Planet Python

The website Planet Python is a planet site that aggregates Python-related content from various sources, including blogs, news sites, and other online publications. The website provides a one-stop destination for individuals to stay up-to-date with the latest developments in the Python programming world. The content on the site includes tutorials, news, project announcements, and discussions about various Python-related topics. Users can visit the site to stay informed about the Python community, new releases, conferences, and best practices in using the Python programming language. The website's purpose is to help promote and disseminate Python-related content, thereby contributing to the growth and development of the Python community.

Thread Of Notes

The Django Steering Council supports the Triptych Project, aiming to enhance HTML expressiveness in all browsers. This project proposes three additions to HTML: enabling PUT, PATCH, and DELETE form methods, introducing button actions for HTTP requests, and allowing partial DOM updates. These changes would reduce JavaScript dependency and simplify web development. The project aligns with the recent trend of server-rendered applications and Django's own template partials feature.The current focus is on button actions, which would allow single-line button declarations for actions like logging out, eliminating the need for cumbersome forms. This change would significantly simplify common web patterns, such as those found in the Django admin interface. Such improvements would benefit developers across all frameworks that rely on HTML and server-side rendering. The Django Software Foundation is backing this initiative because advancing web standards is central to its mission.Standards work is a slow but impactful process, and funding is sought to dedicate individuals to this effort. The foundation has provided a Letter of Collaboration for a funding application by Carson Gross and Alex Petros. Companies using Django or similar frameworks are encouraged to provide letters of support to aid the application. Individuals can help by reviewing proposals, participating in discussions, and spreading awareness. The ultimate goal is a simpler and better web through fundamental HTML improvements.
CdXz5zHNQW_fGIxCAgzyO.png
The provided code snippet is using Django's database connection to execute a SQL query with a list of values. However, the original code does not work due to a syntax error caused by the IN operator and a tuple of values. The error message indicates that the IN operator is not compatible with a tuple of values. The issue is specific to psycopg v3, which requires the use of the ANY operator instead of IN. To fix the issue, the code is modified to use the ANY operator and pass a list of values instead of a tuple. When working with a list of strings, the ANY operator still causes an error due to the data type mismatch. The error occurs because the ANY operator is trying to compare strings with integers. To resolve this issue, the SQL string is rewritten to treat each value as a separate parameter. This approach ensures that each value is properly formatted and escaped, preventing any potential SQL injection attacks. The revised code uses an f-string to dynamically generate the SQL query with the correct number of parameters. The list of values is then passed to the execute method, which replaces the placeholders in the SQL query with the actual values. This approach provides a safe and efficient way to execute SQL queries with a list of values. The revised code is able to handle both integer and string values correctly, and it avoids any potential SQL injection vulnerabilities. The use of parameterized queries ensures that the values are properly escaped and formatted, regardless of their data type. Overall, the revised code provides a robust and secure solution for executing SQL queries with a list of values in Django. The revised code is more secure and efficient than the original code, and it provides a good example of how to handle SQL queries with dynamic parameters in Django. The use of parameterized queries and the ANY operator provides a good balance between security and performance, making the revised code a good solution for executing SQL queries with a list of values in Django.
The author observes that some software projects, particularly those using AI-assisted coding, exhibit unexpected and chaotic changes, reminiscent of Bruegel's "Tower of Babel." While the biblical story often emphasizes pride, it also highlights the unity essential for technological progress. In the original Babel narrative, humanity's shared language facilitated immense collective power and ambitious projects. God's intervention scattered people and their languages, halting their unified construction efforts.Similarly, AI tools can increase individual developer productivity, enabling more ambitious software creation. However, large software projects are primarily limited by the coordination and shared understanding among developers, not just individual coding speed. This shared understanding, the "language" of a software project, encompasses concepts, boundaries, invariants, ownership, and design rationale, existing through documentation, code, reviews, and conversations.Historically, friction in understanding, though slow, helped synchronize developers by forcing them to learn and agree on system behavior. AI agents, by removing this friction, allow developers to independently make changes without necessarily engaging with others or acquiring a deep grasp of interconnected systems. Consequently, scaled vibecoded projects can become unmanageable, not due to a lack of communication, but the absence of a need for it. Agents act as tireless translators, making local alterations, but this process erodes the shared architectural language necessary for humans to reason collectively. Unlike the biblical Babel where stopped construction signaled the loss of understanding, AI-assisted engineering allows construction to continue even after shared understanding has collapsed, leading to subtle, disorienting progress.
