Python Bytes - #502 Introducing chameleon-rs

Episode Date: October 27, 2026

Topics covered in this episode: PHP wasn’t the only problem last week chameleon-rs Bringing uv and ty together Stlite runs Streamlit apps entirely in the browser Extras Joke Watch on YouTube About the show Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: PHP wasn’t the only problem last week Three security incidents in one week, each at a different layer: CA trust (eMudhra), the release pipeline (LiteLLM) and a C decoder (Brotli). All three have fixes released. eMudhra CA: the keys of a compromised eMudhra intermediate CA are now distrusted by CPython. 3.15.1, 3.14.9 and 3.13.17 shipped Oct 21. 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 followed Oct 26 (CVE-2026-115557) and also fix a tarfile filter bypass. Python's post says pip operations are safe even before pip is upgraded. eMudhra, tooling: pip 26.2.2 bundles certifi 2026.10.19, which removes the root. uv 0.13.4 (GHSA-hq85-5cpj-mr62) and 0.13.5 (rustls-webpki 0.103.16) are the uv fixes. After upgrading uv, run uv python upgrade. Existing venvs need pip upgraded by hand, and the 3.9 and 3.10 builds still bundle a pip that trusts the root. Anyone holding those intermediate keys can mint certificates for any domain that an unpatched client will accept as valid. That enables man-in-the-middle attacks: reading or altering HTTPS traffic without a certificate warning. The risk is highest where the attacker can sit on the network path, such as hostile Wi-Fi, a compromised router or ISP, or a cloud network position. For Python specifically, the exposed traffic would be package downloads from PyPI, API calls with credentials or tokens, and webhooks. A tampered package download is the worst case. Containers and old venvs that nobody rebuilds are where this lingers. uv says its Python 3.9 and 3.10 builds still bundle a pip that trusts the root, and existing venvs don't pick up the fix automatically. LiteLLM 1.107.0: malicious wheels hit PyPI on Oct 21. All seven wheels were live from about 11:40 to 13:23 UTC, with roughly 49k downloads. The Docker images were also infected. It's the second LiteLLM compromise this year, after 1.82.7 and 1.82.8 in March. LiteLLM payload: cook.pth runs on every Python start, so nothing has to import litellm. It steals SSH, cloud, browser, CI and AI-tool credentials, and an hourly loader runs remote code. The clean pin is litellm==1.106.4. Kill the loader first, rebuild rather than repair, then rotate everything the host could reach. LiteLLM root cause: a master key committed to a public repo on May 27 was never revoked. On Oct 10 it yielded an org owner's GitHub CLI token. The attacker then changed the trusted release workflow to build from a lookalike Berri-AI/litellm repo. BerriAI's first explanation (tokens in logs) was wrong, and the Oct 23 report supersedes it. Broccoli2Shell: CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder. It affects the Python Brotli and brotlicffi packages 1.0.3 through 1.2.0(.x). Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0. The CVE was published Oct 22 and rated 9.2 Critical by GitHub. Broccoli2Shell workaround: if you can't upgrade, uninstall both packages. urllib3, requests and aiohttp then fall back to gzip and deflate. Also reject Content-Encoding: br request bodies at the proxy or WAF. Sources https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/ https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer https://broccoli2shell.com/ Michael #2: chameleon-rs Chameleon templates, much faster than before (up to 70x faster on start) Modernized: A Rust engine that runs your Chameleon templates unchanged with async rendering, partials (think HTMX), Markdown Built-in framework support: Flask, Quart, FastAPI, Starlette, Pyramid, Robyn and Litestar integrations. A compatibility shim for testing out quickly: chameleon_rs.compat.install() AI agent support via docs (every doc page has a .md extension variant, eg FastAPI docs) and the skill is installable or downloadable. Byte-for-byte identical on every page for talkpython.fm and training.talkpython.fm Passes 100% of the unit tests of the original chameleon project. See compatibility page. Natively supports my chameleon-flask, fastapi-chameleon, and chameleon-partials libraries. Swapping Talk Python Training to chameleon-rs made it 20% fast (end-to-end, not just template rendering)! Calvin #3: Bringing uv and ty together Status: Astral (Sara Sklenka, Oct 13) announced "an experimental integration between uv and ty, available in preview." They ask for feedback, and say "in parallel, we're continuing toward ty's stable release." uv check: a new uv command that prepares the project environment, installs dependencies and runs ty. Flags are --package [HTML_REMOVED], --all-packages and --script example.py. Ruff support is planned, so lint and type check would run in one command. Lockfile pinning: uv check uses the ty version recorded in your lockfile. Developers and CI therefore share one ty version without separate pins. PEP 723 scripts: ty reads inline script metadata and uses uv to build an environment per script. Each script is checked against its own declared dependencies, even when they differ from the project's. In the editor, saving a script syncs it with uv. Enabling it: running uv check turns it on automatically. In VS Code, install the astral-sh.ty extension and set "ty.experimental.useUv": "on". On the command line, run TY_UV=scripts ty check. Opt-in: the post says automatic environment setup "is currently opt-in" because installing dependencies can execute third-party code. Astral plans to enable script support by default over time, and automatic setup for standard projects. Under the hood: it's powered by uv workspace metadata. uv 0.13.6 (Oct 26) changed that preview output to nest each module's owners in an object, so anything parsing the old flat structure breaks. Versions: it needs uv 0.12.3+ and ty 0.0.76+. Current releases are past both (uv 0.13.6, ty 0.0.92 on Oct 26), though I couldn't confirm 0.0.76's exact date. Next: Astral says it's working on checks that combine uv's dependency knowledge with ty's code analysis, such as detecting unused dependencies. Also credit to listener Sky Kasko. :) Michael #4: Stlite runs Streamlit apps entirely in the browser Streamlit is a very unique way to create data-driven dashboards. Stlite is a WebAssembly port of Streamlit built on Pyodide, so a Streamlit app runs completely in the visitor's browser with no Python server behind it. It ships as three packages (@stlite/browser for web pages, @stlite/desktop for offline desktop apps, @stlite/react for embedding in React), plus Stlite Sharing, a hosted editor for trying apps online. The project has been active since 2022 and is now at 0.85.1 with sponsorship from Streamlit/Snowflake and TestMu AI. A Streamlit app becomes static files you can host anywhere, the same story JupyterLite tells for notebooks. Deployment shrinks to a script tag or a single HTML file; the server only serves static assets and never runs Python. It patches requests and urllib through pyodide-http and supports pyfetch, so most existing HTTP code keeps working. Real limitations: time.sleep is a no-op in favor of asyncio.sleep, asyncio.run breaks, and packages with unported binary extensions cannot install. Files default to ephemeral memory, but IDBFS mountpoints persist data across reloads in the browser's IndexedDB. A SharedWorker mode lets multiple apps share one Python runtime to cut memory, at the cost of shared state between apps. The @stlite/desktop bundler turns an app into an offline desktop executable, demonstrated converting Streamlit apps to .exe files. Extras Calvin: Real Python Podcast #316 with Seth Larson on Python security **PSF wikis relaunched on GitHub Pages** Michael: PHP ships emergency patches for critical PHP2Shell flaws OpenAI released a checker Talk Python Next Tech Talk: Talk Python in Production(v2) Notable ZeroVer Projects via Vincent Poulailleau Python 3.15.2 is out Joke: captcha: too real!

Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds. This is episode 502 recorded Tuesday, October 27th, 26. I'm Michael Kennedy. And I'm Calvin Hendricks Parker. And this episode is brought to you by us. If you have hard problems and you want a team you can trust six feet up, just get in touch with Calvin and his team. They're doing amazing work, have been for 20 years. And if you want to learn some Python things, check out Talk Python training, or you want to support support the show over there at Talk Python you can join membership I have a few announcements from that as well connected with us on the socials join the newsletter all those things are on the website now Calvin it's it's been a week it's been a week it's been a crazy week I was traveling last week and all this hit while I was

like either in the air or someplace exotic and strange but yeah and php wasn't the only problem so if you haven't heard there was a php vulnerability a major one last week, but that's not what I'm going to talk about. There were three different incidents also that affected the Python ecosystems that you all need to be aware of, and each of a different layer. So if you're not familiar with certificates and trust authorities and certificate authorities, there was a major vulnerability there in the trust layer. There was also a vulnerability in the release pipeline again with light LLM. And then we had a C-decoder issue that also led to an RCE with the Brodley Library from what defined folks at Google.

But let's dive in. So the E. Madura CA, the keys got compromised. And so if you were using a Python older than the ones that are listed in the release right here. So I think it's like the dot 2, the dot 10, the dot 18, et cetera. So basically 315 through 311 have all been patched, all been fixed and corrected. UV also has been fixed and updated. But you'll notice 3.10, not in the list. This is probably the first very large thing you need to watch out for for 39 and 310.

