Brett Cannon

PEP 832: virtual environment discovery

https://discuss.python.org/t/106998

@pauleveritt@fosstodon.org and the PyCharm folks would probably be interested in this one.

This PEP also puts me in a tie with @vstinner@mamot.fr for being the 4th most prolific PEP (co-)author. 😅

My latest blog post got into the recent edition of the Crux by @daedalus@eigenmagic.net and now I feel like I've met a goal I didn't know I had (been a reader for while now). Next goal: to be called a "friend-of-the-Crux" in a future newsletter 😁

RE: @jni@fosstodon.org

I said digital attestations and `pylock.toml` would have helped with the litellm attack. People asked for more details, so I wrote a blog post explaining why. It also hopefully acts at motivation for people to use:

- Trusted publishing
- Digital attestations
- Lock files, and `pylock.toml` specifically

https://snarky.ca/why-pylock-toml-includes-digital-attestations/

So yes, @jni@fosstodon.org , I have a "human-readable intro" because I wrote one for you (and the other folks asking me questions on the subject). 😁

RE: @dangoodin@infosec.exchange

Notice how the compromised releases were directly uploaded. This is why `pylock.toml` includes attestation data and trusted publishing is important. If the project used trusted publishing then their the lack of attestation data could have been noticed in a diff of the lock file as it would have suddenly disappeared (which is also why `pylock.toml` was designed to be human-readable).

OpenAI is buying Astral https://openai.com/index/openai-to-acquire-astral/

1. I'm happy Astral got their exit (which we all knew was the end goal)
2. I'm glad no one will accuse me of trying to kill the company anymore by working on standards or saying there are other workflow tools
3. I'm taking a wait-and-see view (e.g. Astral already said more AI is coming to their tools https://blog.pamelafox.org/2026/03/learnings-from-pyai-conference.html#:~:text=Astral%20is%20also%20re%2Dprioritizing%20based%20off%20the%20move%20towards%20100%25%20agentic%20coding%2C%20with%20less%20emphasis%20on%20tools%20that%20would%20be%20used%20solely%20by%20a%20developer%20who%20is%20manually%20typing.)
4. I'm going to continue to work on standards for a baseline workflow experience to make my kid happy someday

Wrote a blog post to give a status update on WASI support for CPython as PEP 816 got accepted!

https://snarky.ca/state-of-wasi-support-for-cpython-march-2026/

Because @tiangolo@fosstodon.org isn't too active over here, there's a mini-doc on FastAPI

https://www.youtube.com/watch?v=mpR8ngthqiE

The final release of Python 3.9 is out!

https://discuss.python.org/t/the-final-python-3-9-security-fix-release-is-out/104666

May you all enjoy using the features added in Python 3.10 if that's now your oldest version. 😁

https://docs.python.org/3/whatsnew/3.10.html

The Q&A from EuroPython for the special 20 minute preview cut of the Python documentary that covered @mariatta@fosstodon.org and @mitsuhiko@hachyderm.io 's sections is now up!

https://www.youtube.com/watch?v=Sf2AqQ5a38Y