcurl has been installed an estimated 20+ billion times with 3,000+ listed contributors.Bug bounty killed - cURL ended its paid security bounty program in January, citing an "explosion of AI slop reports" that take real time to debunk and drain morale.Extractive contributions - authoring a PR is now nearly free, reviewing one still costs a human; tldraw's Steve Ruiz closed outside contributions entirely, asking why he'd want someone else writing the easy part.Guido weighs in - van Rossum says projects are holding emergency meetings over the slop flow, and notes LLM patches tend to touch unrelated parts of a file, making review more tedious."Vibe Coding Kills Open Source" - paper from Miklós Koren's group: packages frequently recommended by coding models saw big download jumps with no matching engagement, breaking the reputation loop that sustains maintainers.Stack Overflow flatlined - over 100,000 questions a month before ChatGPT, under 1,500 last month, with the response rate cut roughly in half; the public archive is now stale training data.The course-creator angle - Josh Comeau's newest web dev course launched at about a third of prior enrollment, and he worries about devs who never learn which questions to ask. But the most interesting portion is what was omitted. Focused on: The end of the curl bug-bountyOmitted: High-Quality Chaos Why the omission is interesting It fits a narrative. The FT piece is a maintenance-and-decline story, and January-Stenberg is a perfect witness for it. April-Stenberg complicates it - same person, same project, better data, opposite direction on the specific claim being used.The tell is already in the article. Learner quotes Stenberg saying AI tools are much better at finding problems than fixing them. That's the April thesis in one line, and it goes undeveloped.Reason for the shift is process, not vibes. Killing the bounty removed the cash incentive and the venue change filtered the rest. Worth saying out loud, because "AI reports got better" isn't quite it - "no bounty plus a real triage platform" is closer. Joke too: Sarah O’Connor wrote a related piece (is this just before skynet launches?) Calvin #3: Where Did All Your AI Tokens Go? AgentsView to the rescue! Local-first desktop/web app for browsing, searching, and analyzing your past AI coding agent sessions (Claude Code, Codex, Copilot, Cursor, Gemini, Aider, and dozens more)Auto-discovers session files on your machine — no config needed; everything stored locally in SQLite, no cloud/accountsagentsview usage is a drop-in ccusage alternative — reads from pre-indexed SQLite, reports run 80–220× faster on large historiesNew Activity dashboard shows peak concurrency, active vs. idle time, agent-minutes, and cost — filterable by project/agent/machine, with a -json CLI report tooFull-text + optional semantic search across every session; ...
    Mostra di più Mostra meno
    37 min
  • #489 Or JSON?
    Jul 21 2026
    Topics covered in this episode: django-orjsonBest Django Redis configuration for speed and sizeLinus Torvalds puts the foot down against Anti-AI Kernel MaintainersDjango Steering Council backs the Triptych ProjectExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Michael #1: django-orjson Adam Johnson dropped django-orjson - drop-in replacements for the Django and DRF pieces that touch JSON, swapping stdlib json for orjson, the Rust-based library. Headline numbers: 10x faster serialization, 2x faster deserialization.The interesting question is why this needs to be a package at all. pip install orjson is the easy part. Adam's actual pitch: adopting it "isn't easy, especially when your framework uses json in many different parts." Django scatters JSON across JsonResponse, the test client and test case classes, the json_script template tag, and more. There's no single hook to grab, so you get a library that catches them all.Adam is refreshingly honest about the scale of the win. His words: "While database queries tend to dominate the typical Django application's runtime, the time spent in serialization and deserialization can still be significant." He calls it "a nearly free performance win" - not "this will 10x your app." That's a claim about cost, not magnitude, and it's worth keeping those straight.Worth flagging what the post doesn't cover: caveats. There are none in the article, but orjson has real ones. Django and Flask both render datetimes as RFC 822 HTTP-date (Wed, 15 Jul 2026 12:00:00 GMT); orjson does ISO 8601. It can't do ensure_ascii, it rejects NaN and Infinity (which stdlib happily emits), and it raises on Decimal. If you've got a JS client parsing dates, that's a wire-format change.Who should actually take this? If you're a DRF shop shoveling JSON all day, yes - it's cheap and it's real. If your