You're not out of luck, though, because as long as you upgrade PIP, I believe, and certify, you'll get the latest bundles into your older versions of Python, but you've got to go do that yourself. The other folks have done all the patching for you and made all the releases, so make sure you grab the latest versions of that. So why does this matter? When a certificate authority gets compromised like this, Anyone who has these intermediate keys can basically mint certificates for any domain and any unpatched client who has these certificates in their CA will accept them as valid. That means you are now susceptible to man in the middle attacks, you know, basically reading

and altering HTTP traffic without a certificate warning. Pretty bad stuff. If you consider like the world of Python and any version of Python before this, I had those intermediates in there, is now susceptible to reading and data from an untrust. source who will think it's trusted. So that's something you's, everyone needs to be obviously on the hook for is making sure we should all stay safe out there.

So specifically like for Python, you could be downloading a susceptible package from Pi or Pi Pi and get something malicious because the credentials will, it looks real, but it's not. It's not real under the covers. So that one, make sure you grab that latest release. Any existing virtual environments, you're going to need to make sure you upgrade those as well because they don't pick it up automatically. So if you did UV and upgraded your UV and did UV reinstall the Python version,

any virtual environments created by that Python version still need to be updated. So grab those, grab the latest, and make sure you're safe. I actually noticed this. I didn't realize what it was for, but I noticed this because I have a script that just updates my homebrew, my NPM, my UV installed tools. And one of the things I've recently added, I've actually added two things, is one, just UV Python upgrade will do a build level upgrade of all of your installed pythons without changing anything. And I think without breaking your virtual environments. Nice. Yeah. And there's another there's actually another fix in here too around some tar file stuff too. Yeah,

reject cookies in a negative assertion. Oh yeah, the tar file tar filter. So there was more than just the CAs in this release, two other CVEs, but none as important as the CA one that's bundled in here. The next one was on the build side. The build side of this, which is light LLM again is in the news. They got compromised back in March. They also just gotten the build got compromised. There was a version of light LLM that hit PPI. It was up for about two hours, roughly 49,000 downloads. So, which is kind of sad. Folks should make sure that they are using the back off in their pipelines to install not the absolute latest and greatest. You may want to wait, have it back off a few days and only grab versions.

that have been released for, well, at this point, if you had at least three hours in there, you had been fine and gotten the patched version of it. Docker images were also infected. They basically, and I think the big question here is, why does this keep happening to LLM? I mean, it's twice this year. The attackers are relentless. They are looking for exposed credentials, and that's how they got in this time. They were able to find a key that didn't get revoked.

There was a force push that included trying to fix for a key that got published accidentally. but they never revoked that key. They were able to use that then to have the pipeline push keys like tokens from actual maintainers to a third-party source where they were able to collect them. And then they were able to trigger the build pipeline, removing branch protections, et cetera, because they had admin privileges. So again, make sure your build tokens have least privilege so they can't do things like remove branch protections in your GitHub repository. There's a lot of layers that go into this.

but obviously now the light lLM folks have hardened the pipeline once again to protect against this. But yeah, this was another one that the exploit was using the path hooks for Python start. So nothing had to import light LLM for this to be exploited. But it was still SSH keys, cloud browser tokens, CI, AI tool credentials. They're all after your credentials so they can continue propagating these attacks into other places. So if you happen to have downloaded it within those two hours, that's unfortunate. Hopefully you've already patched in it on the way. But I think the important bit here is to learn from how they're hardening their CI pipeline.

If anyone is going to be a good example for the best way to do it, it's going to be these folks now because they are, they've gone through two rounds of this and in some pretty sophisticated versions of the attacks. Yikes. Yeah, yikes is right. Yikes. The last one is even more a bit of a yikes. Right. I have a comment really quick on here. Go back. Yeah. Let's go back really quick. I just want a second. UV exclude newer. Yes. Give it. It's, it feels a little like, oh, it's just security through obscurity. But we're just going to say, well, we're just not going and sell stuff for like, oh, a day. And how is that going to make any? It's a good practice.

