Python Hub Weekly Digest for 2026-11-01
This week, Quicksand was introduced as an async Python API for managing QEMU virtual machines, providing isolated environments for AI agents. The PCC compiler was highlighted for its ability to compile Python and C into native programs while preserving Python's syntax. A security risk in Python's packaging ecosystem was discussed, focusing on potential malicious code in binary wheels uploaded to PyPI. Have a good week and happy coding!
đź’– Most Popular
Quicksand
Quicksand is an async Python API for launching, controlling, snapshotting, and rolling back QEMU virtual machines to provide isolated sandboxes for AI agents without requiring Docker or root privileges.
Write Python, Run native, All in Python.
PCC compiles Python and C source into native programs. This compiler and runtime aims to preserve Python's syntax and behavior without libpython, with self-hosting。
retro-kit
Headless-Ghidra toolkit for reverse engineering 32-bit DOS and Win32 games (1993-2010): own LE/LX loader, Watcom calling conventions, library signatures, MCP server
DeepInfer
DeepInfer is the high-performance inference framework that powers DeepSeek's large-scale production services.
vlmhub
A lightweight, config-driven framework for unified vision-language model inference across local and cloud backends, built on LiteLLM and Transformers.
đź“– Articles
loopinfo: let your for loop know if it is on the first or last item
Python loops do not know where they are. loopinfo adds loop.first, loop.last, loop.index, loop.count, previous, next and more.
Game of Life – But Multiplayer, Hypermedia and Python
Python 3.15's best new features
Trey Hunner's opinion on which Python 3.15 features will be most exciting for the average Python user.
Python Hub Weekly Digest for 2026-10-25
Python's experimental JIT to be removed
Symbolic Learning in Python and Julia
Python's binary wheels and supply chain attacks
Artem Golubin highlights a supply chain security risk in Python's packaging ecosystem: binary wheels uploaded to PyPI can contain malicious code that differs from their accompanying source distributions. Since most security scanners focus on source code rather than compiled binaries, attackers could hide malware in prebuilt wheels that pip installs by default.
Python vs Go: A Practical Comparison for Developers
Python offers a huge ecosystem, especially for AI, data, and scripting, while Go trades some flexibility for faster execution, simpler deployment, and built-in concurrency. This post compares where each language fits best today, including performance, typing, tooling, developer adoption, and why many teams end up using both rather than choosing one outright.
Bringing uv and ty together
Astral introduces experimental integration between uv and ty, enabling dependency-aware type checking for Python scripts with PEP 723 inline metadata and a new uv check command that automatically prepares project environments and runs ty. The integration also supports workspace-wide type checking and consistent ty versions through uv's lockfile, bringing Python development tools closer t...
Comprehensive Tutorial on Django ORM, Migrations and makemigrations
Learn how Django's ORM and migration system work by building a coffee and tea store, covering model relationships, database queries, and the differences between makemigrations and migrate. The tutorial demonstrates how to backfill required fields, roll back migrations, resolve conflicting migration histories, and use Django 6.1's new FETCH_PEERS mode to reduce N+1 database queries.
Django: check version support with norwegianblue
Adam Johnson demonstrates how to use norwegianblue, a command-line tool powered by endoflife.date, to check release cycles and support deadlines for Django, Python, PostgreSQL, and other software. The tool displays version compatibility, end-of-life dates, and upcoming support deadlines in a color-coded table, helping developers identify unsupported versions and plan upgrades.
How to Build a Decision Model Like Jev
Learn how to build AI decision models that return calibrated probabilities for classification, scoring, and routing tasks without generating text, using Hugging Face Transformers and the /v1/systemone API. The guide covers custom option tokens, model fine-tuning, probability calibration, and tree batching to improve accuracy, reduce latency, and lower inference costs.
How to Run Turing-Complete Malware in PyTorch's Backward Pass
Elon Litman demonstrates how a malicious PyTorch loss function can report a value of zero while secretly manipulating model weights through the backward pass. By exploiting differences between floating-point arithmetic and automatic differentiation, he shows how gradient descent can execute arbitrary computations inside a neural network, creating a potential attack vector for AI training...
How to improve technical SEO on a Django website
Learn how to improve technical SEO in Django applications by implementing canonical URLs, XML sitemaps, robots.txt, structured data, and proper redirects. The guide includes practical Django code examples for controlling search engine indexing, preventing duplicate content, optimizing page performance, and monitoring results with Google Search Console.
How I Found a $90,000 Remote Code Execution Vulnerability in Google
A leaked Flask session signing secret let an attacker forge session cookies containing malicious pickled data, turning OAuth state handling into unauthenticated remote code execution on several Google developer sites. The writeup shows how combiningpicklewith client-controlled session data can turn a secret leak into code execution, and why untrusted data should never cross a pickle dese...
⚙️ Projects
BOOTH
A lightweight, zero-dependency Python checkpoint layer for structured LLM output reliability.
llm-d
State of the art inference performance with modern accelerators on Kubernetes
lightseekorg / tokenspeed
TokenSpeed is a speed-of-light LLM inference engine.
TutorLoom
TutorLoom is an open-source, self-hosted learning management system built with Django, React, and Flutter, featuring course management, quizzes, grading, progress tracking, and multi-tenant support.
🎬 Videos
Bridging between Scala & Python with GraalVM
This talk explores using GraalVM to enable seamless interoperability between Scala 3 and Python 3 code, focusing on generating idiomatic Scala facades for Python libraries. It details strategies for handling dynamic Python concepts, such as type hints, structural typing, and decorators, within the static and nominal type system of Scala.
Build an AI That Turns Your Voice Into Images, Video and Audio (Python)
This video demonstrates how to build a Python AI agent that automates the entire video creation pipeline, including speech-to-text, scriptwriting, image generation, voice synthesis, and video rendering. By using OpenRouter as a unified API, the project shows how to integrate multiple AI models efficiently while tracking individual operation costs.
apache iceberg beneath the surface
A video tutorial on how Apache Iceberg's manifests, snapshots, and catalog turn a folder of Parquet files into a table with ACID transactions, hidden partitioning, time travel, and schema evolution. Tutorial uses the data on NYC taxi trips along with PyIceberg, Polars, and DuckDB.
Popular Python Features You Probably Shouldn’t Use
Explore seven powerful Python features, including properties, dataclasses, caching, decorators, async, pattern matching, and slots, that can make code harder to understand and maintain when misused. Learn the trade-offs of each feature and when using it improves code clarity, design, and maintainability.
Project by Ruslan Keba. Since 2012. Powered by Python. Made in 🇺🇦Ukraine.