app mostly renders HTML templates, you're optimizing a slice of runtime that's already near zero.The problem Adam's package solves doesn't exist in Flask or Quart. They already centralize every JSON operation - jsonify, request.get_json(), the test client, the |tojson filter - behind one provider object at app.json. So there's no library to install. It's about ten lines: import orjson from quart.json.provider import JSONProvider # or flask.json.provider class OrjsonProvider(JSONProvider): def dumps(self, obj, **kwargs) -> str: return orjson.dumps(obj).decode() # provider must return str def loads(self, s, **kwargs): return orjson.loads(s) app.json = OrjsonProvider(app) The numbers on talkpython.fm Evaluated it, measured it, and skipped it. The biggest JSON payload we serve is our MCP server returning a cached episode transcript, about 139 KB. Swapping the provider saves 0.119 milliseconds per request. That total response takes 1.1 msWe got 4.1x, not 10x - and the reason is the good lesson. Payload shape decides your speedup. The 10x is for structure-heavy data, lots of small keys where stdlib burns time in Python-level dispatch per item. Our hot payload is one giant transcript string, so the work is escaping and memcpy Calvin #2: Best Django Redis configuration for speed and size Peter Bengtsson revisits a classic: his 2017 "Fastest Redis configuration for Django" benchmark now has a 2026 update posted this week.The 2017 post pitted django-redis serializers (json, ujson, msgpack, pickle) and compressors (zlib, lzma) against each other; conclusion was msgpack + zlib as the sweet spot - avoid the json serializer, it's fat and slow.The 2026 update narrows focus to just compressors: default (no compression), zlib, lzma, and newcomer zstd.New results: lzma compresses best but is slowest; zstd is the fastest compressor on Ubuntu; differences between them are very small.Big takeaway across both: compression buys you a lot of space (2–3.5x smaller) for very little speed cost - worth it for Redis where memory is the constraint.Caveat from the author: results depend heavily on your data - his test stores short strings of numbers, so benchmark your own workload. Michael #3: Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Write up on Ars.Really good coverage by Maximillian: Time to wake up (for some)Torvalds said that “Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away.”I agree with Max, putting your head in the sand and waiting for AI to go away will likely mean you won’t be working professionally in software development in the coming years.The statement came amid a lengthy thread arguing about the use of Sashiko, an “agentic ...
    Mostra di più Mostra meno
    31 min
  • #488 tau - it's 2pi and it writes code
    Jul 14 2026
    Topics covered in this episode: The trusted-publishing debate: how to do it right vs. why you shouldn't trust itJupyterLab 4.6 and Notebook 7.6 are out!Tau – new small, readable terminal coding agentDjango Tasks and Django 6.1ExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/ (Brett Cannon) and https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing (William Woodruff) Trusted Publishing (PyPI's OIDC-based auth scheme, also now used by npm, RubyGems, crates.io, NuGet) replaces long-lived API tokens with short-lived, auto-scoped credentials tied to CI/CD machine identity.Yossarian's post: it's purely an authentication mechanism between a machine identity and a package — it says nothing about package safety or quality. PyPI deliberately avoids any "verified/trusted" badge for it, unlike its verified-URL checkmarks.Same logic applies to PyPI attestations: anyone can sign with any machine identity they control, so an attestation's presence isn't itself a trust signal.Bottom line from that post: don't confuse "trusted" (machine-to-machine) with "trustworthy" (human judgment about the package).Snarky.ca's companion piece is more practical: given GitHub Actions compromises in the news, the real fix is 3 concrete steps — run zizmor to lock down workflow permissions/checkout credentials and pin actions to commit hashes, adopt Trusted Publishing to eliminate stored PyPI tokens, and require manual approval via a GitHub environment before any publish job runs.Takeaway for listeners: Trusted Publishing is good hygiene for how you authenticate to PyPI, but it's not a substitute for securing your CI pipeline itself — or for actually vetting the packages you install. Michael #2: JupyterLab 4.6 and Notebook 7.6 are out! Michał Krassowski's rundown - a chunky minor release: 68 features, 97 bug fixes, 95 contributors, one of the biggest ever. Scratchpad console (Notebook 7.6 headliner) - a console next to your notebook sharing its kernel, for throwaway experiments. Ctrl+B.Jump to last-edited cell - new commands hop through recently edited cells.File browser glow-up - Date Created column, editable breadcrumbs with Tab-completion, and Open in Terminal.Debugger - sources open in the main area, floating step/continue overlay, live kernel-sources filter.Custom layouts (Lab) - activity bar top/bottom, draggable panels, four-way tab splits, per-panel Ctrl+scroll zoom.