> #python

3 posts

○

With uv it’s straightforward to try different python flavours, i.e., the free-threaded version introduced in 3.13 or the jit-compiled pypy with versions up to 3.11. Just run

uv python install 3.14t for the free-threaded version or uv python install pypy3.11 for the latest version of pypy.

○

Since astral has now officially announced the beta of ty, i’d like to share my current setup of amazing and fast tools:

  • uv is for managing python dependencies and python itself. Rigorous environment locks included, which you absolutely need. Can also do versioning, building and publishing.
  • pixi is for when you need to have conda dependencies. It uses uv under the hood for pypi deps, which is why I try to add everything as a pypi dependency (pixi add --pypi x).
  • ruff is a linter. I don’t want to see any of you manually formatting code, inserting spaces and the like. Just use ruff.
  • ty (now officially in beta) is a static type checker. It’ll tell you things like when you return or pass the wrong type, which will probably make your code malfunction. You can use it as a full language server, so it’ll also tell you diagnostics, give (non-AI) code completions for known symbols, and show docstrings.

All of these are built in rust and just generally nice to use.

Honorable mention to loguru for being a logger that I actually can remember how to use (from loguru import logger; logger.info('hello')).

@

Pickle Scanning (huggingface.co)

Pickle is (/was?) a widespread file format in the Python ecosystem. It is immensely flexible, as you can pickle a lot of things (but not everything as I learned using submitit). But that flexibility comes at the cost of security, as pickle files can contain arbitrary code instructions. Huggingface has a great post (the link of this note) covering this and their scanner for potentially dangerous pickle files. They also have a file format called safetensors (because pytorch tensors can also contain code…).