Improving security and integrity of Python package archives

Security and integrity of the Python packaging ecosystem is critical, and the smallest unit of a packaging ecosystem is a "package". Python packages use existing archive formats like ZIP and tar to distribute Python projects to their users. Archives seem simple on the surface, but many ZIP and tar features can be abused to confuse implementations into seeing different contents of the same archive.

These vulnerabilities affect the "integrity of the ecosystem" if tools can't agree what a package contents actually are. This can cause many downstream issues, such as vulnerability or malware scanners giving different results from the package when installed on disk.

The Python Software Foundation Security Developer-in-Residence, Seth Larson, published a new white paper with Alpha-Omega titled "Slippery ZIPs and Sticky tar-pits: Security & Archives" about work to remediate 10 vulnerabilities affecting common archive format implementations such as ZIP and tar for critical Python projects.

The white paper highlights how the PSF maintained Python Package Index (PyPI) can be used to protect insecure implementations of archives preemptively, whether their vulnerability status is known or unknown, by coordinating disclosures with other packaging tools. 

 

The white paper details potential future work to shore up the security of ZIP and tar implementations that are in widespread use, such as the zipfile and tarfile module in the Python standard library. The white paper also makes recommendations for packaging ecosystems regarding reproducible builds of archives.

If you rely on PyPI and the Python packaging ecosystem you can directly contribute to further security work done by the PSF by:

• Become a Member: When you sign up as a Supporting Member of the PSF, you become a part of the PSF. You’re eligible to vote in PSF elections, using your voice to guide our future direction, and you help us sustain what we do with your annual support.
• Donate: Your donation makes it possible to continue our work supporting Python and its community, year after year.
• Sponsor: If your company uses Python and isn’t yet a sponsor, send them our sponsorship page or reach out to sponsors@python.org today. The PSF is ever grateful for our sponsors, past and current, and we do everything we can to make their sponsorships beneficial and rewarding.

The Security Developer-in-Residence position is sponsored by Alpha-Omega. If you'd like to support improving Python at the ecosystem-scale contact sponsors@python.org to discuss sponsoring a Developer-in-Residence position. 

 

Open Infrastructure is Not Free: PyPI, the Python Software Foundation, and Sustainability

In September, the Python Software Foundation (PSF) co-signed the Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship Letter published by the Open Source Security Foundation (OpenSSF) as a steward of the Python Package Index (PyPI). As a follow up, I would like to share a bit more about the concerns expressed in this letter as they relate to our community and the PSF.

History and Current Conditions

PyPI (and Python) have continued to experience effectively exponential growth in usage over the past decade, from October 2018 to the present. This is clear in our telemetry: 

 

Daily requests over time for PyPI's services, showing a trend line starting in 2018 in the millions, reaching 2-3 billion per day at present.

This growth has been met with persistent and growing investment by the PSF. Starting with the hire of a full-time Director of Infrastructure in June 2018, as well as ongoing costs associated with operating PyPI and managing relationships, grants, and sponsorships that support it.

At present, the PSF employs personnel and pays operational costs to keep PyPI online, reliable, secure, and supported to meet the modern expectations of the Python community globally. While we are very fortunate to have long-term partnerships with Fastly, Amazon Web Services, Google Cloud, Datadog, Sentry, depot, and PagerDuty that help us to develop, test, host, operate, monitor, and respond to incidents for PyPI, we still pay monthly fees for things like our support inboxes and other infrastructure.

The largest cost for the PSF is staffing. The PSF staff who support PyPI include:

• Ee Durbin (myself), Director of Infrastructure
• Jacob Coffee, Infrastructure Engineer
• Maria Ashna, PyPI Support Specialist
• Mike Fiedler, PyPI Safety and Security Engineer

While our Safety and Security Engineer role is funded via a grant from The Linux Foundation’s Alpha-Omega project, all others are paid for from the PSF’s general fund, which comes from our sponsorship program and individual contributions.

These roles ensure that the expectations of our community are met when it comes to reliability and availability of the infrastructure and systems that run PyPI. They also ensure responsiveness to both critical support concerns, such as account recovery and project ownership, and to security incidents and malware, as well as continuing improvements to PyPI’s security stance overall.

We fulfill these roles and operate PyPI as a free resource for Python developers to find, install, and publish their open source projects in pursuit of our mission. This will not change, but we do believe that there are concrete ways that our community can help to support us. We also believe that there are changes that we can make to help guide PyPI and the PSF to long-term sustainability, commensurate with the value and usage of for-profit companies.

While we echo the statement from the open letter, “This is not (yet) a crisis.”, we also believe that “it is a critical inflection point” as we look to the future of the sustainability of PyPI and the PSF.

