Mailman 3 July 2026 - Python-announce-list

PyCA cryptography 50.0.0 released
by Alex Gaynor July 31, 2026

July 31, 2026

PyCA cryptography 50.0.0 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X.509, key derivation functions, and much more. We support Python 3.9+, and PyPy3 3.11. Changelog (https://cryptography.io/en/latest/changelog/#v50-0-0) * SECURITY ISSUE: pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to @X1AOxiang for reporting the issue * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash. * The X.509 verification APIs are now considered stable and are subject to our API stability policy. * Added the Cobblestone recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification (https://c2sp.org/chunked-encryption) for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using x509.Name as a field type in the cryptography.hazmat.asn1 module. * Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * load_der_ocsp_request and load_der_ocsp_response now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * XOFHash is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman is now supported when building against AWS-LC. * load_der_public_key and load_pem_public_key now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits, matching the minimum already enforced when loading DH private keys and when constructing DHParameterNumbers. * Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs. * The builtin HashAlgorithm classes and the classes in cryptography.hazmat.primitives.asymmetric.padding can now be compared with ==. * CertificateBuilder now supports creating unsigned certificates (RFC 9925) with the create_unsigned method. * The X.509 verification APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87 (RFC 9881) public keys and signatures by default. Alex -- All that is necessary for evil to succeed is for good people to do nothing.

1 0

Python 101 3rd Edition
by Mike Driscoll July 28, 2026

July 28, 2026

Hello! I’m Michael Driscoll, and I’m excited to announce the third edition of Python 101 <https://www.kickstarter.com/projects/driscollis/python-101-3rd-edition>. For years, *Python 101* has helped readers take their first steps into programming. Whether you’re a complete beginner, a student, or someone looking to learn Python for work or personal projects, the goal has always been the same: make learning Python approachable, practical, and enjoyable. Python has continued to evolve, and it’s time for the book to evolve with it. This Kickstarter <https://www.kickstarter.com/projects/driscollis/python-101-3rd-edition> will help fund the writing, editing, production, and publication of the fully updated third edition. Why a Third Edition? Python has changed significantly since the previous edition. New language features, updated best practices, and improvements throughout the ecosystem make this the right time for a comprehensive update. The third edition will include: - Updated examples compatible with modern versions of Python - New coverage of current Python features and best practices - Improved code samples and exercises (when applicable) - Corrections and refinements based on reader feedback The goal isn’t simply to revise the previous edition—it’s to create the best beginner-focused version of *Python 101* yet. Who Is This Book For? This book is designed for: - Complete beginners with no programming experience - Students learning Python - Self-taught developers - Professionals transitioning into software development - Anyone looking for a clear, practical introduction to Python No prior programming knowledge is required. Why Kickstarter? Kickstarter allows readers to directly support the creation of the book while helping ensure it receives the time and attention needed for a high-quality release. Funding will help cover: - Writing - Ebook production - Print preparation - Kickstarter fulfillment and shipping materials - Any cover refinements Most importantly, it allows me to focus on creating the strongest edition possible. Rewards Depending on your pledge level, rewards may include: - DRM-free PDF edition - EPUB and Kindle editions - Printed paperback - Signed copies - Early access to chapters during development - Exclusive Kickstarter updates Project updates will be shared throughout the process so backers can follow the book’s progress. Thank You Whether you back this project or simply share it with others, your support means a great deal. Writing technical books is a collaborative effort between authors and readers. Your encouragement has helped make previous editions successful, and I’m excited to bring an updated *Python 101* to the next generation of Python learners. Thank you for helping make the third edition possible. Back the project today! <https://www.kickstarter.com/projects/driscollis/python-101-3rd-edition> ----------------- Mike Driscoll Blog: http://blog.pythonlibrary.org Podcast: https://www.pythonshow.com/ Newsletter: https://www.pythonpapers.com/ <https://www.pythonpapers.com/> Books: Python 101 <https://leanpub.com/py101> 2nd Edition, Python 201: Intermediate Python <https://leanpub.com/python201>, wxPython Recipes <https://www.apress.com/us/book/9781484232361>, Python Interviews <https://www.packtpub.com/web-development/python-interviews>, Creating GUI Applications with wxPython <https://leanpub.com/creatingapplicationswithwxpython>

1 0

[ANN] Gather 1.6.1 - provenance-aware research intake for Python
by Zain Harper July 16, 2026