~5x faster extension builds - webpack → Rspack, and jupyter-builder means no full Lab install needed to build extensions.Keyboard/a11y - add shortcuts from the UI (no JSON), Find & Replace in Edit menu (Ctrl+H). Calvin #3: Tau – new small, readable terminal coding agent Tau – new small, readable terminal coding agent (Python 3.12+), built as both a working tool and a teaching project for how coding agents work under the hoodInstall via uv tool install tau-ai, pipx, or pip; ships a tau CLIThree-layer architecture: tau_ai (provider-neutral model layer) → tau_agent (reusable "brain": messages, tools, events, loop) → tau_coding (CLI/TUI, file & shell tools, sessions)Supports OpenAI, Anthropic, OpenAI Codex, OpenRouter, Hugging Face, and custom/local OpenAI-compatible endpointsBuilt-in tools (read/write/edit/bash), durable JSONL sessions with resume/branching, project instructions via AGENTS.md, and context compactionCore harness is UI-agnostic — same brain can power the TUI, print mode, or a custom frontend — usable as a standalone library too Michael #4: Django Tasks and Django 6.1 Django 6.0 finally ships first-party background tasks (django.tasks) - out of Jake Howard's DEP 14, accepted May 2024, after two decades of everyone bolting on Celery/RQ/Huey.It's an API, not a worker. Django handles task definition, validation, queuing, and result storage - it does not execute them. You bring the backend.The default backend traps people. ImmediateBackend runs tasks inline on the request thread and blocks until done - so out of the box .enqueue() backgrounds nothing (a 5-second task means a 5-second response). The other built-in, DummyBackend, runs nothing at all. Both are dev/test only.Nice API otherwise: slap @task on a function, call .enqueue(), get back a TaskResult you look up later by id - with async twins like aenqueue(). Gotcha: ...
    Mostra di più Mostra meno
    32 min
  • #487 Minimum requirements
    Jul 7 2026
    Topics covered in this episode: dust - a better duHermes Agent: The AI agent that grows with youllm-coding-agent 0.1a0ExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: dust - a better du du + Rust = dust - a fast, visual, intuitive disk-usage CLIRun dust and immediately see the biggest directories and files without piping through sort, head, or awkSmart recursive output focuses on what matters instead of dumping every folderColored bars show relative size and parent/child hierarchy, making “where did the space go?” obviousPerfect for Python projects bloated by .venv, caches, Docker volumes, downloaded datasets, and local AI modelsInstall via brew, cargo install du-dust, conda-forge, Scoop, Snap, deb-get, or GitHub releases Calvin #2: A Way better ARchive format for Python packaging war - new archive format spec from Astral (same team as uv/ruff), v0.0.2, still no binary encoding defined yetHeader-Index-Store layout: header IDs the file, index maps names to store offsets, store holds compressed dataIndex uses a finite-state transducer (FST) to dedupe common path prefixes across entry namesSupports three entry types (file, directory, link) and three compression modes (store/DEFLATE/zstd), plus an "executable" metadata flagUnpacking is atomic - writes to a temp dir, then renames into place, so a failed extract never leaves a half-unpacked directoryStrict name-segment rules (no NUL/control chars, no leading/trailing whitespace, blocks Windows-reserved names like CON/PRN) to avoid path traversal and cross-platform footguns Michael #3: Hermes Agent: The AI agent that grows with you Hermes Agent is an open-source, Python-built AI agent framework from Nous Research - think ChatGPT-style assistant, but connected to your tools, files, shell, browser, calendar, memory, and messaging appsI’m using it in Discord as a long-running agent conversation, not just a one-off chatbot sessionHermes can connect through a gateway to platforms like Discord, Telegram, Slack, WhatsApp, email, webhooks, and more - so the same assistant can follow you across surfacesIn my setup, I can send Hermes voice/text from Discord, keep project context across turns as threads, and ask it to actually do things: read GitHub repos, run commands, edit files, schedule calendar events, generate drafts, and verify resultsA fun workflow: I can trigger one-shot actions from an Apple Watch shortcut - dictate a request, send it to Hermes, and have the agent execute