What Needs to Change

We are aligned with the OpenSSF letter on their three key points, but would like to say more about how they relate to PyPI:

Commercial and institutional partnerships

In 2024, the PSF and Fastly signed and announced a five-year agreement under Fastly’s Fast Forward program. This is a fundamentally different kind of commitment from others that we rely on to operate PyPI (and the rest of the Python Software Foundation infrastructure).

We feel very fortunate to have long-term recurring partnerships with other providers, but the annual renewal cycles do come with overhead and risk. While we work incredibly hard to use donated credits and services as efficiently as possible¹, a critical in-kind sponsor choosing not to renew would require precious engineering resources to prepare for and complete a migration to another provider or cost the PSF tens of thousands of dollars a month during an interim period to pay outright.

As an organization, we will seek to establish similar long-term agreements with our infrastructure partners.

Value-added capabilities & tiered access models

Having users pay for PyPI usage is something we cannot, and will not do. As we stated when we originally announced PyPI Organizations, paid features must remain opt-in, and core features for publishing and installing projects will remain free.

However, we do recognize that corporate publishers have been a large driver of the growth in the resources needed to serve PyPI. As we continue to develop PyPI Organizations features, providing these publishers with higher quotas will allow for the usage they drive by publishing large files to PyPI to be paid for.

In general, our roadmap for PyPI Organizations will focus on value-added features that benefit Companies as well as Community projects alike, while continuing to provide those features to Community organizations at no cost.

How You Can Help

If you or your team install from PyPI for development, continuous integration testing, or deployment, please take time to review the ways in which your tooling utilizes caching, and implement as much of it as possible when installing from free package repositories. PyPI itself heavily utilizes caching when installing our own dependencies, leveraging Docker cache mounts and pip’s internal caching to reduce usage and increase speed of builds, not only for our Python dependencies but npm and apt as well. This shared responsibility for usage is one that we all should bear, rather than treating package repositories as a limitless resource.

Just as we intend to seek longer-term agreements with the providers we rely on to operate PyPI, we ask members of the community in organizations that provide such support to champion for similar long-term agreements with open source foundations and projects that rely on them for operations.

If your company publishes projects to PyPI, consider signing up for PyPI Organizations. The recurring revenue generated by Organizations is a key way that we hope to build a reliable and sustainable base for PyPI moving forward.

Even if any of those do not apply to you or your company, but you rely on PyPI, you can always:

• Become a Member: When you sign up as a Supporting Member of the PSF, you become a part of the PSF. You’re eligible to vote in PSF elections, using your voice to guide our future direction, and you help us sustain what we do with your annual support.
• Donate: Your donation makes it possible to continue our work supporting Python and its community, year after year.
• Sponsor: If your company uses Python and isn’t yet a sponsor, send them our sponsorship page or reach out to sponsors@python.org today. The PSF is ever grateful for our sponsors, past and current, and we do everything we can to make their sponsorships beneficial and rewarding.

_{1. Fun Fact: The Python Software Foundation’s AWS Open Source Credits usage has only grown 25% over the past 8 years, despite the explosive growth in usage of our services.}

A new PSF Board- Another year of PSF Board Office Hour sessions!

Greetings, Pythonistas- thank you so much for supporting the work of the PSF and the Python community! The newest PSF Board has decided to continue investing in connecting with the global Python community by running the PSF Board Office Hour sessions on the PSF Discord into 2026. 

We began running these sessions in September 2024, and they have proven to be a great method for the community to connect with the board and vice versa. The sessions have provided the PSF Board and Staff the opportunity to hear what our community is up to and what challenges they are facing, as well as receive invaluable feedback about how the PSF can continue to improve our service to the Python community. 

What are the PSF Board Office Hours?

During the PSF Board Office Hours, you can participate in a text-based live chat with PSF Board Directors. This is a chance to connect, share, and collaborate with the PSF Board and Staff to improve our community together. Occasionally, we will have dedicated topics such as PyCon US and the PSF Board Elections for the office hour sessions. 

Here is some of the work that we collaborate with staff and volunteers on:

• Promotion and outreach for the Python programming language
• Supporting local Python communities
• Organizing PyCon US
• Diversity and Inclusion in our community
• Support handling Code of Conduct issues within our communities
• Furthering the mission of the PSF

Unless we have a dedicated topic for a session, you are not limited to talking with us about the above topics, although the discussions should be focused on Python, the PSF, and our community. If you think there’s something we can help with or we should know, we welcome you to come and talk to us!

