Mailman 3 April 2026 - Python-announce-list

TatSu v5.17.0
by Juancarlo Añez May 6, 2026

May 6, 2026

竜 TatSu is a tool that takes grammars in a superset of EBNF as input, and outputs memoizing (Packrat) PEG parsers in Python. The classic variations of EBNF (Tomassetti, EasyExtend, Wirth) and ISO EBNF are also supported as input grammar format. The Overdue Major Refactoring ------------------------------------------ Maintenance and contributions to TatSu have been more difficult than necessary because of the way the code evolved through its lifetime. - Very long modules and classes that try to do too much - Algorithms difficult to understand or with incorrect semantics - Basic features missing, because the above made them hard to implement This release is a major refactoring of the code in TatSu. - Complex modules were partitioned into sub-modules and classes with well-defined purpose - Several algorithms were rewritten to make their semantics clear and evident, and their implementation more efficient - Many unit tests were added to assert the semantics of complex algorithms - Several user-facing features were added as they became easier to implement For the details about the many changes please take a look at the commit log. - pypi: https://pypi.org/project/TatSu/ - docs: https://tatsu.readthedocs.io/ - repo: https://github.com/neogeny/TatSu Every effort has been made to preserve backwards compatibility by keeping most unit tests intact and testing with projects with large grammars and complex processing. If something escaped those tests, there will be a bugfix release with the fixes soon enough. User-Facing Changes - The TatSu documentation has been improved and expanded, and it has a better look&feel with improved navigation. - TatSu doesn’t care about file names, but the default extension used in unit tests, examples, and documentation for grammars is now .tatsu - EBNF, both ISO and the classic variations, is fully supported as grammar input format - Now tatsu.parse(...., asmodel=True) produces a model that matches the ::Type declarations in their grammar (see the models documentation for a thorough review of the features). - walkers.NodeWalker now handles all known types of input. Also: - DepthFirstWalker was reimplemented to ensure DFS semantics - PostOrderDepthFirstWalker walks children before parents - PreOrderWalker was broken and crazy. It was rewritten as a BreadthFirstWalker with the correct semantics - Constant expressions in a grammar are now evaluated deeply with multiple passes of eval() as to produce results that are intuitively correct: def test_constant_math(): grammar = r""" start = a:`7` b:`2` @:```{a} / {b}``` $ ; """ result = parse(grammar, '', trace=True) assert result == 3.5 - Evaluation of Python expressions by the parsing engine now use safe_eval(), a hardened firewall around most security attacks targeting eval() (see the safeeval module for details) - Because None is a valid initial value for attributes and a frequent return value for callables, the required logic for undefined values was moved to the notnone module, which declares Undefined as an alias for notnone.NotNone In [1]: from tatsu.util.undefined import Undefined In [2]: u = Undefined In [3]: u is None Out[3]: False In [4]: u is Undefined Out[4]: True In [5]: Undefined is None Out[5]: False In [6]: d = u or 'OK' In [7]: d Out[7]: 'OK' - objectmodel.Node was rewritten to give it clear semantics and efficiency - New attributes to Node after initialization generate a warning if the name of a method is being shadowed. This change avoids confusing @dataclass, which is used in generated object models. - Node equality is explicitly defined as object identity. No attempts are made at comparing Node structurally. - Node.children() has the expected semantics, and is much more efficient. - Node.parseinfo is now honored by the parsing engine (previously, only results of type AST could have a parseinfo). Generation of parseinfo is disabled by default, and is enabled by passing pareseinfo=True to the API entry points. def test_node_parseinfo(self): grammar = """ @@grammar :: Test start::Test = true | false ; true = "test" @:`True` $; false = "test" @:`False` $; """ text = 'test' node = tatsu.parse(grammar, text, asmodel=True, parseinfo=True, ) assert type(node).__name__ == 'Test' assert node.ast is True assert node.parseinfo is not None assert node.parseinfo.pos == 0 assert node.parseinfo.endpos == len(text) - Synthetic classes created by synth.synthetize() during parsing with ModelBuilderSemantics behave more consistently, and now have a base class of class SynthNode(BaseNode) - Now ast.AST has consistent semantics of a dict that allows access to contents using the attribute interface - asjson() and friends now cover all known cases with improved consistency and efficiency, so there are less demands over clients of the API - Entry points no longer list a large subset of the configuration options defined in ParserConfig, but still accept them through **settings keyword arguments. Now ParserConfig verifies that the settings passed to are valid, eliminating the frustration of passing an incorrect setting name (a typo) and hoping it has the intended effect. - TatSu still has no library dependencies for its core functionality, but several libraries are used during its development and testing. The TatSu development configuration uses uv and hatch. Several requirements-xyz.txt files are generated in favor of those using pip with pyenv, virtualenvwrapper, or virtualenv - All attempts at recovering comments from parsed input were removed. It never worked, so it had no use. Comment recovery may be attempted in the future. - All pre-existing grammars are compatible with this version of TatSu. - Previously generated Python parsers and models, work with this version of TatSu, yet you should consider generating them anew to take advantage of the improved speed, layout, and features. - CAVEAT: Several functions, methods, and argument names were deprecated. They can still be used, but warnings will be issued at runtime. - CAVEAT: If there are invalid strings or regex patterns in your grammars YOU MUST fix them because now the grammar parser validates strings and patterns. - Many of the functions that TatSu defines for its own use are useful in other contexts. Some examples are: from tatsu.safeeval import is_eval_safe from tatsu.safeeval import hasshable from tatsu.safeeval import make_hashable from tatsu.util import safe_name from tatsu.util.misc import find_from_rematch from tatsu.util.misc import topsort from tatsu.util.undefined import Undefined # ... ----------------------------------------------------------------------------------------------- -- Juancarlo Añez mailto:apalala@gmail.com

