#python

From Python to Rust: Master Iterators by Rebuilding 10 Unix Tools

Bài viết giới thiệu một khóa học hướng dẫn Rust thông qua việc xây dựng lại 10 công cụ Unix quen thuộc (như wc, grep, sort) bằng cách sử dụng Python làm cầu nối. Mỗi bài tập so sánh các mẫu Python (vòng lặp, comprehensions) với cơ chế Rust (iterator chains, Option/Result) và cung cấp bài tập miễn phí trên rustplatform.com.

Lập trình viên nên đọc bài này để chuyển đổi từ cách sử dụng iterator trong Python—thường là các vòng lặp hoặc list comprehension—ra những kiến thức Rust mạnh mẽ như iterator chains và lifting để viết code hiệu quả, an toàn và dễ bảo trì hơn.

Using LlamaIndex for RAG in Python – Real Python

Khóa học hướng dẫn xây dựng ứng dụng RAG (Retrieval-Augmented Generation) bằng Python với LlamaIndex, từ thiết lập môi trường, tải tài liệu, tạo và lưu trữ indexes tìm kiếm, cấu hình nhà cung cấp AI (local/remote) đến chạy truy vấn nhằm giảm thiểu ảo giác (hallucination) từ LLM.

Là người phát triển Python muốn xây dựng hệ thống xử lý thông tin tự động với chất lượng cao, LlamaIndex giúp bạn tự động hóa việc kết hợp tìm kiếm và sinh lời từ mô hình ngôn ngữ lớn, giảm thiểu sai sót và tối ưu hóa hiệu suất cho ứng dụng của mình.

Beyond the Straight Line: Choosing Between OLS, Interaction Terms, and Tweedie Regression

A practical guide comparing three regression approaches for datasets with zero-inflation and heavy tails: standard OLS, OLS with interaction terms, and Tweedie regression. Using the French Motor Third-Party Liability Claims dataset, the author demonstrates that OLS fails on zero-inflated insurance data, interaction terms provide only marginal improvement, while Tweedie regression reduces MAE by ~35%. A bonus two-step zero-inflated model combining LightGBM (claim occurrence classifier) with Tweedie regression (severity estimator) achieves an additional 21% MAE reduction, reaching an MAE of 87.79 versus OLS's 174.17.

Control an Android Phone with Gemini 3.5 Flash Computer Use

Gemini 3.5 Flash has built-in Computer Use capability that lets it control Android devices by analyzing screenshots and issuing structured actions like taps, swipes, and text input. This guide walks through setting up an Android emulator on Mac without Android Studio, installing Python dependencies, and running an agent loop that connects the Google GenAI SDK with ADB to execute model-requested actions. Supported mobile actions include open_app, click, type, long_press, drag_and_drop, press_key, go_back, wait, list_apps, and take_screenshot, all using a normalized 0-999 coordinate grid. The guide also covers connecting to physical or remote devices and notes on extending to iOS, adding production robustness, and handling safety decisions.

Template-based data extraction is dead. Here’s what comes next.

Amazon Bedrock Data Automation (BDA) is a fully managed AWS service that uses foundation models to extract, classify, and transform unstructured content from documents, images, audio, and video into structured data. Unlike brittle template-based systems, BDA supports standard outputs for common use cases and custom blueprints for schema-defined extraction. A walkthrough covers creating projects via the console, configuring standard and custom outputs, and using the Python boto3 SDK to create blueprints, invoke async jobs, and poll for results. BDA supports five core automation types: classification, extraction, transformation, normalization, and validation, with use cases spanning financial services, insurance, HR/legal, customer support, and compliance.

Hexora v0.3: New features and improvements

Hexora v0.3 is a Python library for detecting malicious PyPI packages using static analysis. The new release adds a gradient boosting machine learning model that analyzes code structure, semantic features, and static analysis results to assess entire Python files. The ML model's primary role is filtering false positives — previously yielding 5-10 false positives per real finding. Running against newly published PyPI packages, it now detects 2-10 malicious packages daily. Remaining false positives mostly come from AI-related projects that use dynamic code execution, base64-inlined assets, or telemetry.