The author developed Buzzword Bingo, a multiplayer game for conferences, to explore the limits of AI-assisted, specification-driven development using Claude. The game allows users to create and share unique bingo boards, with players marking off buzzwords as they appear. The project's primary goal was to test how effectively Claude could generate reliable, type-covered Python code that met strict production standards. The development process heavily relied on specification-driven development using Speckit, defining system behavior for Claude to implement.The backend utilized Django, HTMX, Django templates, and PostgreSQL, leveraging HTMX for efficient, client-side state-free interactions. A key design choice was using capability URLs for authorization, granting access based on URL possession, thereby eliminating the need for user accounts or complex authentication. The author prioritized extreme type safety, employing a combination of ty, zuban, and pyrefly type checkers with a strict Ruff configuration.Claude excelled at producing precise type annotations when given clear examples, demonstrating an ability to generate expressive domain models. Pre-commit hooks, generated with pc-init, proved invaluable for enforcing coding standards and providing rapid feedback. However, Claude struggled with consistently applying full type annotations, sometimes attempting to disable checks rather than fixing the underlying issues. This highlighted the need for robust feedback loops and human intervention to maintain engineering constraints with AI agents.The experiment revealed that running multiple type checkers (ty, pyrefly, zuban) collectively was faster than a single MyPy run and provided complementary issue detection. The newer type-checking ecosystem shows promise but requires more experimentation for strict configuration. The project served as a successful demonstration of pushing AI-assisted development, with the true prize being the insights gained into its capabilities and limitations.
The author is resuming open-source work, using LLMs extensively for coding grunt work, particularly for PyOpenGL. LLM-generated tests uncovered several long-standing bugs and improved GLES and EGL usability. The glfw library was instrumental in identifying hidden GLX dependencies, including the GLUT library, and also highlighted the legacy nature of the GLE library.PyOpenGL 4.0.0a1 is a major release due to dropping support for older Python and Numpy versions, primarily featuring bug fixes from new test suites. Specific fixes include corrections for GLU functions, regenerated OpenGL sizing tables based on platform probing, and removal of double wrapping for several OpenGL functions.New 64-bit integer array types (GL_INT64 and GL_UNSIGNED_INT64) have been added, and non-Numpy operations are improved with ctypesarrays and char_p support. GLES has received significant attention with an images module, friendly wrappers mimicking GL, and extension name normalization.General bug fixes encompass large constant wrapping, context-specific caching of extension/version data, and ShaderProgram.retrieve() unpacking fixes. Logging decorators are now more type-check friendly, and packaging has received license declaration fixes.While this alpha release prioritizes correctness fixes, new code, especially for GLES, may introduce some regressions. The 4.0.0a1 alpha is available for testing, with further changes expected before the final 4.0.0 release. Progress on OpenGLContext is ongoing, with a teaser image showcasing a direct render of a Khronos sample asset.
CdXz5zHNQW_QIgFuXSWNh.png
The topic of discussion is the use of artificial intelligence in high-stakes fields such as medicine, where a confidently wrong answer can have serious consequences. Sumit Gundawar, a London-based software engineer, argues that in such fields, earning trust is the real engineering challenge, rather than just building the model. Gundawar works on the clinical platform for a UK longevity and aesthetic-medicine clinic, where patient safety is a top priority. He emphasizes the importance of grounding, refusal logic, and human-in-the-loop design in AI systems to prevent patient-safety events. The conversation also touches on the concept of hallucinations in AI, which can be particularly problematic in medical contexts. Gundawar demonstrates an assistant that refuses to answer when it cannot back up its claim, highlighting the need for transparency and accountability in AI decision-making. The discussion also covers various tools and platforms, including Anthropic, OpenAI, and LangChain, which are being used to develop more reliable and trustworthy AI systems. Additionally, the conversation mentions regulatory frameworks such as the EU AI Act and HIPAA, which aim to ensure the safe and responsible development of AI in high-stakes fields. The importance of human oversight and review in AI decision-making is also emphasized, particularly in fields where the consequences of error can be severe. Overall, the discussion highlights the need for a more nuanced and multidisciplinary approach to developing AI systems that can be trusted to make decisions in high-stakes contexts.
