Astral, which makes high-performance Python tools such as the Ruff linter, has launched uv, an “extremely fast” Python package installer and resolver written in Rust. Designed as a drop-in replacement ...

Forks of forks of forks, but which ones are patched? A vulnerability in the popular Rust crate async-tar has affected the fast uv Python package manager, which uses a forked version that's now patched ...

PyPI is popular among Python programmers for sharing and downloading code. Since anyone can contribute to the repository, malware – sometimes posing as legitimate, popular code libraries – can appear ...

Python’s packaging ecosystem is under growing strain as development teams move away from pip in production environments, citing performance bottlenecks, fragile dependency resolution and rising ...