New Record Resurrects Long-Dead CD Graphics Format

Một đĩa nhạc mới có tên Divacore trên mini-CD đã hồi sinh hai định dạng hiếm gặp là CD+G (đồ họa 16 màu, độ phân giải 288x192 pixel) và CD+EG (mở rộng 256 màu, hầu như chưa từng được thương mại hóa). Nhóm thực hiện đã xây dựng bộ mã hóa Python tùy chỉnh, áp dụng kỹ thuật dithering thông minh và nghiên cứu tài liệu Red Book để nhúng tác phẩm nghệ thuật chất lượng cao vào đĩa, có thể xem đầy đủ 256 màu trên Sega Saturn hoặc phần cứng hiếm Victor VS-G2/VS-G3, và 16 màu trên các thiết bị như Amiga CD32.

Lập trình viên nên đọc bài này để khám phá cách tái sinh và tối ưu hóa các định dạng đồ họa CD+G/EG qua kỹ thuật dithering và Python, giúp hiểu về cách xử lý dữ liệu hình ảnh trên CD-ROM và ứng dụng trong các hệ thống retro gaming.

How the Django Software Foundation Became a CNA

The Django Software Foundation (DSF) has become a CVE Numbering Authority (CNA), allowing it to assign CVE IDs directly for vulnerabilities in Django and related ecosystem projects. The post details the full journey: initial evaluation, application preparation, MITRE training and onboarding exercises, and formal approval. Key lessons include that projects with mature security processes mostly need to formalize existing practices, the process takes roughly four months, and defining CNA scope early reduces ambiguity. For end users, Django's security release workflow remains unchanged — the main benefit is reduced external coordination overhead when publishing advisories.

Python Is Not Enough: Why Pythonistas Love Rust (Podcast)

A podcast episode recap covering why Python developers are adopting Rust, featuring discussion of Rust tooling (Ruff, uv, Polars, Pydantic core), how Rust's strictness benefits AI agent guardrails, and a skeptical take on vibe coding. The author argues real AI productivity gains are closer to 1.2-2x rather than 10x, warns about rubber-stamping AI-generated code, and emphasizes that deep engineering fundamentals outlast hype cycles. The post also promotes a 6-week Python-to-Rust cohort building a JSON parser with PyO3 bindings.

Explicit Lazy Imports Are Coming to Python 3.15

Python 3.15 introduces explicit lazy imports via PEP 810, allowing modules to be deferred until their attributes are first accessed. This reduces startup latency and memory consumption, especially useful in large applications and CLI tools that conditionally use heavy libraries. The post demonstrates the feature using Python 3.15.0b1 (installable via uv or pyenv), profiles import times with the tuna tool showing pandas being skipped when unused, and walks through the internal mechanism using pdb breakpoints to observe sys.lazy_modules and sys.modules state changes during reification. PyCharm 2026.1 does not yet fully support the new lazy keyword syntax.

Why you should use Fromager to build your Python dependency trees from source

Fromager là công cụ mã nguồn mở giúp xây dựng cây phụ thuộc Python từ mã nguồn, khắc phục hạn chế của pip khi chỉ tải các wheel đã biên dịch sẵn. Nó tự động phát hiện, giải quyết và biên dịch tất cả dependencies (bao gồm cả công cụ build) theo đúng thứ tự topological, tạo ra hai tệp quan trọng: build-order.json (hướng dẫn build có thứ tự) và graph.json (bản đồ quan hệ phụ thuộc đầy đủ).

Lập trình viên cần đọc bài này để khám phá cách Fromager giải quyết vấn đề không tin cậy và không tái tạo của pip khi xây dựng dự án Python từ nguồn gốc, đặc biệt trong môi trường yêu cầu độ tin cậy cao như AI/ML, ngân hàng, hoặc hệ thống chính phủ.

Why I wrote PEP 832 -- virtual environment discovery

Brett Cannon explains the motivation behind PEP 832, a proposal for standardizing Python virtual environment discovery. The core problem is that tools like VS Code have no reliable way to know which workflow tool (uv, Poetry, Hatch, etc.) a project uses, or where its environments are stored. Cannon proposes a .python-envs file listing environment paths and a [workflow] table in pyproject.toml to specify a workflow server protocol (WSP) over JSON-RPC, enabling editors to communicate with any workflow tool in a standardized way rather than requiring bespoke extensions per tool.