Joining the office hours

The office hour sessions will take place on the PSF Discord server in the #psf-board channel. If you are new to Discord, make sure to check out a tutorial on how you can download the app and sign up for free– then join us on the PSF Discord! To make the office hours more accessible, the office hours will be scheduled at alternating times, so no matter where you are based, you can find a time that is most convenient for you! Here is a list of the dates and times:

• November 4th, 2 pm UTC
• December 9th, 9 pm UTC
• January 13th, 2 pm UTC 
• February 10th, 9 pm UTC
• March 10th, 1 pm UTC 
• April 14th, 9 pm UTC
• May 12th, 1 pm UTC 
• June 9th, 9 pm UTC
• July 14th, 1 pm UTC 
• August 11th, 9 pm UTC
• September 8th, 1 pm UTC 
• October 13th, 9 pm UTC

Each session lasts for an hour. Sessions after October 2026 will be announced in the future.

Who will be at the office hours?

Some board members of the PSF will be attending each office hour, as well as members of the PSF Staff. The list of the current PSF Board Directors can be found on our website. We are passionate Python community members who are excited to listen, help, and provide support to you. We are happy to follow up with you if there are any issues we cannot address immediately during the office hour sessions. As always, you can email us at psf-board@python.org with inquiries, feedback, or comments any time. 

The PSF has withdrawn a $1.5 million proposal to US government grant program

In January 2025, the PSF submitted a proposal to the US government National Science Foundation under the Safety, Security, and Privacy of Open Source Ecosystems program to address structural vulnerabilities in Python and PyPI. It was the PSF’s first time applying for government funding, and navigating the intensive process was a steep learning curve for our small team to climb. Seth Larson, PSF Security Developer in Residence, serving as Principal Investigator (PI) with Loren Crary, PSF Deputy Executive Director, as co-PI, led the multi-round proposal writing process as well as the months-long vetting process. We invested our time and effort because we felt the PSF’s work is a strong fit for the program and that the benefit to the community if our proposal were accepted was considerable.  

We were honored when, after many months of work, our proposal was recommended for funding, particularly as only 36% of new NSF grant applicants are successful on their first attempt. We became concerned, however, when we were presented with the terms and conditions we would be required to agree to if we accepted the grant. These terms included affirming the statement that we “do not, and will not during the term of this financial assistance award, operate any programs that advance or promote DEI, or discriminatory equity ideology in violation of Federal anti-discrimination laws.” This restriction would apply not only to the security work directly funded by the grant, but to any and all activity of the PSF as a whole. Further, violation of this term gave the NSF the right to “claw back” previously approved and transferred funds. This would create a situation where money we’d already spent could be taken back, which would be an enormous, open-ended financial risk.   

Diversity, equity, and inclusion are core to the PSF’s values, as committed to in our mission statement: 

The mission of the Python Software Foundation is to promote, protect, and advance the Python programming language, and to support and facilitate the growth of a diverse and international community of Python programmers.

Given the value of the grant to the community and the PSF, we did our utmost to get clarity on the terms and to find a way to move forward in concert with our values. We consulted our NSF contacts and reviewed decisions made by other organizations in similar circumstances, particularly The Carpentries.  

In the end, however, the PSF simply can’t agree to a statement that we won’t operate any programs that “advance or promote” diversity, equity, and inclusion, as it would be a betrayal of our mission and our community. 

We’re disappointed to have been put in the position where we had to make this decision, because we believe our proposed project would offer invaluable advances to the Python and greater open source community, protecting millions of PyPI users from attempted supply-chain attacks. The proposed project would create new tools for automated proactive review of all packages uploaded to PyPI, rather than the current process of reactive-only review. These novel tools would rely on capability analysis, designed based on a dataset of known malware. Beyond just protecting PyPI users, the outputs of this work could be transferable for all open source software package registries, such as NPM and Crates.io, improving security across multiple open source ecosystems.

In addition to the security benefits, the grant funds would have made a big difference to the PSF’s budget. The PSF is a relatively small organization, operating with an annual budget of around $5 million per year, with a staff of just 14. $1.5 million over two years would have been quite a lot of money for us, and easily the largest grant we’d ever received. Ultimately, however, the value of the work and the size of the grant were not more important than practicing our values and retaining the freedom to support every part of our community. The PSF Board voted unanimously to withdraw our application. 

Giving up the NSF grant opportunity—along with inflation, lower sponsorship, economic pressure in the tech sector, and global/local uncertainty and conflict—means the PSF needs financial support now more than ever. We are incredibly grateful for any help you can offer. If you're already a PSF member or regular donor, you have our deep appreciation, and we urge you to share your story about why you support the PSF. Your stories make all the difference in spreading awareness about the mission and work of the PSF. 

