python

Python.org lists 3.15.0 as the stable release dated Oct. 9, 2026, with explicit lazy imports, new frozendict and sentinel built-in types, and UTF-8 as the default encoding.

The October 8 release changes hf jobs stats to exit after one snapshot unless -f is passed, fixes an hf_xet version-lookup race, and repairs HfFileSystem cache bugs.

Astral's Ruff 0.17.0 release notes, dated October 9, list code-signed executables, a default Python version of 3.11, changed default rules and the removal of ruff-lsp support.

The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.

uv 0.12.23 adds a frozen-lockfile preview letting sync, export and tree run from uv.lock alone, the latest in a run of releases focused on lockfile fidelity.

Python 3.14.8, 3.13.16, 3.12.15, 3.11.17 and 3.10.22 fix CVEs in tarfile, ssl, zipfile and urllib; 3.10 reaches end of life with its final release.

A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.

At RustConf in Montreal, Rust's programming manager outlined CPython's scaled-back plan to add an optional internal Rust API in Python 3.16, along with unresolved technical hurdles.

Cloudflare has moved Python Workers out of beta to general availability, adding native FastAPI, Django, and Flask support plus PostgreSQL and MySQL connectivity via Hyperdrive.

CPython added riscv64-unknown-linux-gnu to PEP 11 as a Tier 3 platform, following months of community testing on RISE Project hardware.

Polars 2.0-rc.1 flips LazyFrame queries to the streaming engine by default, a change the project says should be roughly 5x faster while removing melt(), join_nulls, and other older APIs.

A crafted marimo notebook could run an attacker's command as a local subprocess the moment it was opened in edit mode, via a fake MCP server entry in its configuration.