Bitbucket Packages adds PyPI and NuGet support

Bitbucket Packages bổ sung hỗ trợ PyPI (Python) và NuGet (.NET), tích hợp quản lý package vào Bitbucket cùng các registry sẵn có (container, Maven, npm). Tất cả năm registry chia sẻ chung mô hình quyền, thanh toán và dung lượng, nhưng PyPI/NuGet chỉ khả dụng trên gói Standard/Premium trả phí.

Lập trình viên phát triển ứng dụng Python hoặc .NET sẽ tìm hiểu Bitbucket Packages để tiết kiệm thời gian quản lý và chia sẻ gói phụ thuộc một cách hiệu quả hơn, tránh việc phụ thuộc vào các nền tảng bên ngoài như PyPI hoặc NuGet độc lập.

Malicious Edge extension abuses Native Messaging as bridge to malware

A malicious Microsoft Edge extension called 'Edgecution' has been discovered abusing Chrome's Native Messaging protocol to escape the browser sandbox and deploy a Python-based backdoor. The attack chain begins with social engineering via Microsoft Teams, where attackers pose as IT support and direct victims to a fake Microsoft update page. From there, multiple scripts (AutoHotKey, batch, PowerShell) deploy the malware, which runs in a headless Edge browser and communicates with a local Python backdoor capable of executing shell commands, running PowerShell, writing files, and gathering system information. Zscaler researchers link the campaign to an initial access broker connected to the Payouts Kings ransomware operation. Organizations are advised to monitor browser extensions and enforce strict native messaging host controls.

How to Find Stock-Specific Moves in the S&P 500 with Python

A step-by-step guide to building a Python scanner that identifies stock-specific (idiosyncratic) moves in the S&P 500 by separating market-driven returns from stock-specific residuals. The approach uses rolling OLS regression via statsmodels to estimate each stock's beta and alpha against SPY over a 60-day window, computes drift-corrected z-scores on residuals, confirms signals with volume ratios, and checks news headlines via the EODHD API. Multi-day compounded residuals (1, 3, 5-day windows) help distinguish one-day spikes from sustained moves. Real examples from June 12, 2026 illustrate the scanner in action, including SATS (-11%, 6x volume), LEN (z-score -3.9), and a TKO ticker collision edge case. Visualizations include actual vs. expected return scatter plots, z-score bar charts with volume labels, and a trailing abnormal returns heatmap.

How to Build Production-Grade AI Guardrails for Enterprise Applications: A Practical Guide

A practical guide to building multi-layered AI guardrail systems for enterprise LLM applications, based on real-world experience deploying an internal RAG assistant. Covers three defensive layers: input validation using regex and keyword blocking to stop prompt injection, role-based document retrieval filtering to prevent unauthorized data access, and output validation to redact sensitive data and detect hallucinations. Includes Python code for each layer and lessons learned about latency, logging, and why security must never rely on system prompts alone.

Django 6.1 beta 1 released

Django 6.1 beta 1 has been released, marking the second stage of the 6.1 release cycle. It introduces new features and usability improvements detailed in the in-development release notes. The beta is not intended for production use, but developers are encouraged to test new features and report bugs. A release candidate is expected in about a month, with the final release scheduled for August 5.

reader 3.26 released – discovery, exports, demo

reader 3.26, a Python feed reader library, has been released with two main additions: feed autodiscovery and database exports. The autodiscover plugin lets users add a website URL and automatically find available feeds, storing results in feed tags. Database exports allow users to download a full copy of their data from the web app, enabling migration or backups. The release also includes a public demo of the upcoming hosted version of reader, which is nearing launch and already supports multi-user accounts, email authentication, and infrastructure deployments via pyinfra.

Django Tasks: Exploring the Built-in Tasks Framework – Real Python

Django 6.0 introduces a built-in Tasks framework that standardizes background job execution. Using the @task decorator, developers can define tasks, enqueue them via .enqueue(), and track results through a TaskResult object. The framework is backend-agnostic — it ships with ImmediateBackend and DummyBackend for development, while production use requires a third-party backend like django-tasks-db. Key topics covered include setting up named queues with priority levels, checking task status (READY, RUNNING, SUCCESSFUL, FAILED), handling failed tasks with error inspection, and avoiding common pitfalls like transaction race conditions and non-JSON-serializable arguments. The framework is positioned as a lightweight Celery alternative for simpler use cases, with a future CeleryTaskBackend adapter planned.