How to support the PSF:

• Become a Member: When you sign up as a Supporting Member of the PSF, you become a part of the PSF. You’re eligible to vote in PSF elections, using your voice to guide our future direction, and you help us sustain what we do with your annual support.
• Donate: Your donation makes it possible to continue our work supporting Python and its community, year after year.
• Sponsor: If your company uses Python and isn’t yet a sponsor, send them our sponsorship page or reach out to sponsors@python.org today. The PSF is ever grateful for our sponsors, past and current, and we do everything we can to make their sponsorships beneficial and rewarding.

Announcing Python Software Foundation Fellow Members for Q3 2025! 🎉

The PSF is pleased to announce its third batch of PSF Fellows for 2025! Let us welcome the new PSF Fellows for Q3! The following people continue to do amazing things for the Python community:

Abhijeet Mote

Abigail Afi Gbadago

LinkedIn, Website 

Becky Smith

LinkedIn, Bluesky, Mastodon, GitHub 

Christopher Bailey

Dawn Wages

Leah Wasser

Website, Bluesky, Mastodon, LinkedIn, GitHub

Maaya Ishida

Mason Egger

Website, Twitter, LinkedIn, GitHub

Miguel Grinberg

Website, GitHub

William Vincent

Website, LinkedIn, GitHub

 

Thank you for your continued contributions. We have added you to our Fellows Roster.

The above members help support the Python ecosystem by being phenomenal leaders, sustaining the growth of the Python scientific community, maintaining virtual Python communities, maintaining Python libraries, creating educational material, organizing Python events and conferences, starting Python communities in local regions, and overall being great mentors in our community. Each of them continues to help make Python more accessible around the world. To learn more about the new Fellow members, check out their links above.

Let's continue recognizing Pythonistas all over the world for their impact on our community. The criteria for Fellow members is available on our PSF Fellow Membership page. If you would like to nominate someone to be a PSF Fellow, please send a description of their Python accomplishments and their email address to psf-fellow at python.org. Quarter 4 nominations will be in review soon. We are accepting nominations for Quarter 4 of 2025 through November 20th, 2025.

Are you a PSF Fellow and want to help the Work Group review nominations? Contact us at psf-fellow at python.org.

CPython Core Dev Sprint 2025 at Arm Cambridge: The biggest one yet

Guest blog post authored by Diego Russo, Python Core Developer and Principal Software Engineer at Arm. 

Sprint overview

For one week, Arm’s Cambridge headquarters became the heart of Python development. Contributors from around the world came together for the CPython Core Developer Sprint. It was the largest gathering in the project’s history, with 35 core developers and 13 invited guests collaborating in person. 

Unlike a conference, the sprint is a working retreat. There are no spectators or formal keynotes, just space for deep technical debate, design, coding, and consensus-building. 

The sprint offers a rare chance for real-time dialogue. Ideas can be sketched on whiteboards, trade-offs debated face-to-face, and tricky issues given momentum.

What happened

The week included technical presentations, collaborative work, and community events. Talks and presentations were grouped around key themes:

• JIT and performance
• Ken Jin Ooi – Building a Community Around the JIT Compiler and demo of the new C API
• Antonio Cuni – Tracing JITs in the Real World, highlighting challenges such as trace blockers, control flow, and async behavior

• Packaging and distribution
• Russell Keith-Magee – Managing Cross-Platform Wheel Builds
• Brett Cannon – Precompiled Binaries from python.org

• Language design and standards
• Steering Council – PEP 793 and abi3/abi3t/abi4
• Matthew Parkinson – Designing Deep Immutability

• Ecosystem and infrastructure
• Brett Cannon – WASI Update
• Hood Chatham – Upstreaming the Pyodide FFI
• Gregory P. Smith – Claude Code and Agents for Good in OSS

• Lightning talks
• Guido van Rossum – A New Python History Project
• Ee Durbin – PSF Infrastructure Next Gen
• Steve Dower – Python Install Manager
• Larry Hastings – A Missing Fundamental Data Structure
• Adam Turner – Bring Out Yer Dead (Issues)
• Greg Smith – Async Exception Group Tracebacks

• Arm contributions
• James Greenhalgh – Arm Neoverse: Overview
• Martin Weidmann – A Brief History of the Arm Architecture
• Peter Smith – Compilers, ABI, and Optimizations

The program also included a Q&A with the Steering Council, where Barry Warsaw and Emily Morehouse joined remotely. It also featured a mentorship discussion led by Tania Allard on how to welcome and support new contributors.

 

Beyond presentations, the sprint fostered hands-on collaboration. Developers had advanced JIT planning, explored progress on free threading, and discussed improvements to documentation and translations. They also strengthened testing and CI across platforms, and refined governance and contributor onboarding processes.