Almost all of these major ones we've reported on are like, it was out for three hours. It was out for two hours. It was out for half a day. Just let other people go first and find out. You know what I mean? Like you, you rarely need. that much cutting edge. Yeah. And so just add that. You probably never. You never need it. Yeah, you almost never need it. And the one thing where you do maybe sometimes need it is if you're working on a project

and you're pulling in something that you're publishing a Pi Pi Pi and you're like, I want to actually just get, I want to publish it a Pi Pi and ship it so I can put the fix in now and test it. That's really frustrating because you don't want to wait a week to test out what you're doing. So you can just do exclude this package and just have an exclude list. They get instant and your stuff gets everything else. gets delayed and it's usually perfect yeah so follow these good practices and you will avoid a lot of heartache i think is the moral of the story here for these this one specifically it's the tools are

here so just you know uv i believe pip added this as well it's yeah the the cly is really different but it's the effect is the same yep and then the last one major one from last week was the broccoli two shell uh so there's a brook a bug in the brockley decoder that lets crafted compressed data right past the end of a buffer which gets you a fun RCE so a get we've got a remote shell in a box you're if you find one of these ones that's been installed with an old version of the broadly C decoder you will be on your way um so if you upgrade to the latest version of broadly and broadly CFFI you'll be fine everything's been patched but you may not know you have this a lot of web stacks for example may be bringing this in because they're using this to

get a greater performance out of compression, for example. This is one of the main, one of the use cases for this specific library in there. So you may have gotten a transitive dependency brought in that brought this in. One nice thing is that if you just uninstall the Brotley package and I believe Live URL 3, other things will just fall back on like HTTPX will fall back automatically to like GZip and deflate for compression. So it's, you can fix it quickly if you can't upgrade. I don't know any reason why you wouldn't be able to upgrade, but there are a couple ways to mitigate this, which basically involved taking care of getting broadly out of the loop and then taking care of getting this out of your system. Again, staying on top of it.

How long was this one even like out for? I don't even remember if it noticed in there. Yeah, so the Broccoli decoder from 0103 through 1-2 had this in there. And so by default, you don't get a Python that's been compiled with the Brotley. ced coder, but you may be bringing in dependencies that do. So just to be aware if you may want to, you run like UV or PIP looking for this specific dependency in your projects and make sure again, you update those dependencies. The show notes have links to all these various things. I just thought I'd kind of give a security roundup in my one segment for all the Python folks out there to stay safe.

Calvin, I thought broccoli was good for you. Broccoli is normally good for you. It's a bad broccoli. It's a bad broccoli. All right, I am so excited about this project that I'm going to introduce. This is my project, something I've been working on all of last week. And I think it is, it's going to be really interesting. And I'm going to show you some numbers. Why? Okay.

So I'm sure you're familiar with the chameleon template language, yes? Oh, yeah. I'm a long time, like, zoplone pyramid. Yeah. I'm a big fan. I'm a big fan of it. I like it over ginger. I like it over Django templates.

We don't need to go into why. But let's just say it's a really minimal, nice, clean. Well, the TLDR is with chameleon, the stuff you write is still valid HTML with Jinja and Django. You have all this junk in there. Plus, it allows you to write arbitrary Python in those other frameworks, which encourages you to have bad architectural practices, whereas Chameleon is more strict. So now that's why I like it. But it hasn't got a ton of love. If you go back and look at the project, I don't have it pulled up here, go to the camellium project to go to the, not the homepage, go to the repo, run by,

bunch of people I really like. But if we go over here and look, you can see that like, well, the build is failing and it's only technically built for 313. It's still on two. You know, if you go look at the releases, I think in the last, I remember some on this up, but if you look at the last releases, they're all like

minor, minor bug fix, security fix, minor, minor bug fix, like for the last four years, right? It's just not a whole lot is going on there. But could we do a better job and still support that? So I introduced to the world, chameleon, dash, RS. Like the sportier version of Camellion? This is like yeah like if you had a Honda accord and then you're like well what if we had the sport edition and we got a new suspension and oh yeah we also put a turbo on it. The RS badge on the back. That's all you needed. Exactly. It's the RS edition.

So Camillion RS. Camillion templates modernize and it's not just faster. If it were just faster, that would be interesting. But let me ask you this. Is Camelian Python 315T safe? Can I run free threaded Python on chameleon. I'm guessing not. Probably not. I don't know, but I would guess strongly no if it hasn't even been touched since it probably wouldn't work very well. Exactly.

