Bruno Alla

Bruno Alla

@browniebroke.com

Backend engineer, Pythonista, Djangonaut, OSS maintainer. French 🇫🇷 living in London 🇬🇧

486 followers170 following48 posts

Bruno Alla reposted

Anthony Shaw
@anthonypjshaw.bsky.social

🚨litellm was compromised via a supply chain vulnerability. Package releases included a credential stealing script. 1.82.8 - includes a malicious .pth file (litellm_init.pth) 1.82.7 - includes a malicious payload in proxy_server.py github.com/BerriAI/lite...

github.com[Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8 — credential stealer · Issue #24512 · BerriAI/litellm[LITELLM TEAM] - For updates from the team, please see: #24518 [Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8 PyPI package — credential stealer Summary The litellm==1.82.8 wheel...
Bruno Alla
@browniebroke.com

Current status: trying to give Django 6.0a1 a spin on one of my project. Refuses to install as some of my dependencies require Django<6.0 grrrr Forked them and removes the upper version pin, everything run smoothly grrr iscinumpy.dev/post/bound-v... #python #django #packaging

iscinumpy.devShould You Use Upper Bound Version Constraints? -Bound version constraints (upper caps) are starting to show up in the Python ecosystem. This is causing real world problems with libraries following this recommendation, and is likely to continue to get worse; this practice does not scale to large numbers of libraries or large numbers of users. In this discussion I would like to explain why always providing an upper limit causes far more harm than good even for true SemVer libraries, why libraries that pin upper limits require more frequent updates rather than less, and why it is not scalable. After reading this, hopefully you will always consider every cap you add, you will know the (few) places where pinning an upper limit is reasonable, and will possibly even avoid using libraries that pin upper limits needlessly until the author updates them to remove these pins. If this 10,000 word behemoth is a bit long for you, then skip around using the table of contents, or see the TL;DR section at the end, or read version numbers by Bernát Gábor, which is shorter but is a fantastic read with good examples and cute dog pictures. Or Hynek’s Semantic Versioning Will Not Save You Be sure to check at least the JavaScript project analysis before you leave! Also be warned, I pick on Poetry quite a bit. The rising popularity of Poetry is likely due to the simplicity of having one tool vs. many for packaging, but it happens to also have a special dependency solver, a new upper bound syntax, and a strong recommendation to always limit upper versions - in direct opposition to members of the Python core developer team and PyPA developers. Not all libraries with excessive version capping are Poetry projects (like TensorFlow), but many, many of them are. To be clear, Poetry doesn’t force version pinning on you, but it does push you really, really hard to always version cap, and it’s targeting new Python users that don’t know any better yet than to accept bad recommendations. And these affect the whole ecosystem, including users who do not use poetry, but want to depend on libraries that do! I do really like other aspects of Poetry, and would like to eventually help it build binary packages with Scikit-build (CMake) via a plugin, and it has some great developers. If I don’t pick on Poetry enough for you, don’t worry, I have a follow-up post that picks on it in much more detail. Also, check out pdm, which gives many of the benefits of Poetry while following PEP standards. Also pixi, which works with the Conda ecosystem. If you come across something that can’t be solved, try using --exclude-newer <DATE> in uv and pdm. This limits the solve by ignoring packages newer than some date.
Bruno Alla
@browniebroke.com

TL;DR It's 2025, we have great tools to let users pin their dependencies in the final project Don't do it in your PyPI package UNLESS you have a very good reason to (known incompatibility) - spoiler alert: you probably don't This kind of thing just deter people from testing early releases

Bruno Alla reposted

Hynek Schlawack
@hynek.me

Since I've seen/heard it a few times now: Where the hell is the nonsense coming from that Python data classes are not allowed/supposed to have methods!? Is it their name (that I was somewhat unhappy w/ for that reason)? Did Eric or Guido say something I've missed? 1/4

Bruno Alla reposted

Charlie Marsh
@crmarsh.com

The uv build backend is now stable, and considered ready for production use. An alternative to setuptools, hatchling, etc. for pure Python projects, with a focus on good defaults, user-friendly error messages, and performance. When used with uv, it's 10-35x faster.

