Here’s a seemingly simple question: given a chunk of multi-line text, how do you split it and return an array …

YouTube video by EuroPython Conference

I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.

The next decade will challenge many assumptions in Python security. Join us for a session of speculation on secxuring the next decade.

There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say "GitHub Actions is the weakest link" in publishing and to GitHub publish...

Find vulnerabilities in your Python dependencies with uv audit and prevent installation of known malware with uv's experimental malware detection.

Insights and guidance from our engineering team on how Astral secures its tools.

ty is an extremely fast Python type checker and language server, written in Rust, and designed as an alternative to mypy, Pyright, and Pylance.

GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning

PyCon US 2026 is coming to Long Beach, California ! PyCon US is the premiere conference for the Python programming language in North Americ...

Find and fix potential vulnerabilities in your GitHub workflows and action definitions with zizmor's powerful static analysis.

Shai-Hulud is a great worm, not yet a snake. Attack on npm ecosystem may have implications for PyPI.

Take the 2025 Python Packaging Survey if you still haven't! Important🚨 This release includes fixes for GHSA-vxmw-7h4f-hqxh discovered by @woodruffw💰. We've also integrated Zizmor to catch similar i...

There was a bug in an OpenPGP library which finally gave us an excuse to tear encrypted email via PGP to shreds. Our special guest William Woodruff joined us...

PyPI has implemented PEP 792, and is now serving project status markers in its standard HTML and JSON APIs.

Abbreviated change notes about each zizmor release.

In order to harden our infrastructure and pipelines, we have introduced the open source tool Zizmor into our CI/CD pipelines.

Abbreviated change notes about each zizmor release.