it asynchronouslyHermes has persistent memory, so it can remember durable preferences and facts - for example, how I like my research formattedIt also has “skills,” which are reusable procedures the agent can load later, so Hermes can self-improve over time instead of rediscovering the same workflow repeatedlyIt supports scheduled jobs / cron-style automations, so it can proactively watch for releases, send summaries, run checks, or remind you about thingsIt’s provider-agnostic: OpenRouter, Anthropic, Google, xAI, local models, Nous Portal, and othersThe big idea: Hermes turns an LLM from “a chat box I visit” into “an agent I can reach from anywhere that knows my workflows and can take real actions and learns over time.” Calvin #4: llm-coding-agent 0.1a0 Simon Willison built a Claude/Codex-style coding agent on top of his llm library, using an alpha of the llm package plus his python-lib-template-repoBuilt almost entirely via prompted TDD - asked an agent to write a spec.md, then commit + implement with red/green tests, occasionally hitting a real OpenAI key to sanity-checkShipped to PyPI as an alpha: uvx --prerelease=allow --with llm-coding-agent llm codeTool set mirrors familiar coding-agent primitives: read_file, edit_file (exact string replace + diff), write_file, list_files, search_files, execute_commandAlso exposes a Python API - CodingAgent(model="gpt-5.5", root=..., approve=True).run(...) - which Simon didn't ask for but got anywayDemo: llm code --yolo told GPT-5.5 to build a SwiftUI CLI clock; model correctly noted SwiftUI isn't really CLI-friendly and still produced an ASCII-art time display Extras Calvin: Slides, but for developers https://sli.dev/Wanna reduce your token usage…. only issue is that its lossy https://github.com/teamchong/pxpipePEP 772 - Python Packaging Council inaugural election dates set, nominations open July 28, voting September 1-15 Michael: What the pls? revisited! Joke: Min requirements for ...
    Mostra di più Mostra meno
    28 min
  • #486 underscore-underscore-ghost-emoji
    Jun 30 2026
    Topics covered in this episode: Free-threaded Python: past, present, and futuredjango-admin-site-searchQwen 3.6 27B is the sweet spot for local developmentA large batch of PEPs are finalizedExtrasJokeWatch on YouTube Show Intro Sponsored by us! Support our work through: Our courses at Talk PythonConsulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Free-threaded Python: past, present, and future The GIL has prevented true multi-threaded parallelism in CPython since the beginning — multiple past attempts to remove it failed on performance groundsSam Gross at Meta finally solved it; his work became PEP 703 and ships as free-threaded CPython todayPython 3.13 was experimental with 20–40% single-threaded slowdown; 3.14 brought that to 0–10%Python 3.15 (October 2026) delivers a unified ABI — one extension binary works on both GIL and free-threaded buildsAlready >50% of the top PyPI binary wheels support free threadingWouters predicts free-threaded becomes the default between 3.16–3.20 (2027–2031), with the GIL eventually disappearing next decade Michael #2: django-admin-site-search via Adam ParkinA global/site search modal for the Django admin, by Ahmed Aljawahiry. Hit cmd+k anywhere in the admin and you get a command-palette-style search window, kind of like the one in VS Code.It doesn't just search one model's list page. It searches your entire site in one box: App labelsModel labels and field attributesActual model instances (your data)Two ways to search the instances: model_char_fields (the default): runs an __icontains across every CharField (and subclasses) on the model. Zero config, works out of the box.admin_search_fields: defers to each ModelAdmin's existing get_search_results(), so it respects the search_fields you've already set up.The part I like: it's permission-aware out of the box. Users only see results for the apps and models they actually have view permission on, so you're not leaking anything through search.Results appear as you type, with throttling/debouncing so you're not hammering the server on every keystroke, and it's full keyboard nav: cmd+k to open, up/down to move, enter to go.It's responsive, does dark and light mode, and it pulls Django's built-in admin CSS variables so it just matches whatever admin theme you're running.Under the hood it's Alpine.js, but bundled into static so there's no external CDN dependency.Setup is about what you'd expect: pip install django-admin-site-search, add it to INSTALLED_APPS, mix the AdminSiteSearchView into your AdminSite, and drop a few template includes into base_site.html.Supports Python 3.8 through 3.14 and Django 3.2 through 6.0, MIT licensed, and everything is overridable if you want to skip certain models, add