Antonio Cuni highlighted real-world JIT pitfalls, which informed many of these discussions.

Finally, the sprint included community activities that helped balance the technical intensity with moments of connection. The Python Guild at Arm hosted an Ask Me Anything (AMA) session, giving local engineers the chance to interact with core developers.

A formal dinner at Jesus College reflected Cambridge traditions, while a punting trip on the River Cam offered a relaxed opportunity to connect outside of work.

A Team Effort

The Python Software Foundation coordinated the event, making the sprint possible. We thank Phyllis Dobbs for managing the RSVP process and the travel grants that enabled many contributors to join us in Cambridge.

Hosting the CPython Sprint at Arm’s Cambridge offices shows a shared commitment and we send huge thanks to everyone at Arm who made the sprint possible. Arm shares, 

“Hosting the latest CPython sprint was more than providing a venue. It was an investment in strengthening one of the most influential open-source communities. Python’s reach is vast, and ensuring its modern components run smoothly on Arm platforms helps the language stay inclusive and performant across architectures. Hosting the sprint gave Arm a way to give back, reinforce bonds with the core team, and invest in Python’s future.”

The Arm Software Communities team led the effort from start to finish, handling logistics, sponsorship, and every detail that kept things running smoothly. Their support, along with the help of Central Engineering, Facilities, Workplace, People, IT, Developer Marketing, and the Python Guild organizers, ensured a successful and well-organized week for all participants. 

Finally, a huge thank you to all the attendees who traveled from across the world to spend a week in Cambridge. Some came from nearby in the UK and neighboring countries. Many others journeyed across Europe, several crossed the Atlantic, and a few took long-haul and even ultra-long-haul flights of more than 10,000 km. That dedication and commitment to the Python community is what truly made this sprint special.

Organizing a sprint of this scale takes many hands. From sponsors to volunteers, organizers to attendees, everyone contributed in their own way. This sprint was a reminder that Python is more than a programming language. It is a community that works together, supports one another, and achieves more as a team than any individual could alone.

Conclusion

The sprint was widely regarded as a success. Attendees described it as productive, well-organized, and an excellent community experience. Even so, some aspects could have been improved, and these are valuable lessons to take forward for future events. 
Sessions such as the Steering Council Q&A, the mentorship discussion led by Tania Allard, and the lightning talks stood out as highlights. They reinforced the value of bringing the community together in person.

Python is undergoing important technical transitions. Sprints like this accelerate evolution, resolve difficult challenges, and align the community. The concentration of expertise enabled focused, collaborative progress. The ripple effects of this sprint will shape code, discussion, and design decisions for months to come. We look forward to coming together again as a community.

Announcing PSF Community Service Award Recipients!

The PSF Community Service Awards (CSA’s) are a formal way for the PSF Board of Directors to offer recognition of work which, in its opinion, significantly improves the Foundation's fulfillment of its mission and benefits the broader Python community. These awards shine a light on the incredible people who are the heart and soul of our community– those whose dedication, creativity, and generosity help the PSF fulfill its mission. The PSF CSAs celebrate individuals who have been truly invaluable, inspiring others through their example, and demonstrates that service to the Python community leads to recognition and reward. If you know of someone in the Python community deserving of a PSF CSA award, please submit them to the PSF Board via psf@python.org at any time. You can read more about PSF CSAs on our website. 

The PSF Board is excited to announce three new CSAs, awarded to Katie McLaughlin, Sarah Kuchinsky, and Rodrigo Girão Serrão, for their contributions to the Python community. Read more about their contributions and impact below. 

Katie McLaughlin

Katie has been a tireless and dedicated member of the Python and Django communities for many years. They have served on the boards of both the DSF and PSF, including as PSF Communications Officer, and was named a PSF Fellow in 2018. Katie has played a big role in the Australian conference community– chairing DjangoCon AU 2017, PyCon AU in 2018 and 2019, and co-chairing PyCon AU 2021– and continues to support PyCon AU as an advisor.

A frequent speaker and keynote presenter at PyCons and DjangoCons around the world, Katie has worked to demystify Python website deployment, highlight the value of all kinds of open source contributions, and call out the impact of contempt culture on developer communities. They are also a regular at sprints, helping new contributors get started and improving onboarding through code and documentation. 

Sarah Kuchinsky

Sarah has been the driving force behind PyCon tutorials for many years, shaping them into the strong program they are today. She has brought skill, care, and consistency to the difficult work of selecting, organizing, and running tutorials, ensuring they provide meaningful learning experiences for attendees.