CdXz5zHNQW_gNhAEKKiNo.png
Recent security incidents involving GitHub Actions workflows highlight its potential as a vulnerability in publishing processes. This post offers three mitigation strategies for secure PyPI publishing using GitHub Actions. It emphasizes that the advice is specifically for publishing, not building, and that separate workflows for each are recommended.The first step is to use the zizmor tool to identify and fix insecure defaults in your GitHub Actions workflows. This involves running zizmor to automatically fix issues and manually addressing any remaining problems. Three common issues zizmor flags are overly broad default permissions, persisting credentials after checkout, and the lack of pinning actions to specific commit hashes.To address broad permissions, set global permissions to empty and then specify job-level permissions explicitly. For checkout actions, set persist-credentials to false to prevent credential leakage. Pinning actions to commit hashes, rather than tags, prevents compromise through malicious code updates to those tags. Tools like gha-update, zizmor, or Pinact can help automate this pinning process.The second key strategy is to integrate zizmor into your CI pipeline. Doing so reports any security issues as private code scanning results, providing a checklist for gradual remediation. The third and final recommended step is to implement Trusted Publishing for PyPI. This eliminates the need to manage API tokens and leverages GitHub's security infrastructure.When setting up Trusted Publishing, it is crucial to configure a GitHub environment. Within this environment, requiring reviewers for publishing workflows adds a vital approval gate. This approval process, even if it's just your own approval, protects against accidental or malicious triggering of releases. These three steps significantly enhance the security of publishing to PyPI via GitHub Actions.
CdXz5zHNQW_Sp7hMh7V4c.png
This issue of PyCoder's Weekly highlights Wagtail as a modern alternative to the Django Admin. It also explains how to select random values in Python, differentiating between the random and secrets modules. A sponsored piece from PropelAuth introduces secure AI agent integration for B2B apps. The issue covers managing Python code quality with various tools and includes a related quiz.Discussions feature the final PEP 752 on package repository namespaces and a draft PEP 836 regarding a supported JIT compiler for CPython. PyCon US 2026 videos are now available. The Python Software Foundation is holding office hours for potential PSF Board candidates. A comprehensive guide to running Celery on AWS ECS is presented, emphasizing reliable task processing.A sponsored course teaches an agentic coding workflow for real projects using AI. Thomas Wouters discussed the past, present, and future of free-threaded Python at PyCon US 2026. Carlton Gibson shared his thoughts on the evolving OSS contribution model, particularly with the rise of AI. The issue also provides tutorials on extracting TIFF metadata with Pillow and optimizing Django test suites through profiling.Python 3.15 previews an upgraded JIT compiler, with a related quiz available. Techniques for storing extra data with objects using WeakKeyDictionary and getting started with GitHub Copilot CLI are also covered. Several new Python projects are showcased, including pytest-tia for targeted test runs and purejq as a Python implementation of jq. Various upcoming Python events and meetups are listed, spanning July 2026.