1 1

PyCA cryptography 47.0.0 released
by Paul Kehrer April 24, 2026

April 24, 2026

PyCA cryptography 47.0.0 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X.509, key derivation functions, and much more. We support Python 3.8+, and PyPy3 3.11. Changelog (https://cryptography.io/en/latest/changelog/#v47-0-0) * Support for Python 3.8 is deprecated and will be removed in the next cryptography release. * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves (SECT* classes) has been removed. These curves are rarely used and have additional security considerations that make them undesirable. * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been removed. OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC continue to be supported. * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 4.1. * BACKWARDS INCOMPATIBLE: Loading keys with unsupported algorithms or keys with unsupported explicit curve encodings now raises UnsupportedAlgorithm instead of ValueError. This change affects load_pem_private_key(), load_der_private_key(), load_pem_public_key(), load_der_public_key(), and public_key() when called on certificates with unsupported public key algorithms. * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private keys, we now reject keys that incorrectly encode a private key of the wrong length because such keys are impossible to process in a constant-time manner. We do not believe keys with this problem are in wide use, however we may revert this change based on the feedback we receive. * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to TripleDES. In a future release, only 192-bit (24-byte) keys will be accepted. Users should expand shorter keys themselves (e.g., for single DES: key + key + key, for two-key: key + key[:8]). * Updated the minimum supported Rust version (MSRV) to 1.83.0, from 1.74.0. * Support for x86_64 macOS (including publishing wheels) is deprecated and will be removed in the next release. We will switch to publishing an arm64 only wheel for macOS. * Support for 32-bit Windows (including publishing wheels) is deprecated and will be removed in the next release. Users should move to a 64-bit Python installation. public_bytes and private_bytes methods on keys now raise TypeError (instead of ValueError) if an invalid encoding is provided for the given format. * Moved CFB, OFB, and CFB8 into Decrepit cryptography and deprecated them in the modes module. They will be removed from the modes module in 49.0.0. * Moved Camellia into Decrepit cryptography and deprecated it in the cipher module. It will be removed from the cipher module in 49.0.0. * Added extract() to HKDF. The previous private implementation will be removed in 49.0.0. * Added support for loading elliptic curve keys that contain explicit encodings of the curves secp256r1, secp384r1, and secp521r1. * Added support for Argon2d and Argon2i when using OpenSSL 3.2.0+. * Added derive_into methods to HKDF, HKDFExpand, ConcatKDFHash, ConcatKDFHMAC, Argon2id, PBKDF2HMAC, KBKDFHMAC, KBKDFCMAC, Scrypt, and X963KDF to allow deriving keys directly into pre-allocated buffers. * Added encrypt_into and decrypt_into methods to AESCCM, AESGCM, AESGCMSIV, AESOCB3, AESSIV, and ChaCha20Poly1305 to allow encrypting directly into a pre-allocated buffer. * Added support for PKCS1v15 signing without DigestInfo using NoDigestInfo. * Added hash(), a one-shot method for computing hashes. * Added HPKE (Hybrid Public Key Encryption) support implementing RFC 9180 for hybrid authenticated encryption. * Added new ML-KEM key encapsulation module with support for ML-KEM key encapsulation with AWS-LC and BoringSSL. * Note: Post-quantum algorithm support requires AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most users will not have access to these APIs yet. See ( https://cryptography.io/en/latest/statements/state-of-openssl/) for more information on OpenSSL support. * Added new ML-DSA signing module with support for ML-DSA signing and verification with AWS-LC and BoringSSL. * Note: Post-quantum algorithm support requires AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most users will not have access to these APIs yet. See ( https://cryptography.io/en/latest/statements/state-of-openssl/) for more information on OpenSSL support. * Added new ASN.1 module with support for declaratively defining custom ASN.1 types and encoding/decoding them. * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL 4.0.0. * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.0. -Paul Kehrer (reaperhulk)