I will bet you. Good odds that there will be some kind of race condition corruption issue. So that's the modernized part, right? Camelian temple is modern. Like I want to be able to run regular new Python and expect that my project will work and not just race condition corrupt itself out of existence, especially on a web. app that runs for a long time right so I rewrote it in Rust and I took every single unit tests that chameleon has and it passes perfectly I took all of the like the template tests

where it renders them it's byte for byte HTML identical I then converted Talk Python and Python bytes to it and requested every single page on old chameleon and chameleon RS they are byte for byte HTML identical not just like the same parsable structure AST, like every, like a bike comparison, they're the same. How cool is that? That's really cool, actually. It's a great test too. And then I started doing a bunch of multi-threaded tests, scaling tests, and I'm still running over on my Mac studio. It's running for an hour over there doing some performance testing and like looking for any possible issues on the free threaded stuff. But not just that, more modernized. What if, what if, check this out in your, let's

see, I'll go over here. What if I had markdown? content. What do I do with that? Calvin, I don't know. I can't do anything with it in the templates, but markdown is so insanely common. It's almost HTML, right? Yeah. Shouldn't your thing support it? Well, now you just have markdown colon, some kind of content. And this happens in Rust, which is like 60 times faster than that's really cool than the Python ones. So it's insanely fast. Oh, and one of the really nice benefits of this, I don't know if you've ever, I'm sure you've seen this, how much work you've done with these languages. But when you first deploy your web app and you request a page and it takes like one second for that page to load and then

after that it's fast that one second a lot of it is actually the chameleon template compiling camelian compiling the template into its actual form this is 70 times faster compiling the template so when you deploy it the first time you touch a page is basically as fast as if it's up and running wow and i see you've got htmx support too this the perfect world combination you see the is more of the modernization. It's not totally HTMLX dedicated, but I have three things that I've kind of gone around and I've just, I like poking at trying to make these web frameworks better.

So I created Camelian Flask, which lets me run Camelian on Flask in a super easy way. You just do like a little template and you put it as a decorator on your Flask thing. Flask will not adopt Camillion for reasonable reasons, but it's not a crazy good reason. It's like the plugins and Flask expect Jinja, so we can't have any other template.

Well, it would be nice if we could have other templates on Flask. Also, if you want to do HTMLX, having some kind of partial library support is super neat. But Camelian is not going to add any concept of partials, right? So I took all of these libraries and more, and I built them in Rust, rebuilt them, re-implemented in Rust, and put them inside a Camelian artist. So it has native partial support. It has native support for a few frameworks such as Flask, Court, Fast API, Starlet, Star, and Pyramid, just out of the box. All right.

We need to add this to Plone now. We'll get the Plone folks on it. Yeah, yeah, yeah, yeah. Absolutely. Plone people want to work with me. I don't have enough stuff to be able to test it. They've got a lot of employment. So here we go.

Check this out. Compatibility, like you want to switch over. It has, like I said, tons of compatibility, but, oh, yeah, it also has an AI skill. So if you go to the docs, it has LM.t. But also an installable skill. So you can teach your agent and just like, hey, you can make this happen. And what was the other? Oh, yes, getting started.

So if I want to switch from regular chameleon, this is like chameleon, Camillion, Parcials, all these different pieces, you just import Camelian rs.compat, Compat.compat. Dot install. Boom. That's all you do in your app and everything else is now running the rest version.

That's amazing. So I recommend to rewriting it, but. You have this live now on Talk Python? Yeah, yeah. Nice. And now, not only do I have it live, this is the last thing I'm gonna say, then we'll chill out because I'm really excited about it.

This is like, this is such a neat thing to be doing. So I switched it. These numbers are off of Talk Python training, OK? So I just, I literally effectively wrote those two lines. I did completely rewrite it to natively take advantage of those things because I have plans. But you could just do the compact thing and basically get this.

So the median page response time, it's 17.6 seconds. Sorry, 17.6% faster by just doing that. And pages that are large are 19% faster. Here's a nice graph. Look at this graph, before and after. Huh. You can see where the change was. Yeah, it's like the thing I'm linking to, you can see the picture. It just drops. And then you go, you can actually see as the pages get bigger. It only gets to be like more useful.

And then you can see like the faster and slower. Like in almost every way, this is just more awesome, even if you don't take advantage of any of the things. Now, I want to point out, this is not I went and I made some very specific benchmark. Like, I'm going to return a JSON document that's in memory. and then test how fast that goes. Oh, look, it's 20% faster. This is the entire application running. This is all the data access, all the validation,

all the e-commerce junk, all the logging, everything, like all the database calls, all of it. And even when you consider the entire app running, it's still 19% faster, just by switching that out. Speed is a feature. Speed is the feature. All right. Okay.