July 16, 2026

Gather 1.6.1 is a Python 3.11 CLI and library for turning local materials and authorized public sources into a durable research corpus. It preserves acquisition context and content hashes so a later run can show what was captured and detect a changed stored body. The core package has no runtime dependencies. Optional adapters add browser rendering, faster parsing, and alternate transports without making those capabilities part of the default installation. Install: pip install gather-engine Version: 1.6.1 License: Gather Fair-Source License, Version 1.0 License status: source-available, not open source Author: Zain Dana Harper <zaindharper(a)gmail.com> <P><A HREF="https://github.com/HarperZ9/gather">Gather 1.6.1</A> - provenance-aware research intake with content hashes and tamper checks. (16-Jul-26)

1 0

Roundup 2.6.0 release
by John Rouillard July 14, 2026

July 14, 2026

This release is a security, bugfix and feature release (49 changes), so make sure to read the upgrade documentation: https://www.roundup-tracker.org/docs/upgrading.html to bring your tracker up to date or patch an older release. Version 2.6.0 requires Python version 3.10 or newer. Among the significant enhancements in version 2.6.0 compared to the 2.5.0 release are: * Filter history entries where permissions are handled by check function When a property's permission uses a check command, the history of changes for that property were shown. The permissions are now properly checked using the check function. (security) * Fix old CSRF prevention for PATCH method when using REST The PATCH method was not covered by the old CSRF protection method. (security) * Modern CSRF prevention method available This release implements CSRF protection using Cross-Site Request Forgery by Filippo Valsorda https://words.filippo.io/csrf/. This is an effective method for CSRF protection and is much simpler as well. There are no configurable options unlike the 8 options for the older method. This can be opted into using config.ini. * Require reauthentication when making changes to sensitive fields You can trigger a reauthentication when the user changes particular fields. For example you can require a password be entered before the user changes their password. * Classic UI interface modernization. The classic tracker has basic responsive support for mobile. The table based layout was removed and HTML 5 landmarks (main, nav ...) are used along with flex and grid layouts. The left hand menu now collapses to a grid layout in a single column when on a smaller display. This can be retrofitted to existing classic trackers. The file CHANGES.txt (https://sourceforge.net/p/roundup/code/ci/default/tree/CHANGES.txt) has a detailed list of feature additions and bug fixes for each release.

1 0

python-oracledb 4.0.2
by Anthony Tuininga July 14, 2026

July 14, 2026

What is python-oracledb? python-oracledb is a Python extension module that enables access to Oracle Database for Python and conforms to the Python database API 2.0 specifications with a number of enhancements. This module replaces cx_Oracle. Where do I get it? https://pypi.org/project/oracledb/4.0.2/ The easiest method to install/upgrade python-oracledb is via pip as in python -m pip install oracledb --upgrade What's new? This release addresses a number of issues. See the full release notes for all of the details: https://python-oracledb.readthedocs.io/en/latest/release_notes.html#oracled… Please provide any feedback via GitHub issues: https://github.com/oracle/ python-oracledb/issues or discussions: https://github.com/oracle/python- oracledb/discussions

1 0

ANN: Leo 6.8.9
by Edward K. Ream July 11, 2026

July 11, 2026

Leo https://leo-editor.github.io/leo-editor/ 6.8.9 is now available on GitHub <https://github.com/leo-editor/leo-editor/releases> and pypi <https://pypi.org/project/leo/>. Leo is an outline-oriented text editor <https://leo-editor.github.io/leo-editor/preface.html>. *The highlights of Leo 6.8.9* - Add Find/Change history. How did we ever live without this? - Replace the ,, Easter Egg with Leo's Find commands. - Add support for @language pug. - Enhanced security for Leo's server. - Significant code-level improvements and performance optimizations. - Deprecate support for --gui=console. - The usual bug fixes. *Links* - Install Leo <https://leo-editor.github.io/leo-editor/installing.html> - 6.8.9 Issues <https://github.com/leo-editor/leo-editor/issues?q=is%3Aissue+milestone%3A6.…> - 6.8.9 Pull Requests <https://github.com/leo-editor/leo-editor/pulls?q=is%3Apr+milestone%3A6.8.9> - Documentation <https://leo-editor.github.io/leo-editor/leo_toc.html> - Tutorials <https://leo-editor.github.io/leo-editor/tutorial.html> - Video tutorials <https://leo-editor.github.io/leo-editor/screencasts.html> - Forum <https://groups.google.com/group/leo-editor> - Leo on GitHub <https://github.com/leo-editor/leo-editor> - LeoVue <https://github.com/kaleguy/leovue#leo-vue> - What people are saying about Leo <https://leo-editor.github.io/leo-editor/testimonials.html> - More links <https://leo-editor.github.io/leo-editor/leoLinks.html> Edward ----------------------------------------------------------------- Edward K. Ream: edreamleo(a)gmail.com Leo Editor: https://leo-editor.github.io/leo-editor/ <http://leoeditor.com/> ----------------------------------------------------------------- <P><A HREF="https://leo-editor.github.io/leo-editor/">Leo 6.8.9</A> Leo 6.8.9 released (June 3, 2026)