Beyond logistics, Sarah has a gift for spotting and nurturing talent. She has encouraged new volunteers to grow into leadership roles, building a resilient, collaborative committee that sustains itself year after year. Her outreach has kept reviewers engaged while also welcoming fresh voices, strengthening both the program and the community behind it.

The impact of Sarah’s work is felt by every instructor, attendee, and volunteer who has benefitted from PyCon tutorials, and the community is deeply grateful for her many years of leadership and care. Sarah was also the lead organizer for PyLadies Silicon Valley for over 5 years, is a SoCal Python Co-Organizer, and has contributed to a variety of open source projects.

Rodrigo Girão Serrão

Rodrigo Girão Serrão has made lasting contributions to the international Python community through his leadership, teaching, and generosity. He has helped organize PyCons in Portugal, supported the Python community across Europe, and spoken regularly at PyCons worldwide, making complex topics like descriptors clear and approachable.

Through his website mathspp.com, bootcamps, and self-published books, including the freely available Pydon’ts book, Rodrigo has worked to make Python more accessible and welcoming. His dedication to sharing knowledge and supporting others has had a wide-reaching impact, and the community is grateful for his many contributions.

Announcing the 2025 PSF Board Election Results!

The 2025 election for the PSF Board created an opportunity for conversations about the PSF's work to serve the global Python community. We appreciate community members' perspectives, passion, and engagement in the election process this year. 

We want to send a big thanks to everyone who ran and was willing to serve on the PSF Board. Even if you were not elected, we appreciate all the time and effort you put into thinking about how to improve the PSF and represent the parts of the community you participate in. We hope that you will continue to think about these issues, share your ideas, and join a PSF Work Group or PSF initiative if you feel called to do so.

Board Members Elect

Congratulations to our two new and two returning Board members who have been elected! 

• Abigail Dogbe
• Jannis Leidel
• Sheena O’Connell
• Simon Willison

We’ll be in touch with all the elected candidates shortly to schedule onboarding. Newly elected PSF Board members are provided orientation for their service and will be joining the upcoming board meeting. 

Thank you!

We’d like to take this opportunity to thank our outgoing board members. Kushal Das has been serving on the PSF Board for over ten years– WOW! Kushal has been a part of change after change for the PSF and Python community, serving in PSF Board officer positions, and we are incredibly grateful for his contributions. Dawn Wages quickly became an integral part of the Board during her tenure, stepping up as Treasurer and then Board Chair. Dawn helped guide us through a period of major change– navigating a difficult economy, adapting to the rise of AI, and supporting important shifts in our programs. Thank you, Kushal and Dawn, for your leadership and dedication to the PSF and the Python community. You will be missed and are deeply appreciated! 

Our heartfelt thanks go out to each of you who took the time to review the candidates and submit your votes. Your participation helps the PSF represent our community. We received 683 total ballots, easily reaching quorum–1/3 of affirmed voting members (929). We’re especially grateful for your patience with continuing to navigate the changes to the election processes and schedule, which allows for a valid election and a more sustainable election system.

We also want to thank everyone who helped promote this year’s board election, especially Board Members Cristián Maureira-Fredes and Georgi Ker, who took the initiative to cover this year’s election and produced informational videos for our candidates. This promotional effort was inspired by the work of Python Community News in 2023. We also want to highlight the PSF staff members and PSF Board members who put in tons of effort each year as we work to continually improve the PSF elections.

What’s next?

If you’re interested in the complete tally, make sure to check the Python Software Foundation Board of Directors Election 2025 Results page. These results will be available until Nov 11, 2025.

The PSF Election team will conduct a retrospective of this year’s election process to ensure we are improving year over year. We received valuable feedback about the process and tooling. We hope to be able to implement more changes for next year to ensure a smooth and accessible election process for everyone in our community.

Finally, it might feel a little early to mention this, but we will have at least 3 seats open again next year. If you're interested in running or learning more, we encourage you to contact a current PSF Board member or two this year and ask them about their experience serving on the board.

Sprints are the best part of a conference

When I first started attending Python conferences, my focus was entirely on the talks on the schedule. That's not surprising, there's no conference without talks! Over the years, though, I came to appreciate the so-called hallway track and the usual post-conference sprints that many events include. These days, I mostly come for those. Let's talk about why.

Raw numbers

Before we get into subjective and soft reasons why sprints are great, just consider how productive they are for Python. To give you an idea, let's focus on three Python conferences of different sizes on three continents.

At PyCon US 2025, 370 new PRs were open to the Python organization during, 286 to the cpython repository alone. Close to 300 PRs were merged into the Python GitHub organization during that time. That's for four days of sprints. This is over 2X the number of PRs handled during the same period when there's no sprint happening.