1 0

Leo 6.8.8 released
by Edward K. Ream April 21, 2026

April 21, 2026

Leo https://leo-editor.github.io/leo-editor/ 6.8.8 is now available on GitHub <https://github.com/leo-editor/leo-editor/releases> and pypi <https://pypi.org/project/leo/>. Leo is an outline-oriented text editor <https://leo-editor.github.io/leo-editor/preface.html>. *The highlights of Leo 6.8.8* - Replace Leo's legacy beautifier commands by full support for ruff format <https://docs.astral.sh/ruff/formatter/>. - Make the add-comments command compatible with ruff format. - Add the @bool raise-file-update-dialogs setting. - Add the dump-last-colorizer-trace command. - Remove support for leoflexx and --gui=browser. - Add check_leo.py script. - Add gdc.summary_diff_two_revs script helper. - Fix several minor bugs. *Links* - Install Leo <https://leo-editor.github.io/leo-editor/installing.html> - 6.8.8 Issues <https://github.com/leo-editor/leo-editor/issues?q=is%3Aissue+milestone%3A6.…> - 6.8.8 Pull Requests <https://github.com/leo-editor/leo-editor/pulls?q=is%3Apr+milestone%3A6.8.8> - Documentation <https://leo-editor.github.io/leo-editor/leo_toc.html> - Tutorials <https://leo-editor.github.io/leo-editor/tutorial.html> - Video tutorials <https://leo-editor.github.io/leo-editor/screencasts.html> - Forum <https://groups.google.com/group/leo-editor> - Leo on GitHub <https://github.com/leo-editor/leo-editor> - LeoVue <https://github.com/kaleguy/leovue#leo-vue> - What people are saying about Leo <https://leo-editor.github.io/leo-editor/testimonials.html> - More links <https://leo-editor.github.io/leo-editor/leoLinks.html> ----------------------------------------------------------------- Edward K. Ream: edreamleo(a)gmail.com Leo Editor: https://leo-editor.github.io/leo-editor/ <http://leoeditor.com/> ----------------------------------------------------------------- <P><A HREF="https://leo-editor.github.io/leo-editor/">Leo 6.8.8</A> Leo 6.8.8 released (4-21-2026)

1 0

ANN: pymmich - An easy to use uploader/downloader for Immich, the photo server
by eGenix Team April 20, 2026