People, if you like Camillion, check out Camelian RS. It's pretty awesome. Yeah. Well, speaking of speed is feature, the Astral folks. have come up with some new fun stuff. That's what I got up next here. Yeah, let's hear it.

So they're experimenting with bringing together some of the astral tools, which I've always loved the fact that Astral's kept them kind of like the little bit of the Unix philosophy, like one tool to do one thing and does it really well, where you can kind of pipe them together if you needed to. But now there's an ability to take them and pull them together to gain another multiplier.

So the latest release here is bringing UV and TIE. together so this blog post from October 13th as an experiment on integration between UV and Thai available in preview and they're asking for feedback on this and in parallel they're continuing towards a stable release for tie itself so this is all again kind of on the maybe bleeding edge a leading edge of the actual tool chain stuff but why does this matter to you why should you even care and one of the things I love and I didn't didn't really piece this together until I read the blog post is you know with PEP 723 it allows for the inline

scripts, the inline dependencies of the top of the script. So you can see here on the screen. There's an example where they've got the inline where it says what Python it requires and what versions of what dependencies it requires. You can have in your library, and didn't think about this, but you can have inside your, if you've got a repository or you're storing a bunch of different scripts, different scripts can actually have different dependencies. And UV handles this very, very cleanly by creating environments for each script individually. And now it can take those various environments and use tie as a language server to do all the validation of your type checking inside of each script individually without kind of running over each other or getting the wrong version

of this dependency for that one that's over there. So it's kind of bringing you the best of both worlds here is where you can actually enable this. You have to turn it on and then your editor now can be aware of the various versions of the dependencies to make sure that tie is using the right dependency versions as it builds out the type checking for you in the backside. So it's It's all opt in right now. You should definitely check it out. It's powered by the UV workspace metadata. So again, another part I didn't really recognize is that UV is maintaining a really

rich set of metadata under the covers. And wouldn't it be great if your type checker had access to that same set of metadata. So it's bringing together kind of more data to build a better experience for the editors, the IDE's, well, ultimately, the developer experience benefits from doing all this. So it's working on this. I think there's some more stuff coming soon from them. You may see Ruff getting some integrations as well. The tools obviously stay still independent,

but now they can work more closely together to superpower the developer experience, which is really cool. That's very cool. And it just makes sense to bring TY. I can see Ruff coming as well as just a sub-command, like UV format. You know what I mean? Like, why do I need three different commands?

Well, in UV-Chek. This is compatible with UV-Cech. So the UV check command and UV pre-commit hooks will also grab the right versions of things and do the right type checking of the bits all on the fly for you automatically. So it gives you even more reason to use the PEP 723, especially for writing lots of little utility scripts or kind of one-off commands that are meant for consumption by other folks. This makes it really easy to develop those and use type checking just seamlessly, which is super cool. It is super cool. Two things also, Astral being part of OpenAI. It looks like there's still, I know people were concerned, but it looks like they're still innovating.

Still innovating, still coming on strong. And this was independently sent into us by Sky Casco. So thank you for that. Thanks for listeners. I think you found it separately, but still very, very cool. They sent that in. Yeah. Now, my first one was kind of intense because I was so excited about it.

You're very excited. I am very excited. I am not done me excited. I will be back. I will be back with more to this story. But I want to talk about streamlet light. So you know what streamlet is, yeah? You've seen Streamlet?

Yeah. So Streamlet, I had Adrian on way back before Streamlet was acquired by, I'm sorry, who acquired Streamlet, Snowflake. And the idea is you write basically procedural code, and your procedural code is understood by Streamlet and then turn into an interactive dashboard with controls that then change the parameters to your procedural functions you write. It's like if you don't really want to be or are not a visual front-end designer, but you want data science like it has a cool front end

with lots of interactivity. I really, really think it's cool. Well, like Jupiter, it requires a server. So this ST Lite by Witt PHX, Fooks, I don't know, is basically streamlet in the browser, which is pretty sweet. So similar to what you might get with Jupiter Light. And it's really interesting because it's not just, oh, look, you can run it.

It is obviously based on Pyotide, which is solid. I just did a Talk Python episode, Recorded, not yet published with the Cloudflare team about Python Cloudflare edge workers and a couple of the folks who are building that and who built that are Pyotide core developers. So Pyotide's going strong, which is really cool. So what I can do is I can come up and just create a streamlet app that you can share. But look at this, Calvin, a desktop app. Nice. So the desktop app basically creates an electron JS version.