TextField matching, etc. Calvin #3: Qwen 3.6 27B is the sweet spot for local development Qwen 3.6 27B is being called the first local model that genuinely competes as a general-purpose intelligence — benchmarks put it at roughly mid-2025 frontier level (comparable to GPT-5 / Claude Sonnet 4.5)Runs locally via llama.cpp; on an M5 MacBook Max with 8-bit quantization + multi-token prediction, it hits ~32 tokens/sec using ~42GB RAM4-bit quantization gets it under 18GB, runnable on 32GB devices; Nvidia RTX cards run it even fasterThe dense 27B is recommended over the faster MoE 35B A3B — author prefers higher quality output over raw speedPrivacy and reliability are the pitch: fine-tunable, can't be taken down, suitable for sensitive/proprietary dataAuthor sees this as a stepping stone — frontier open-weight models like GLM 5.2 are now locally runnable with company-grade hardware, and smarter-still local models are coming Michael #4: A large batch of PEPs are finalized A bunch of PEPs went from accepted to final. 668, 687, 691, 699, 701, 703, 728, 770, 773, 829But this wasn’t them making their way into CPython. It’s an admin sorta thing. (Thanks PyCoders)See the commit. Extras Calvin: More fun bling for your terminal this time - https://charm.land/ Michael: Follow up from pls, What the pls? Thanks Pito. Joke: BEMoji A production-grade utility and component framework built entirely on emoji class namesvia Jeff Triplett
    Mostra di più Mostra meno
    30 min
  • #485 Creating memories
    Jun 23 2026
    Topics covered in this episode: Backup Docker volumes locally or to any S3Pyodide 314.0 Releasenb-cli: A Command-Line Interface for AI Agents and Notebook AutomationHindsight Agent Memory That LearnsExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk PythonAWS Community Day Midwest tomorrow Wednesday the 24th in downtown Indianapolis, Six Feet Up is sponsoring and there are 2 Sixies presenting Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedInCalvin: Mastodon / BlueSky / X / LinkedInShow: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an bonus digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Backup Docker volumes locally or to any S3 Via Bryan Weber (thanks Bryan!), who spotted it over on Virtualization HowTo. Find Bryan at bryanwweber.com.offen/docker-volume-backup is a lightweight companion container that backs up the volumes your apps actually depend on, then ships them somewhere safe.It's tiny: written in Go and about 25MB compressed, roughly 1/20th the size of the shell-based image (jareware/docker-volume-backup) that inspired it.Drop it into your docker compose file as a backup service, mount the volumes you care about as read-only, and you're off.Push backups to a pile of destinations: a local directory, plus any S3, WebDAV, Azure Blob Storage, Dropbox, Google Drive, or SSH-compatible target. Mix and match as many as you want in one run.Recurring cron-style backups in a Compose setup, or one-off backups straight from the Docker CLI.Production-friendly touches worth calling out: Rotates away old backups so you don't quietly fill the disk.GPG encryption for your archives.Notifications on finished and failed runs (so you find out about failures before you need the backup).Stop a container during backup for a consistent snapshot using a simple docker-volume-backup.stop-during-backup=true label, then auto-restart it.Run custom commands during the backup lifecycle (great for a database dump before the file copy).Docker Swarm support, plus arm64 and arm/v7 builds. Hello, Raspberry Pi homelab.Fun aside from Bryan: he searched our back catalog for this tool and the search came back so fast he thought it hadn't run. Love to hear it. Calvin #2: Pyodide 314.0 Release PEP 783 is the real news — Pyodide maintainers used to hand-build 300+ packages. Now anyone can publish Pyodide wheels to PyPI with cibuildwheel.The version jump from 0.29 to 314.0 is intentional — it now tracks the Python version, so 314.x = Python 3.14. Binary compatibility is locked per Python cycle, meaning packages you build today won't break on the next Pyodide release.sqlite3, ssl, and lzma are back in the default stdlib — no more await pyodide.loadPackage("sqlite3"). Bigger download, but a much smoother experience for newcomers.bigint precision bug is fixed — values above 2^53 were silently losing precision when crossing the Python/JS boundary. The new JsBigInt type makes the roundtrip correct. Worth flagging if anyone is doing numeric work in a browser app.Experimental TCP sockets in Node.js — you can now connect Pyodide to a real database (MySQL, PostgreSQL, Redis tested) when running server-side. Blurs the line between "Python in the browser" and "Python runtime anywhere Wasm runs." Michael #3: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation