#464 Malicious Package? No Build For You!

Topics covered in this episode:

• ty: An extremely fast Python type checker and LSP
• Python Supply Chain Security Made Easy
• typing_extensions
• MI6 chief: We'll be as fluent in Python as we are in Russian
• Extras
• Joke

Watch on YouTube

About the show

Connect with the hosts

• Michael: @[e-mail] / @mkennedy.codes (bsky)
• Brian: @[e-mail] / @brianokken.bsky.social
• Show: @[e-mail] / @pythonbytes.fm (bsky)

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Brian #1: ty: An extremely fast Python type checker and LSP

• Charlie Marsh announced the Beta release of ty on Dec 16
• “designed as an alternative to tools like mypy, Pyright, and Pylance.”
• Extremely fast even from first run
• Successive runs are incremental, only rerunning necessary computations as a user edits a file or function. This allows live updates.
• Includes nice visual diagnostics much like color enhanced tracebacks
• Extensive configuration control
  • Nice for if you want to gradually fix warnings from ty for a project
• Also released a nice VSCode (or Cursor) extension
  • Check the docs. There are lots of features.
  • Also a note about disabling the default language server (or disabling ty’s language server) so you don’t have 2 running

Michael #2: Python Supply Chain Security Made Easy

• We know about supply chain security issues, but what can you do?
  • Typosquatting (not great)
  • Github/PyPI account take-overs (very bad)
• Enter pip-audit.
• Run it in two ways:
  1. Against your installed dependencies in current venv
  2. As a proper unit test (so when running pytest or CI/CD).
  3. Let others find out first, wait a week on all dependency updates: uv pip compile requirements.piptools --upgrade --output-file requirements.txt --exclude-newer "1 week"
• Follow up article: DevOps Python Supply Chain Security
  1. Create a dedicated Docker image for testing dependencies with pip-audit in isolation before installing them into your venv.
     1. Run pip-compile / uv lock --upgrade to generate the new lock file
     2. Test in a ephemeral pip-audit optimized Docker container
     3. Only then if things pass, uv pip install / uv sync
  2. Add a dedicated Docker image build step that fails the docker build step if a vulnerable package is found.

Brian #3: typing_extensions

• Kind of a followup on the deprecation warning topic we were talking about in December.
• prioinv on Mastodon notified us that the project