Working on infrastructure at the Python Software Foundation (PSF) as the Director of Engineering is a broad job with many hats. Python turns up everywhere. It’s in healthcare systems and government agencies, in research labs and classrooms, in one-person side projects and in infrastructure at companies with six-figure headcounts. SomebodyContinue Reading
PyPI has adopted PEP 833, which “freezes” the HTML representation of the index API, which is also sometimes called the “simple API” or the “simple repository API.” New packages and releases will continue to appear in the HTML representation, meaning this has no breaking implications for downstream index consumers. However,Continue Reading
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we areContinue Reading
Over the next few months, we will be rolling out changes to the PyPI user interface, improving how we surface security signals and updating the pages where users view package details. Updates will be staged to TestPyPI and deployed to production in phases. This approach allows our team to thoroughlyContinue Reading
Highlighting the next stage in our sidebar reorganization campaign! We are still primarily focusing on Organization Dashboards (which have the highest financial complexity) and gradually introducing changes to individual and collective dashboards. As a reminder, the intention behind this redesign is to make the platform more coherent, intuitive, and welcoming,Continue Reading
In 2023 PyPI completed its first security audit, and I am proud to announce that we have now completed our second external security audit. This work was funded by the Sovereign Tech Agency, a supporter of Open Source security-related improvements, partnering with Trail of Bits to perform the audit. ThanksContinue Reading
This post will drill deeper into two recent supply chain exploits, targeting users of popular PyPI packages – litellm & telnyx. We also provide Python developers and maintainers with guidance on what they can do to prepare and protect themselves from future incidents. What happened with LiteLLM and telnyx? AfterContinue Reading
TLDR ; We are rolling out an important improvement to how payees connect their PayPal accounts when submitting expenses on Open Collective. This update affects all fiscal hosts that use PayPal to pay expenses. Payees must now connect their PayPal account instead of typing an email. Open Collective gets theirContinue Reading
TL;DR: We are introducing a new pricing structure for Organizations. We have already been in touch privately with all impacted Organizations. The new model replaces percentage-based fees with a usage-based approach. Organizations choose a plan that matches their activity levels and needs. Hosted Collectives remain unchanged and are not subjectContinue Reading
On Tuesday, February 27 at 9:00 CET (8:00 UTC, 4:00 New York, 21:00 New Zealand), we will upgrade our production database to a higher-performance plan. As usage and data volume have grown, this upgrade is necessary to improve performance, reduce timeouts, and increase overall stability. During the migration, the platformContinue Reading