Bruno Alla reposted

Gergely Orosz
@gergely.pragmaticengineer.com

What is happening right now? ChatGPT/OpenAI outage for 3 hours Heroku down for 4 hours (even their status page is down!) NVIDIA dev docs as well (runs on Heroku) Pipedrive (CRM) issues for 4 hours What else is down… and are these connected? Something started 4 hours ago…

Bruno Alla reposted

Sam Rose
@samwho.dev

Replying to @samwho.dev

If you've not tried it, pressing ? on any GitHub page will bring up a selection of keyboard shortcuts. I wish the window these are in were a little bigger but it shows you what's possible. I find going through notifications much easier with a keyboard than it ever was with a mouse.

Bruno Alla reposted

Adam Johnson
@adamj.eu

👏 Congrats to @browniebroke.com for this DX improvement PR finally getting merged! A nice little boost for 'startproject' and 'startapp' 🚀 #Django github.com/django/djang...

github.comFixed #18296 -- Create custom target directory if missing in startproject and startapp by browniebroke · Pull Request #18387 · django/djangoTrac ticket number ticket-18296 Branch description Given the following project structure, where apps is a directory: . ├── apps ├── manage.py └── myproject ├── __init__.py ├── asgi.py ...

Bruno Alla reposted

Hugo van Kemenade
@hugovk.dev

pip 25.1 has been released and maintainer Richard Si has a great writeup about it, including: - #PEP735 dependency groups - Package installation progress bar - Resumable downloads - #PEP751 experimental lockfile generation: pip lock ichard26.github.io/blog/2025/04... #Python #pip #packaging

ichard26.github.ioWhat's new in pip 25.1 - Dependency groups!pip 25.1 introduces support for Dependency Groups (PEP 735), resumable downloads, and an installation progress bar. Dependency resolution has also received a raft of bugfixes and improvements.

Bruno Alla reposted

Gergely Orosz
@gergely.pragmaticengineer.com

Interesting to reflect how much of an impact @xkcdComic has had on tech culture - expressing making (mostly) universal truths via simple to understand comics So many golden nuggets. Like this classic:

Bruno Alla reposted

Gina Häußge
@foosel.net

Currently reading "Burnout" by Emily and Amelia Nagoski in preparation for a talk and am once more reminded that this quote is something we all need to hear more...

Bruno Alla reposted

Rodrigo Girão Serrão 🐍🚀
@mathspp.com

Use the type `Literal` in your Python function signatures for arguments that represent options. This is better than using the general type that the configurations fall into. Stricter is better since it'll catch more bugs, earlier. It also helps document the valid values.

Bruno Alla reposted

Django London
@handle.invalid

We’ve "migrated" a second talk into our April 8 meetup at Kraken Tech: @adamj.eu's "Data-Oriented Django Drei" on database indexes. Alongside David Imba Zorto's “How to Use Cursor as a Professional” If you can’t make it, please free your spot 👉 bit.ly/43L35eM #DjangoLondon #Python #Meetup

Bruno Alla
@browniebroke.com

I'm late to the party but I'm considering travelling to @djangoconeurope - where are people staying? (the hotel conference is fully booked) #django #djangoconeu

Bruno Alla reposted

Adam Johnson
@adamj.eu

I just got a GitHub DX PR merged into Django 😊 Use this one weird trick to activate GitHub’s Django templates/Jinja syntax highlighting. #Django #GitHub github.com/django/djang...

github.comMade GitHub apply Django template syntax highlighting to HTML files. by adamchainz · Pull Request #19279 · django/djangoTrac ticket number n/a Branch description Added a linguist override to make our templates render with its Jinja (alias Django) language on GitHub. Before: After: Checklist This PR targets the m...