python

Release manager Hugo van Kemenade postponed Python 3.15.0 beta 1 by two days to May 7, 2026, marking the feature freeze for one of the language's largest releases in years.

PEP 772 was accepted on April 16, 2026, establishing an elected five-member Python Packaging Council with authority over standards covering pip, setuptools, and PyPI.

An unauthenticated WebSocket flaw in the popular Marimo notebook (CVE-2026-39987, CVSS 9.3) was weaponized within 9 hours 41 minutes of disclosure, with credential theft completed in under three minutes. CISA has since added the bug to its KEV catalog with a May 7 federal deadline.

The Rust for CPython project has achieved cross-platform builds in CI and shifted its target from Python 3.15 to 3.16, setting a July deadline to submit a formal Python Enhancement Proposal that would make Rust a build-time dependency of the reference interpreter.

Security researchers disclose a critical deserialization flaw and two high-severity bugs in the most widely downloaded AI framework on PyPI, with patches now available.

OpenAI will acquire Astral, the startup behind uv, Ruff, and ty, folding critical Python infrastructure into Codex as AI coding platforms race to own developer toolchains.

Python 3.15.0a7 introduces frozendict as a built-in type, explicit lazy imports for faster startup, a statistical sampling profiler, and JIT compiler improvements delivering up to 9% speedups.

Three converging developments—Django 6's built-in safety features, an 86% type-hint adoption rate, and Anthropic's PSF security investment—reveal a Python ecosystem entering a new phase of maturity.