Oh, that's cool. then host your WASM streamlet app and PaiDide running locally with, I believe, local data access, which is why it would be interesting. Yeah, yeah, I wonder what the speed's like. I don't know if you've demoed any of this. Yeah, I don't know, actually. Yeah, I don't know. Web assemblies pretty quick these days, but who knows? It integrates with React, which is cool.

You can drop it into your own page, and so you just have to do things like Add a StyleSheet, and then just include the JavaScript module, which then pulls in the WASM, and then you just have a streamlet dash app inline your your python and you're good to go anyway i think this is really cool i'm i'm a fan of these in the browser things you know so often it's like well how do i share this thing i bet with somebody it's like what if i could put it on a static file server but i like netlify or something like that yeah i like the offline desktop executable mode as well like you can build a desk like an app you can just app bundle you can hand someone or an exc that someone can just run without any other dependencies yep yep it's

Pretty straightforward. It just gives you all the little bits that you need. And off it goes, I would like to point out one thing for people out there working on projects or if they're listening. Here's an app, powder, a visual thing, like a data dashboard in a desktop app. There's not one picture here. Goodness. We're, yeah. Screenshots, people. Screenshots. Get us excited. I mean, just you already got the thing. Just screenshot it. Anyway, that's it. That's it for my items. How extra are you feeling? I'm feeling I got a couple extras. One of them is a shout out to another podcast. Given the security elements I talked about at the beginning of this episode, if you wanted to hear more, you should definitely check out the real Python podcast. They had Seth Larson on talking about the future of Python security. So definitely check that out. I think security is obviously becoming more and more and more prevalent in our day-to-day lives as developers. So there's another reason to go talk about it. And then another little just announcement is that the Python Software Foundation wikis

have moved to GitHub pages, which I think is probably a great move. So PSF Wiki, the Python Wiki, and the Jethan Wiki are now over on GitHub itself. So if you click on that, you are now in a GitHub powered wiki, which is pretty cool. They look good.

And I'm pretty psyched to see that on a subdomain of Python.org where it belongs. Yeah, yeah, for sure. I think you saw the links they were to PSF.gith.com. But then it looks like they've got a redirect in place to get the nice canonical name. Yeah, probably that was already on the, just to get up business and they're like, let's get our own domains,

or put out, just not even get the domain, just set up the DNS for a subdomain. Yep. So I'm glad they're taking care of things, keeping the project running very strong. Awesome, awesome. How you, Michael. Is that it? Yep, that's it for me.

Cool. So I just want to point, I was going to just talk about this PHP to Shell thing one more time. This could just be some shot in for you. Like, ah, not Python. It could be, actually, this could be a good reason to help convince your boss or decision makers that you should migrate from PHP to Python.

Also good. This is going to have some serious effects on all of us because it's taking over so many systems that have our personal data, which is not ideal. Yeah. So OpenAI, of all places, actually released a checker for people who happen to be in the PHP land or maybe Python people, but you're like, oh, yeah, we also maintain these PHP things. You're self-hosting something. You can run OpenAI's Ph.P.2 shell dash checker and figure that out. Okay. Enough of volunteers.

It's a rough week. It's a rough week for PHP folks. That one was brutal. Yes. So the next thing is I want to talk about Talk Python membership. A bunch of people signed up. Thank you so much. Please consider signing up.

You can do so for as little as five bucks a month. And it's not just free, ad free stuff. The next meetup, the Talk Python tech talk coming up is going to be by me. Talk Python in production, building your own Python infrastructure and running it. If you've heard me talk about this before, this is not going to be the same thing. I have some crazy new things like Chameleon RS, but some other. stuff as well that will surprise people. So I must leave it there. Come check out. And also want to announce that it was going to be this Wednesday, but it's going to be a week later. I reschedule it

because I want to coordinate a few more things and get some of these ideas, these new ideas, and you're making it a little more useful for people. So talk with a membership, be part of it. See you there. Very cool. I've seen all the people join in. Yeah, thanks. They are. Now, I also want to give a quick shout out to who sent us in. This comes to us from Vincent's Paul Ile Paiolo and we talked about zero verb projects before on the show at the numeral zero ver dot org are you familiar with this Calvin no I'm not actually oh my gosh let's go let's go out to the top real quick so this is like it's it's just sort of calls out this open source trend it's it's a it's a board that outs people with zero version yes yes

okay so we talked about before but probably a lot of people aren't familiar with So the idea is like, oh my goodness. Like some of the ones that are listed here, you're like, wait a minute. These should be released. Exactly. And the reason I think people really started going off on this. I think Mahmoh Hashemi went off on it for a while is for people in open source. Like, yeah, whatever.