Eclipse Qrisp Integrates NVIDIA CUDA-Q for Quantum Software Development

Eclipse Qrisp, the open-source quantum programming framework originally developed at Fraunhofer FOKUS and now maintained under the Eclipse Foundation, has integrated with NVIDIA CUDA-Q for hybrid quantum-classical computing. The integration lets developers write quantum programs in Qrisp's Python-based language and execute them on CUDA-Q's GPU-accelerated simulation and hardware backends. The combined platform aims to lower the barrier to quantum software development by pairing high-level abstractions with powerful execution capabilities. A tutorial covering the full workflow from writing quantum kernels to building hybrid variational algorithms will accompany the public release later this year.

Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed

GitGuardian scanned public GitHub repositories and Docker Hub images for leaked PyPI API tokens, finding 19,586 occurrences on GitHub alone. After deduplication and filtering, 3,714 unique pypi.org tokens were analyzed. By decoding the macaroon-based tokens and probing the PyPI API with deliberately malformed uploads, 62 live tokens were confirmed valid — 80% from GitHub, despite GitHub's automatic scanning and revocation system. These 62 tokens had access to 125 live PyPI packages with ~25,000 monthly downloads. GitGuardian responsibly disclosed the findings to PyPI, which revoked all tokens and built new admin tooling. Key takeaways: scan commits and images for secrets before publishing, scope tokens to single projects, and ensure files like .pypirc are gitignored.

Django Tasks: Exploring the Built-in Tasks Framework Quiz – Real Python

A quiz to test knowledge of Django's built-in Tasks framework introduced in Django 6.0. Covers defining tasks with the @task decorator, enqueueing work onto background workers, checking task results, and organizing fast and slow work across named queues. Contains 8 questions with no time limit.

How to Teach a Small LLM to Suggest K12 Creative Project Ideas

A hands-on walkthrough of fine-tuning a small LLM (Qwen2.5-1.5B) to suggest culturally-grounded K12 STEAM project ideas. Covers the full pipeline: scraping and filtering ~19,000 Wikipedia articles, generating structured JSON training pairs using a local Qwen 2.5 7B model via Ollama, fine-tuning with LoRA on Apple Silicon using MLX, evaluating on a held-out test set, adding RAG with vector embeddings to improve cultural accuracy, and integrating the model into a TypeScript educational app. Also addresses child-safety guardrails through both data filtering and runtime screening.

NotebookLM turned my scattered YouTube research into one searchable notebook

A personal account of using Google's NotebookLM to organize YouTube video research into a single searchable notebook. By adding YouTube videos as sources, the author could ask specific questions about video content, get summaries, and create audio overviews without rewatching entire videos. NotebookLM imports text transcripts from captioned YouTube videos, enabling Q&A-style interaction. The workflow reduced tab chaos and made research more efficient, though the author still recommends watching videos for visual content and double-checking important details.

Getting Started with NLP Using Hugging Face Transformers in Python

An introductory guide to NLP using the Hugging Face Transformers library in Python. Covers setting up a Python virtual environment, installing dependencies, and building NLP pipelines for text classification, named entity recognition (NER), and text summarization. Explains how transformer models use self-attention to understand context, and briefly touches on real-world applications of transformer-based NLP systems.

PyCoder’s Weekly

PyCoder's Weekly Issue #740 curates Python news and tutorials including a deep dive into the Pluggy plugin system used by pytest and tox, a guide on implementing interfaces with ABCs and Protocols, a tutorial on building Scrapy extensions, and coverage of Python 3.14 garbage collection changes. Also featured: a comparison of Python task queue libraries (Celery, Dramatiq, FastStream, Taskiq, Repid) for 2026, security concerns around AI code completions in PyCharm, PSF board election dates, multiple PEPs marked Final for Python 3.15 beta, and a roundup of security topics from PyCon US 2026. Projects highlighted include NVIDIA's Warp GPU simulation library, python-socketio, and Facebook Research's Hydra configuration framework.

