Viewing profile — notatallshaw

Or an obscure CalVer that no one realizes - /pip-maintainer

FWIW, break-system-packages comes directly from pip's interface, it's not a novel addition from uv. If Astral/OpenAI are willing to support uv pip in the long term, why do you thin…

> Their infrastructure (pip) getting worse and worse Hi, I'm a pip maintainer, can you please report any issue you think is happening in recent versions of pip: https://github.com/…

> Running pip install lightning is all that is needed to activate FYI, pip added cooldowns in 26.1: * https://discuss.python.org/t/announcement-pip-26-1-release/107108 * https://ic…

The note at the end of the post indicates the user asked Claude to review their own chat logs. It's impossible to tell if Claude used or built a a performance harness or just wrote…

Pip maintainer here, to do this in pip (26.0+) now you have to manually calculate the date, e.g. --uploaded-prior-to="$(date -u -d '3 days ago' '+%Y-%m-%dT%H:%M:%SZ')" In pip 26.1 …

The threat actor was sophisticated enough to spam GitHub issues with dozens of different accounts. I imagine they could completely overwhelm PyPI with unauthenticated reports.

> I had no idea how to contact anyone related to PyPI https://pypi.org/security/ : > If you've identified a security issue with a project hosted on PyPI Login to your PyPI account,…

As a pip maintainer I don't think that's really true. The resolver in both pip and uv are fundamentally sequential and single threaded, you can't really queue up or split out jobs.…

pixi offloads PyPI ecosystem stuff to uv, but pixi is conda first. The team were actually the first to build a Rust based Python package resolver (rip), but after uv was released t…

On a widely used open source project I maintain I've been seeing PRs in the last month that are a little off (look okayish but are trivial or trying to solve problems in weird ways…

My understand is Astral's focus for ty has been on making a good experience for common issues, whereas they plan for very high compliance but difficult or rare edge cases aren't ar…

AI is somewhat helpful but I'm not interested in a company finding a way for me to pay to do my volunteer OSS work. GitHub Copilot offers a permanent free subscription for OSS main…

I found the diagrams on the Wikipedia pages help build an intuitive understanding of each step: https://en.wikipedia.org/wiki/Conflict-driven_clause_learnin... Also, the pubgrub-rs…

I assume lock and dependency files are in the training data, so predicting version number tokens have high probabilities associated with them.

As a pip maintainer I primarily think about resolution and resolver performance. I got involved when pip introduced it's current resolver around late 2020, and got my first PR land…

> At one company I worked at, we had a system where each deploy got its own folder, and we'd update a symlink to point to the active one. It worked, but it was all manual, all cust…

We're getting there https://pip.pypa.io/en/stable/cli/pip_lock/ ! Pip has been a flag bearer for Python packaging standards for some time now, so that alternatives can implement st…

Unfortunately that was posted 1 month before the Faster CPython project was disbanded by Microsoft, so I imagine things have slowed.

Python has about 40 keywords, I say I would regularly use about 30, and irregularly use about another 5. Hardly seems like a "junkyard". Further, this lack of first class support f…

> I had been hoping someone would introduce the non-virtualenv package management solution that every single other language has where there's a dependency list and version requirem…

> You let people make the mistake and have the library throw an exception if they do that, not through type checking but just through something eventually calling a method that doe…

> I wouldn't mind a codebase where numpy objects created by dependency B can't be shared directly with dependency A without me first running some kind of conversion function on the…