Hugo van Kemenade

Like many other projects, CPython is experiencing a huge increase in security reports. CVEs per year #Last month, PSF Security Developer-in-Residence Seth Larson posted a chart of CVEs per year, showing a large increase in 2026: But this only represents the output of security work, and doesn’t show all the work dealing with incoming reports. Many are closed and dealt with as non-security bug reports instead; many are closed as neither security nor bug reports. Let’s reveal some of this unseen…

Yes, but not the dict kind of dictionary. When working on CPython, we often find obscure bugs elsewhere, in compilers, operating systems and elsewhere: Rust/LLVM, clang-19, clang 21 and BOLT GCC 13, GCC 15, glibc, readline and curses musl fma Since Python 3.8, the release notes have a section called “And now for something completely different”. These have included Monty Python sketches, astrophysics facts and poetry. For Python 3.14, I’m doing all things

I’m happy to rejoin the Sovereign Tech Fellowship! I was one of six participants in the 2025 pilot to pay maintainers of critical open source technologies in the public interest. By all accounts this first cohort was a resounding success, and I’m glad to see the programme continue. It was wonderful to be part of the inaugural Sovereign Tech Fellowship, and incredibly beneficial to my projects: it gave me the time to focus on releasing Python 3.14 and 3.15 smoothly, to mentor and onboard others,…

gh triage spam #We get a lot of spam in the CPython project. A lot of it isn’t even slop, but mostly worthless “nothing” issues and PRs that barely fill in the issue template, or add a line of nonsense to some arbitrary file. They’re often from new accounts with usernames like: za9066559-wq quanghuynh10111-png riffocristobal579-cmd sajjad5giot satyamchoudhary1430