Multi-Model API Cost Governance with the Inference Router

DigitalOcean's Inference Router (part of Inference Engine, public preview since April 2026) lets you route LLM API calls to different models based on task complexity, reducing inference costs without changing application code. The tutorial builds a three-path router for a SaaS support backend: a cheap classifier path using openai-gpt-oss-20b, a quality-sensitive Q&A path using Claude Sonnet 4.6 with Manual Ranking, and a reasoning path using GPT-5. All paths are invoked via a single OpenAI-compatible endpoint. Per-request cost signals are readable from response headers. At a traffic split of 700K classify, 250K Q&A, and 50K reasoning requests/month, the routed setup costs $2,850/month vs. $4,716 for a hardcoded Claude Sonnet 4.6 baseline — a 39.6% saving. The tutorial also covers session pinning with X-Model-Affinity for KV-cache warmth across multi-turn conversations, observability via the Analyze dashboard, and common troubleshooting scenarios including credential team mismatches and reasoning token budget issues.

I Spent an Hour on a Data Preprocessing Task Before Asking Gemini

A data scientist shares a hands-on experience spending an hour manually solving a Pandas data preprocessing task — extracting a probability value by matching a category ID across list columns — before asking Gemini to do the same. Gemini solved it in seconds, but its first solution used the non-vectorized apply function. Only because the author understood Pandas well enough did they recognize the suboptimal approach and prompt Gemini for a vectorized alternative using explode and regex. The takeaway: LLMs dramatically boost productivity, but domain knowledge is still essential to evaluate and improve AI-generated code.

Python Software Foundation News: Mitigated API authentication bypass for python.org download metadata

The Python Software Foundation disclosed and mitigated an API authentication bypass vulnerability in the python.org release management API, reported by Splitline Ng from DEVCORE Research Team on February 23rd, 2026. The flaw, present in the codebase since 2014, allowed an attacker to supply an admin username with an arbitrary API key to gain admin privileges, potentially enabling modification of Python release download URLs and verification material links. No evidence of exploitation was found after auditing logs, database backups, and verifying Sigstore and PGP signatures for all artifacts. The patch was deployed within 48 hours. Additional hardening measures included rejecting non-HTTPS python.org URLs at the database and API level, adding negative authentication test cases, and increasing log retention from 3 to 30 days. A third-party audit by Trail of Bits (funded by OpenAI) was completed before this report's publication, with full results forthcoming.

Aikido Partners with Drydock to Bring Pre-Publish Malware Review to npm and PyPI

Aikido Security is partnering with Drydock to provide pre-publish malware review for npm and PyPI packages. Drydock integrates with npm's staged publishing feature to let maintainers inspect the exact contents of a release before approving it — diffing the tarball against the last published version and flagging security-relevant changes like new lifecycle scripts, added binaries, or network-reaching code. For PyPI (which lacks staged publishing), Drydock runs as a GitHub Actions environment gate, pausing the release pipeline for human review. The tool is free for npm and PyPI maintainers, uses a read-only token, and never publishes on its own, keeping humans in the loop at every step.

Python 3.15.0 beta 3 is here!

Python 3.15.0 beta 3 has been released, the third of four planned beta releases before the final version. It includes around 195 bugfixes, build improvements, and documentation changes from 86 contributors. Key features in Python 3.15 include PEP 810 explicit lazy imports for faster startup, a new frozendict built-in type, a sentinel built-in type, a dedicated profiling package with the Tachyon high-frequency statistical sampling profiler, frame pointers enabled by default, unpacking in comprehensions, UTF-8 as the default encoding, TypedDict with typed extra items, TypeForm annotations, and a significantly upgraded JIT compiler delivering 8-9% performance improvement on x86-64 Linux and 12-13% on AArch64 macOS. The next beta (b4) is scheduled for 2026-07-18, with the release candidate phase starting 2026-08-04. Production use is not recommended until 3.15.0rc1.

Shipping huggingface_hub every week with AI, open tools, and a human in the loop

The Hugging Face team describes how they automated weekly releases of the huggingface_hub Python library using a single GitHub Actions workflow. The pipeline handles version bumping, PyPI publishing via OIDC Trusted Publishing, downstream test branch creation, and AI-drafted release notes — all built with open-source tools and open-weights models. A key design pattern is a 'trust-but-verify' loop: a deterministic script extracts the ground-truth list of PRs in the release, the model drafts the changelog, then code validates completeness and re-prompts the agent to fix any missing or extra entries. Documentation diffs are fed as context to prevent hallucinated API examples. A human reviews and edits the draft before the final release ships. The full cost per release is ~$0.25. Release cadence improved from every 4–6 weeks to weekly, with better notes, earlier breakage detection, and shorter contributor feedback loops. The workflow is public and designed to be forked and adapted by other Python library maintainers.