There's been two days of sprints at EuroPython in Prague this year, but they didn't disappoint either: 122 new PRs open to the Python organization, including 99 to the cpython repository. 79 PRs were merged into the Python GitHub organization during this time. This is 1.75X the number of PRs handled during a typical weekend.

Even single-day sprint days at conferences are pretty productive. At PyCon Korea earlier this August the attendees managed to open 59 new PRs to the Python organization, including 35 PRs to the cpython repository. Over 40 PRs were merged into the Python organization that day. Still 1.7X the typical velocity.

Hopefully, you're seeing what I'm seeing: sprints can provide a measurable boost to an open-source project. The longer the sprints are, the bigger this boost is. This is because many contributions need more than a day to bake, some bugs can be pretty stubborn, and many features uncover surprising depth once you start implementing them.

Momentum

There's something magical about a large group of people banding together to attack problems. While this is what open source is in general, adding together physical presence in the same physical space at the same time is the secret sauce. Real-time coordination really is more efficient. We can guess at reasons for this, but we can safely assume a big part is simply that humans are social animals. It's easier to empathize with a person when they're in the same room with you. In my experience, pointing at a screen still beats Internet communication.

Part of what makes sprints so productive is that it is a time-boxed period of uninterrupted time away from your usual work environment. And that's true for everyone, so people have the ability to focus on a specific project or problem for an extended period of time. But since there's a time limit to how long the sprints are, there's also some productive pressure to ship something concrete by the end of your stay. So, it's rare to see people playing games or doomscrolling during sprints. Instead, they want to ship something, even if it's a humble small first contribution.

Better yet, after you spend some time with a person in real life, even online interactions with them afterwards change. My brain does this thing where it reads GitHub comments of people I know in their voice. This little thing additionally humanizes the pixels on screen and makes the interaction smoother. When you come to sprints, you build more lasting connections, because you don't only talk about stuff in the hallway, you're solving problems together.

You're getting for free what you wouldn't be able to buy if you tried

You're solving problems together alongside developers from different companies, backgrounds and specialties. Some of them are maintainers of the projects you're contributing to, with a wealth of expertise they're sharing freely. You get immediate feedback, you can learn at a rate that is impossible to match online. You learn not only by doing and asking questions, but even just by watching others work. You discover better tools or ways to use them you didn't know existed.

To put it bluntly, the experts you work with during sprints would be impossible to hire as tutors, and here you get to work with them free of charge. Think about it, that alone makes it worth staying for sprints. And don't get cold feet, either, because...

You belong

I've heard some newcomers are worried that maybe the expected experience level is too high. I say you will definitely find something productive to do. I even blogged about this specifically for PyCon US this year, so you can read "What to Expect at PyCon US Sprints" to get an idea about how to make your experience great. The PyCon Korea sprint organizer and Steering Council member Donghee Na says: "I notice that the participants who had a good experience at last year's sprint tend to rejoin the sprint this year. I hope that many of them come back next year too." I'm seeing the same thing, and want to see even more of it. We do care about your experience.

Specifically at PyCon US, this year we tried something new. We split the CPython sprint room into two rooms: one dedicated to first-time contributors, and one to seasoned developers that needed to focus on some feature or bugfix they really wanted to ship before leaving Pittsburgh. It turned out great. Talking to attendees on both ends, I think both rooms enjoyed this setup and we will be repeating that for next year. While I was coordinating the first-time contributor room, I was heartened to see that quite a few veteran core developers joined me in the room. It was fun all four days!

At EuroPython, the setup this year was such that Petr Viktorin and I were coordinating the CPython sprint... or so we thought! In parallel, Adam Turner was leading the CPython documentation sprint, but attendees responded so well to him that he quickly organically became the de facto leader of the entire CPython sprint. Kudos, Adam, you did great!

Dedicated sprint events

It's not all roses with sprints that are attached to conferences. After an intense few days of the larger event, people tend to get tired. Introverts run out of steam. Key people that you could use talking to don't stay or are only available on the first day. If only there could be an event where core developers gather for a week just to sprint. No distracting talks and hallway tracks!

CPython actually does this annually since 2016 with the obvious online-only hiccup of 2020 and 2021. We do love those sprints as they are both productive and fun. Last year we returned to Meta while this year we will be sprinting at Arm Ltd in Cambridge UK. Unlike the conference sprints, this is an invite-only event for core developers where we can focus on making the next version of Python shinier than it would otherwise be.

But maybe organizing sprint-first events makes sense in general? It seems to me like that could be pretty helpful. Or maybe this is already a thing? Let us know if you know of sprint-first events in your area.

And in the meantime, consider staying for sprints at the next conference you're attending. It's well worth it!