From Piyush Jain (Jupyter and LangChain maintainer) on the Jupyter blog: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation.nb-cli is an experimental, Rust-based CLI to read, write, execute, and search Jupyter notebooks. The premise: agents are great at CLIs but terrible at hand-editing the nested JSON in an .ipynb, so let them operate on the notebook from the outside instead of running inside it.Works with or without a Jupyter server. No server? It reads/writes .ipynb files directly and talks to kernels over ZeroMQ. Connected to a live JupyterLab, your edits show up instantly via Y.js (the same CRDT Jupyter uses).Smart output format: instead of token-heavy JSON or ambiguous plain markdown, it uses @@cell / @@output sentinels with inline metadata. Less wasted context, unambiguous structure, and it degrades gracefully on truncation.The payoff is composability. "Add a summary section and run it" becomes one shell pipeline instead of six agent tool calls. And nb search notebook.ipynb --with-errors returns only the failing cells, so the agent skips the cells that worked.Claude Code tie-in: it ships as an agent skill. npx skills install jupyter-ai-contrib/nb-cli and your agent can drive notebooks via nb.Out of jupyter-ai-contrib, which aims to become an official Jupyter AI subproject. Still early (crates.io is at v0.0.5), so kick the tires before anything...
    Mostra di più Mostra meno
    38 min
  • #484 All our tools
    Jun 16 2026
    Topics covered in this episode: pi + superpowersTerminal: Warp.dev + OhMyZSH{Blink,kitty} + mosh + tmuxClaude codeMacWhisper or HandyTailscaleExtrasJokeWatch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python TrainingSix Feet Up is hosting a LinkedIn Live Connect with the hostsMichael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky)Calvin: @calvinhp@sixfeetup.social / @calvinhp.com (bsky)Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: pi + superpowers terminal-first, open-source coding agentSession management is a first-class citizenExtension model is what makes pi special — it's aggressively composableSuperpowers brings a structured software development methodology as loadable skillsSteps back and asks you what you're really trying to do“hand you the keys to the car” mode vs guardrails might not be for everyone Michael #2: Terminal: Warp.dev + OhMyZSH If you’re using the base terminal with default settings, you have so much head-room for improvement.I’ve been using Warp.dev since Elvis talked me into it. ;)Remarkable terminal but the AI side of things is a bit junky, can be turned offOhMyZSH gives better autocomplete e.g. git branch [HTML_REMOVED] lists all branches in the local repo!Commandbookapp.com is excellent to keep the terminal focused on terminal things and more server commands and other automation in Command Book. Calvin #3: {Blink,kitty} + mosh + tmux Kitty Terminal — GPU-accelerated terminal emulator for macOS, Linux, and Windows with support for graphics, ligatures, and a powerful tiling layout system built right in.Blink Shell — The go-to terminal for iPad/iPhone power users; full SSH and Mosh client with a gorgeous interface built specifically for mobile professional workflows.Mosh — Mobile Shell replaces SSH for remote connections, surviving network switches, sleep cycles, and flaky Wi-Fi with zero dropped sessions — essential for staying connected to long-running agentic jobs.tmux — Terminal multiplexer that keeps sessions alive on your Linux server indefinitely; detach from a Mosh session on your Mac, reconnect from your iPad, and your agent is right where you left it.The combo — Kitty or Blink + Mosh + tmux creates a "persistent remote brain" pattern: your beefy Linux homelab runs the compute-heavy agent sessions 24/7, and any device becomes a thin client to drop in and out at will. Michael #4: Claude code I prefer the IDE experience, the new PyCharm + Claude integration is really good. VS Code too. Why IDE? Because we should still be present with our code and managing context is much easier.Use the best/latest models on high thinking. “Speed” is not your friend, it’s just shortcuts.Create skills and agents and use them.Curate your own rules (e.g. Talk Python’s Claude.md)Works well on non-coding things. Just create a folder, put a ton of files in there and it’s like NotebookLM + Chat + more. Calvin #5: MacWhisper or Handy Transcribes your speech using your choice of Whisper or Parakeet models.All transcription is done on your device, no data leaves your machine.Automatic Speaker Recognition with local models.Handy is more basic, but open source and runs on all platforms. Michael #6: Tailscale No need to open ports at all, Tailscale makes machines inside the same network accessible to each otherWorks