Okay, it's 0.2. That's pretty, you know, it must be good for a while. But as a, I just told people like, hey, you move off a PHP to Python if you can. That would be nice. Well, maybe a tech lead who is like more from. I don't know, the Microsoft space or something where everything, you know, like you don't use a Microsoft product until it's version 30 or later because it's not tested yet. You know what I mean? You're like, it's 0.2.

Kill it with fire. Get it away from you know. And so there may be some actual friction to adoption of these projects because they are zero ver. Okay. That's not in every case. Because I just sort of, I just sorted the table by first released. Something released in 1987 that everyone uses, get text is still a zero ver project. Unreal.

So I think the thing that... 39.8 years, zero ver. The thing that Vincent pointed out to me is like, there's a notable zero ver projects, like, you know what? These are the ones that are really one to know. Like I love Excaladra. It's five years old. It's zero.

That's, you may have heard of fast API brand new. 0.162. 8 years old. NeoVim, that old thing's only 11 years old. It's only 0.12. you go rough for example is rough only zero dot 17 come on you know Zig I mean okay Zick's kind of new but there are a lot of projects there's one on the list from 1978 you know what it's okay to just go one oh at some point you should just

one now you should and it's zero point nine point eight it's so close it's so close to one anyway I just I thought it was the the notable ones I thought okay it's time to revisit the notable and if you have a project that's been out there for a few Look, if your project has been out for 11 years, I don't care if it's 0.8 or it's 1.0. You have a commitment to a stable API, whether you like it or not. You know what I mean? Come on, NeoVM. Come on, Neovm.

Just do it. Get off the list. Been 11 years. The left list of shave. All right. Also, I wanted to give a quick shout out to Python 3152. You called it out for security, but I'm just going to do a quick scroll and point out two things. Just watch how long the scroll bar goes here, Calvin.

God goodness. They're busy. These are all, these are pages and pages and pages of fixes. And then we get to 3151, which I don't know they even when talked about. This was six days ago. And you scroll and it's pages and pages and pages and pages. I don't know, 20, 30 pages of one sentence fixes, one sentence fixes. Like insane amount of it.

So if you're using 315 and you've been waiting for some stuff to get polished, well, it's pretty polished. And also if you're not on dot 2, you want to update not just because of the security sub. but because of all these other changes as well. I'll go out of limb. It's safe. I think you're good to go there. Yes, I think you're probably good to go. It's good stuff.

Unless you have some very rare wheels are not ready or something, but generally safe. All right. It's time for a joke. How do you feel about CAPTCIS? No, don't like them. I hate CAPTCHAs so much. I got banned from Discord. I tried to create a second account.

I didn't get my regular account banned. I got my second account banned because what I wanted to do is as part of the Talk Python membership, I wanted to, on another computer, log in and watch the video channel so I could screen record it and then make it available as a recording and Discord doesn't do that on its own, right? Well, I tried to do that just log in twice in my account. Since I went to one, it would pull me out of the other videos like, oh, you're going to be in two places at once. That's not going to work. We're going to take you out. Like, no, this is exact. So I tried to make a new account. It made me do the CAPTCHA 17 times.

I'm pretty sure I got it right at least 16. Not just once. You know, you go through three stages of show find the bridges find the find all the things that can walk on four legs or whatever and I went through all of them over and over and over and then I got it I finally got in it logged in and I tried to join the room and the next thing I got is an email from discord scene you're banned for suspicious behavior probably for trying to hack the captcha but it just kept coming up and up I'm like I'm just please let me buy I don't understand it's like 10 minutes of capture loops anyway at that point they should be paying you I know I know so the joke is capture it's too real So this one is a slightly different captcha.

It's a capture with a disassembled sort of really gnarly thing. I don't even know what language this is, but a bunch of code doing like some crazy stuff. And the capture is select all the squares with bugs. If there are none, click skip. What do you think about this? Genius. It's diabolical is what it is. Yeah, just what does this print?

27, three times. Okay, you can access the website. Too real. Too real. Find all the bugs. Well played. Well played. Well played.

Recapsia people. Well played. Well, Calvin, well played for a fun episode. Yeah. And yeah, always good to be here with you. Thanks for everything. Thank you everyone for listening. Now we'll talk to you next week.

Bye.