1 0

TatSu v5.24.0 new features + optimizations
by Juancarlo Añez July 9, 2026

July 9, 2026

https://pypi.org/project/TatSu/ https://github.com/neogeny/TatSu/releases/tag/v5.24.0 [V5.24.0] NEW FEATURES + OPTIMIZATIONS CHANGED MULTI-BARS IN CONCURRENCY * Now parproc streams/iterates only Result object. Using the results stream * for passing other information led to complicated code. * All update notifications in crross-process update of barz bars go through a * packetz queue. Now PacketzQueue is JSON-serializable for that purpose. The * actual payload of a queue passed across tasks or processes is the path to * the file-based queue. * Synchronization through a queue is done by a barz.BarBroker which is opt-in * for users of the library. BarBroker uses a daemon thread to read the queue * and call update_row() on the Multi. * Multi.height starts at -1 as the magic number to preserve the line position * before drawing the first bar. * Keeping the files for queues happeens on a per-queue basis with * Packetz(keep=True). The files are stored uner ./packetz/ by default. The * format of the filenames is aaaa-HH-mmmm.pkz.jsonl, where aaaa is four * letters representing the Unix timestamp day in base * len(strings.ascii_loweercase), HH is the UTC hour, and mmmm is the fraction * of the hour in tenth mof millisecond. The format of the files is JSONL, with * one line of flattened JSON per packet. Keeping all the files for queues may * be activated by setting the PACKETZ_KEEP environment variable to non-falsy. * Optimized PacketzQueue.receive() to read by line and retry if a line of * JSONL was incomplete (no newline at the end). OTHER * Changed the documentatiion theme to [Furo]. OGOPEGO * A round of removing memory and transformation bottlenecks has [OGoPEGo] * generating the fastest parsers among the TatSu family of PEG parser * generators. When the CLI combines the parser speed with Go's implementation * of concurrency the result feels instantaneous. LINKS [v5.24.0]: https://github.com/neogeny/tatsu/compare/v5.23.0...HEAD [Furo]: https://pradyunsg.me/furo/ [OGoPEGo]: https://pypi.org/project/ogopego/ -- Juancarlo Añez mailto:apalala@gmail.com

1 0

NumPy 2.5.1 released.
by Charles R Harris July 4, 2026

July 4, 2026

Hi All, NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0 release. The most noticeable fix is to the numpy datetime cython API which should allow downstream to support NumPy versions older than 2.5. Preparations for Python 3.15 continue along with typing improvements. This release supports Python versions 3.12-3.14. Wheels can be downloaded from PyPI <https://pypi.org/project/numpy/2.5.1>; release notes and the changelog are available on Github <https://github.com/numpy/numpy/releases/tag/v2.5.1>. *Contributors* A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time. - Adhyan Gupta + - Ankit Ahlawat - Charles Harris - Iason Krommydas - Joren Hammudoglu - Kumar Aditya - Nathan Goldbaum - Sebastian Berg - Ties Jan Hefting + - Vineet Kumar *Pull requests merged* A total of 20 pull requests were merged for this release. - #31707: MAINT: Prepare 2.5.x for further development - #31721: CI: fix new ``cython-lint`` errors (#31711) - #31723: MAINT: Update meson to match main - #31729: TST: use setup-sde instead of curl to get SDE binaries (#31727) - #31829: BUG: Relax finfo to be easier accessible for all user dtypes... - #31831: TYP: Fix ``flatiter.__next__`` return type for ``object_`` and... - #31832: BUG: avoid deadlocks using NpyString API (#31682) - #31833: BUG: fix out array leak in reduceat and accumulate when dtype... - #31835: BUG: fix numpy datetime cython APIs to be compatible with older... - #31836: TYP: Fix incorrect dtype inference of ``asarray([])`` (#31732) - #31837: TYP: Fix ``np.ma.masked_array`` 2.5.0 regression - #31838: FIX: Refactor error handling in array_setstate to prevent typecode... - #31839: TST: xfail multithreaded BLAS test more generously - #31840: MAINT: Rename subroutine for crackfortran tests - #31842: BUG: fix leak in reductions when a ufunc override errors or is... - #31849: BLD: set minimum required gcc version to 10.3 (#31843) - #31855: CI: fix hangs on MacOS ASan CI (#31853) - #31856: BUG: fix several bugs in StringDType operations (#31846) - #31857: BUG: Fix segfault in MT19937 by preventing recursive seed lists... - #31858: BUG: Fix signed integer overflow in datetime.c (#31688) Cheers, Charles Harris

1 0