great for laptops, desktops, etc. But also available for servers. Though I still use cloud firewalls for servers.How I use it: My dev database server, preloaded with QA data, is always running on my home mac mini m4 pro. All my apps look for that server before looking locally and tailscale makes them always accessible to each otherMy local LLMs expose OpenAI API compatible APIs. Tailscale makes these accessible even while traveling or at a coffee shop.Use my mini as an exit node. All traffic is routed outbound from my local fiber network. Great to restricted IPs like accessing my servers without caring about the local IP.Screen share back to my home machines even while traveling.Listen to the Talk Python episode with Alex for a deeper conversation. Extras Calvin: Telescopo great Mac Markdown viewer/editor. Michael:One more: Typora markdown editor.Created formal documentation for many of my open source packages using Great Docs.Via Mark Little: Statement on the US government directive to suspend access to Fable 5 and Mythos 5 Joke: No second date
    Mostra di più Mostra meno
    50 min
  • #483 Thanks Brian
    Jun 9 2026
    Topics covered in this episode: Vulnerability and malware checks in uvHTTP GET requests with the Python standard libraryMillions of AI agents imperiled by critical vulnerability in open source packagealembic-git-revisionsExtrasJokeWatch on YouTube About the show Goodbye and Thanks Brian Thanks Calvin for being part of this and future episodes! Also new time for the live show. Thanks Brian for all the hard work over the years. Calvin #1: Vulnerability and malware checks in uv release just yesterday by Astral https://astral.sh/blog/uv-audituv audit scans dependencies for known vulnerabilities and abandoned packages via the OSV database — runs 4–10x faster than pip-auditMalware check runs on every install/sync, catching actively malicious packages (credential stealers, etc.) before they execute — including ones PyPI quarantined but lockfiles can still referenceEnable malware scanning with UV_MALWARE_CHECK=1 — it's opt-in and in previewFuture roadmap includes a resolver that steers toward vulnerability-free versions and install-time warnings scoped to newly added deps only Michael #2: HTTP GET requests with the Python standard library If you’re doing HTTP in Python, you’re probably using one of three popular libraries: requests, httpx, or urllib3.There have been issues with httpx lately.Niquest is another option: Drop-in replacement for Requests. Automatic HTTP/1.1, HTTP/2, and HTTP/3. WebSocket, and SSE included.But maybe less is more, especially in the age of agentic AIA good candidate needs two things to be true at once, not one: the used surface is small, and the behavior behind that surface is shallow. Calvin #3: Millions of AI agents imperiled by critical vulnerability in open source package "BadHost" (CVE-2026-48710) is a critical vulnerability in Starlette — the ASGI framework underlying FastAPI — with 325 million weekly downloads; also affects vLLM, LiteLLM, and most MCP server toolingThe exploit is trivial: injecting a single character into an HTTP Host header bypasses path-based authentication, and can lead to credential theft, SSRF, and in some cases remote code executionMCP servers are a prime target since they store credentials for external services (email, databases, cloud accounts) — exposed data in the wild includes biopharma clinical trial DBs, full mailboxes, HR/PII pipelines, and AWS topologyFix is available — patch to Starlette 1.0.1 immediately; use the free scanner at mcp-scan.nemesis.services to check if your servers are still running a vulnerable versionOpen source sustainability footnote: the maintainer triages near-daily security reports solo, in his free time — most are AI-generated noise, and real ones like this still compete for the same evenings and weekends Michael #4: alembic-git-revisions By Julien Danjou from MergifyAutomatic Alembic migration chaining based on git commit history. No more Multiple head revisions are present for given argument 'head'.See the introductory articleCaused by two migrations landed with the same down_revision, and Alembic doesn’t know which one comes first. The fix is always the same: someone manually edits the migration file to re-chain the revisions.The insight: git already knows the order Extras Calvin: GNU make can do pattern matching in the target. Not new at all, mentioned in the 1994-era docs. just and task don’t have this super power on the target name yet. train-%: uv run ./train.py $* --save-hyper-params --overwrite $(TRAIN_ARGS) Michael: Updated my HTTP client using packages from httpx to httpx2: listmonk, umami, and memberful. For motivation, see this reddit thread. Joke: Accurate
    Mostra di più Mostra meno
    29 min