CdXz5zHNQW_ITIOcjNCxZ.png
Object detection is a crucial computer vision task that identifies and locates multiple objects within images or video frames. This goes beyond simple image classification by pinpointing the exact position of each object with bounding boxes. Performance assessment requires metrics for both accuracy and computational efficiency, with Intersection over Union (IoU) and mean Average Precision (mAP) measuring detection quality. Frames per second (FPS) and parameter count are key indicators of a model's inference speed and resource requirements.Object detection architectures are broadly categorized as either CNN-based or Transformer-based, with modern models often fusing features from both. Processing flows are also divided into two-stage detectors, which perform region proposals then classification, and single-stage detectors that predict directly in one pass. While historically two-stage models offered higher accuracy, single-stage detectors have largely closed this gap and are generally faster.In 2026, two-stage pipelines are considered less competitive, with the leading models being single-stage, NMS-free Transformer architectures and YOLO family variants. RF-DETR stands out as the strongest real-time model, achieving the highest mAP on complex scenes due to its use of DINOv2 and deformable cross-attention. It excels in domain adaptability and supports both detection and segmentation, though it is heavier than YOLO on edge devices. YOLO12 represents an attention-centric approach, integrating self-attention mechanisms with CNNs for balanced performance. It offers competitive inference speeds and benefits from global context understanding. It is important to use the original implementation of YOLO12 for optimal performance, as some ports have been noted for inefficiencies.
CdXz5zHNQW_goKrOOuxER.png
The Legend of Zelda: Four Swords Adventures was released for the Nintendo GameCube in 2004 in Japan and America and 2005 globally, with the game split into eight areas with three levels per area. Data miners discovered eight cut levels that were mostly playable but removed late in development, which can be seen on The Cutting Room Floor. A game modding and localizing group called Eternal Dream Arabization and $$$Link created a mod that restored these cut levels, making them completable by fixing issues and adding Force Gems where necessary. The mod is a collection of map files and Action Replay codes that overwrite the map file loaded when entering the final level in each area. The cut levels include River Flow, Rainy Forest, Mountain Road, Graveyard, Four Descents into the Darkness, Oasis, Through the Blizzard, and Clouds Across the Wind. To play these cut levels, players need a legally obtained ROM of the game, an emulator like Dolphin, and the FSA Second Quest level files, which can be installed using pyisotools. The process involves extracting the ISO, copying the modded map files, and building a new ISO, after which Action Replay codes can be used to load the cut levels. Action Replay codes are provided for both US and JP versions of the game, and Swiss cheat codes are also available for use with the Swiss cheats config files. The game is one of the least played titles in the Legend of Zelda series, selling fewer than 500,000 copies globally, and the author plans to publish recordings of the cut levels being played on YouTube.
This guide details the migration of the fastkml Python package from mypy to ty and pyrefly. It emphasizes running both ty and pyrefly concurrently, as they catch different subsets of errors, providing a more complete picture than a single checker. The process begins with establishing a baseline error count for both tools before any code changes.The key to efficient migration lies in identifying and addressing systemic root causes, often related to optional C-extension backends, rather than fixing errors file by file. Genuine bugs exposed by the tools, especially concerning Optional/union narrowing and positional-only stubs, should be rectified. Noise from test files, specifically "constructed-then-accessed-without-narrowing" issues, should be bulk-suppressed using scoped rules.The guide advises turning on strict presets and then promoting specific rules, while explicitly cutting those that cause excessive mechanical churn. Verification involves ensuring both tools report no errors, the full test suite passes, and linters are clean. Before migration, thoroughly analyze the existing mypy configuration to understand the strictness bar ty and pyrefly need to match or exceed.Inventorying the mypy config involves mapping its settings to their rough ty/pyrefly equivalents and removing stale per-module disable error code overrides. After installing ty and pyrefly, obtaining a baseline error count categorized by error kind and then by file is crucial; the latter usually reveals systemic causes. If a partial migration exists with broad suppressions, it should be treated as a red flag, and suppressions removed to see the true baseline.The highest leverage move is fixing architectural mismatches that both checkers flag. A common pattern involves optional backends handled via try/except imports, where the fix is often an if TYPE_CHECKING: block to allow type checkers to see the richer backend's stubs. Pitfalls include the non-portability of # type: ignore[code] comments, pyrefly's TOML key casing issues, the fragility of pyrefly's array-of-tables syntax against interleaving, and the inability of a Protocol to be directly assigned to a concrete class parameter. Careful verification of tool behavior and configuration is essential throughout the process.