 

The 2025 PSF Board Election is Open!

It’s time to cast your vote! Voting for the 2025 PSF Board Election is open starting today Tuesday, September 2nd, 2:00 pm UTC, through Tuesday, September 16th, 2:00 pm UTC. 

How to Vote

If you are a voting member of the PSF who affirmed your intention to participate in this year’s election or you voted in last year’s election, you will receive an email today from “OpaVote Voting Link <noreply@opavote.com>” with a link to your ballot. The subject line will read “Python Software Foundation Board of Directors Election 2025”. If you haven’t seen your ballot by Wednesday, please first check your spam folder for a message from “noreply@opavote.com”. If you can’t find the ballot email from OpaVote please get in touch by emailing psf-elections@pyfound.org so we can look into your account and make sure we have the most up-to-date email for you.

Four seats on the board are open, but you can vote to approve as many of the 13 candidates as you like. We’re delighted by how many of you are willing to contribute to the Python community by serving on the PSF Board! Make sure you take some time to look at all the nominee statements and choose your candidates carefully. 

ATTN: Choose carefully before you press the big green vote button. Once your vote is cast, it cannot be changed.

Who can vote? 

You need to be a Contributing, Supporting, or Fellow member and have affirmed your voting intention by August 26th, 2:00 pm UTC, to vote in this election. Per last year’s Bylaw change that allows for simplifying the voter affirmation process by treating past voting activity as intent to continue voting, if you voted last year, you have been automatically added to the 2025 voter roll. Please note: If you removed or changed your email on psfmember.org, you may not automatically be added to this year's voter roll. 

Reminder that if you were formerly a Managing member, your membership has been updated to Contributing as of June 25th, 2025, per last year’s Bylaw change that merged Managing and Contributing memberships. 

If you’d like to learn more or sign up as a PSF Member, check out our membership types. You can check your membership status on your User Information page on psfmember.org (you will need to be logged in). If you have questions about your membership or the election please email psf-elections@pyfound.org

pypistats.org is now operated by the Python Software Foundation

For a little over six years pypistats.org has been maintained and operated by Christopher Flynn on a volunteer basis. After a recent extended outage made clear the importance of this service to the Python community, and in coordination with Christopher, the Python Software Foundation (PSF) has adopted the project into our GitHub organization and migrated the service to run from our infrastructure.

So what has changed? As far as the day-to-day operations of the service goes the PSF Infrastructure Team will now make sure that pypistats.org’s backing infrastructure, costs, and domain registration are all maintained. Otherwise, there is no material change to the service. The project remains open source and community maintained. We are appreciative that Christopher has stated his intention to stay on as maintainer of the project and we welcome the community to get involved.

We're also grateful to Christopher for his long-term volunteer contribution maintaining this service! As an organization, we are excited to have the opportunity to support pypistats.org and ensure it remains available to the community. Stories like this –under-resourced, but highly depended upon services– are not a new story for the open source community, and we are glad that this story had a positive outcome.

The PSF’s Infrastructure Team is excited to be in a place to adopt services like these into our burgeoning community infrastructure along with services like the PyLadiesCon Portal and memory.python.org. This new community infrastructure, supported by AWS Open Source via their credits program, is backed by the same tooling that delivers pypi.org, python.org, and us.pycon.org along with many other PSF hosted services. We look forward to sharing more in the coming months– not only what we're up to but also how you can get involved!

The 2024 Python Developer Survey Results are here!

We are excited to share the results of the eighth official annual Python Developers Survey. This survey is done yearly as a collaborative effort between the Python Software Foundation and JetBrains. Check out Michael Kennedy's The State of Python 2025 blog post, on the JetBrains blog, which reflects his personal analysis and opinions on the data. Responses were collected October and November of 2024. More than 30,000 Python developers and enthusiasts from almost 200 countries and regions participated in the survey to reveal the current state of the language and the ecosystem around it.

Check out the survey results!

The survey aims to map the Python landscape and covers the following topics:

• General Python usage

• Purpose for using Python

• Python versions

• Frameworks and Libraries

• Cloud Platforms

• Data science

• Development tools

• Python packaging

• Demographics

We encourage you to check out the methodology and the raw data for this year's Python Developers Survey, as well as those from past years (2023, 2022, 2021, 2020, 2019, 2018, and 2017). We would love to hear about what you learn by digging into the numbers! Share your results and comments with us on social media by mentioning JetBrains (LinkedIn, X) and the PSF (Mastodon, LinkedIn, X) using the #pythondevsurvey hashtag. Based on the feedback we received last year, we made adjustments to the 2024 survey- so we welcome suggestions and feedback that could help us improve again for next year!