April 20, 2026

*ANNOUNCING* pymmich - uploader/downloader for Immich Version 0.3.0 A a small, focused CLI for uploading and downloading photos and videos to/from an Immich <https://immich.app/> server ------------------------------------------------------------------------ *INTRODUCTION* pymmich is easy to use on Windows, Linux or macOS and only does a few things, but tries to do them well: * upload photos and add them to albums * download photos or albums * list photos and albums * list users (for sharing) * share and unshare albums with other users Usage is simple: uvx pymmich <command> You only need to setup two env vars to have it connect to your Immich <https://immich.app/> server. ------------------------------------------------------------------------ *FEATURES* * CLI tool based on typer * Uses the Immich API for accessing the server * Apache2 licensed * Works with Python 3.13+ ------------------------------------------------------------------------ *RESOURCES* * Github: https://github.com/malemburg/pymmich * PyPI: https://pypi.org/project/pymmich/ * Documentation: https://malemburg.github.io/pymmich/ ------------------------------------------------------------------------ *NEWS* The 0.3.0 release is the first public release. * Created with Claude Code in a short weekend sprint * Solves a real need * Was fun to get going I'd like to try something new with this project: It's an AI-first project. Instead of PRs, we'll have discussions and prompts. I'll then pAIr with Claude to take care of the implementation :-) Enjoy, -- Marc-Andre Lemburg eGenix.com Professional Python Services directly from the Experts (#1, Apr 20 2026) >>> Python Projects, Coaching and Support ... https://www.egenix.com/ >>> Python Product Development ... https://consulting.egenix.com/ ________________________________________________________________________ ::: We implement business ideas - efficiently in both time and costs ::: eGenix.com Software, Skills and Services GmbH Pastor-Loeh-Str.48 D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg Registered at Amtsgericht Duesseldorf: HRB 46611 https://www.egenix.com/company/contact/ https://www.malemburg.com/

1 0

[RELEASE] pyspread 2.4.4
by Martin Manns April 19, 2026

April 19, 2026

pyspread 2.4 ============ This is a bugfix release. Bug fixes: * Dependencies dialog improved for better readability in dark themes * About dialog now works without AUTHORS file to simplify deployment * Toolbar icon size can now be adjusted from settings.py Known issues: * Building the apidocs is failing. * Using pyspread with Wayland can result in key shortcuts that are triggered twice on each shortcut. This leads to unexpected behavior such as cut operations, with empty clpiboard content (cut is done twice). This issue can be fixed setting the environment variable QT_QPA_PLATFORM to xcb before launching pyspread: `export QT_QPA_PLATFORM=xcb` About pyspread ============== Pyspread is a non-traditional spreadsheet that is based on and written in the programming language Python. The goal of pyspread is to be the most pythonic spreadsheet application. Pyspread is free software. It is released under the GPL v3. Project website: https://pyspread.gitlab.io/ Download page: https://pypi.org/project/pyspread/ Signature for tarball: https://gitlab.com/pyspread/downloads/-/raw/master/releases/pyspread-2.4.ta… Source code: https://gitlab.com/pyspread/pyspread Dependencies ============ Mandatory: * Python (≥ 3.6) * numpy (>=1.1) * PyQt6 (≥ 6.5, requires PyQt6.Svg) * setuptools (>=40.0) * markdown2 (>= 2.3) Recommended: * matplotlib (>=1.1.1) * pyenchant (>=1.1) * pip (>=18) * python-dateutil (>= 2.7.0) * py-moneyed (>=2.0) * rpy2 (>=3.4, requires R installation) * plotnine (>=0.8) * libvoikko (>=4.3) * nuspell (>=5.1) * hspell (>= 1.4) * ggplot2 (>=3.4) * pycel (>=1.0b30), * openpyxl (>=3.0.7) For building the apidocs with Sphinx see apidocs/requirements.txt Enjoy Martin

1 0

PyCA cryptography 46.0.7 released
by Paul Kehrer April 8, 2026

April 8, 2026

PyCA cryptography 46.0.7 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X.509, key derivation functions, and much more. We support Python 3.8+, and PyPy3 3.11. Changelog (https://cryptography.io/en/latest/changelog/#v46-0-7) * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers, which could lead to buffer overflow. **CVE-2026-39892** * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6. -Paul Kehrer (reaperhulk)

1 0

pytest-9.0.3
by Ran Benita April 7, 2026

April 7, 2026

pytest-9.0.3 ======================================= pytest 9.0.3 has just been released to PyPI. This is a bug-fix release, being a drop-in replacement. The full changelog is available at https://docs.pytest.org/en/stable/changelog.html. Thanks to all of the contributors to this release: * Aditya Giri * Alejandro Villate * Bruno Oliveira * Bubble-Interface * Charles-Meldhine Madi Mnemoi * DavidAG * Denis Cherednichenko * Dr Alex Mitre * Freya * Freya Bruhin * Hugo van Kemenade * John Litborn * Liam DeVoe * Lily Wu * Maxime Grenu * Ran Benita * Randy Döring * Ronald Eddy Jr * Samuel Newbold * Tejas Verma * Vladimir * jxramos * 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) Happy testing, The pytest Development Team

1 0