Podcasts

Topics covered in this episode:

• The trusted-publishing debate: how to do it right vs. why you shouldn't trust it
• JupyterLab 4.6 and Notebook 7.6 are out!
• Tau – new small, readable terminal coding agent
• Django Tasks and Django 6.1
• Extras
• Joke

Watch on YouTube

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python
• Consulting from Six Feet Up

Connect with the hosts

• Michael: Mastodon / BlueSky / X / LinkedIn
• Calvin: Mastodon / BlueSky / X / LinkedIn
• Show: Mastodon / BlueSky / X

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Calvin #1: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it

https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/ (Brett Cannon) and https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing (William Woodruff)

• Trusted Publishing (PyPI's OIDC-based auth scheme, also now used by npm, RubyGems, crates.io, NuGet) replaces long-lived API tokens with short-lived, auto-scoped credentials tied to CI/CD machine identity.
• Yossarian's post: it's purely an authentication mechanism between a machine identity and a package — it says nothing about package safety or quality. PyPI deliberately avoids any "verified/trusted" badge for it, unlike its verified-URL checkmarks.
• Same logic applies to PyPI attestations: anyone can sign with any machine identity they control, so an attestation's presence isn't itself a trust signal.
• Bottom line from that post: don't confuse "trusted" (machine-to-machine) with "trustworthy" (human judgment about the package).
• Snarky.ca's companion piece is more practical: given GitHub Actions compromises in the news, the real fix is 3 concrete steps — run zizmor to lock down workflow permissions/checkout credentials and pin actions to commit hashes, adopt Trusted Publishing to eliminate stored PyPI tokens, and require manual approval via a GitHub environment before any publish job runs.
• Takeaway for listeners: Trusted Publishing is good hygiene for how you authenticate to PyPI, but it's not a substitute for securing your CI pipeline itself — or for actually vetting the packages you install.

Michael #2: JupyterLab 4.6 and Notebook 7.6 are out!

Michał Krassowski's rundown - a chunky minor release: 68 features, 97 bug fixes, 95 contributors, one of the biggest ever.

• Scratchpad console (Notebook 7.6 headliner) - a console next to your notebook sharing its kernel, for throwaway experiments. Ctrl+B.
• Jump to last-edited cell - new commands hop through recently edited cells.
• File browser glow-up - Date Created column, editable breadcrumbs with Tab-completion, and Open in Terminal.
• Debugger - sources open in the main area, floating step/continue overlay, live kernel-sources filter.
• Custom layouts (Lab) - activity bar top/bottom, draggable panels, four-way tab splits, per-panel Ctrl+scroll zoom.
• ~5x faster extension builds - webpack → Rspack, and jupyter-builder means no full Lab install needed to build extensions.
• Keyboard/a11y - add shortcuts from the UI (no JSON), Find & Replace in Edit menu (Ctrl+H).

Calvin #3: Tau – new small, readable terminal coding agent

• Tau – new small, readable terminal coding agent (Python 3.12+), built as both a working tool and a teaching project for how coding agents work under the hood
• Install via uv tool install tau-ai, pipx, or pip; ships a tau CLI
• Three-layer architecture: tau_ai (provider-neutral model layer) → tau_agent (reusable "brain": messages, tools, events, loop) → tau_coding (CLI/TUI, file & shell tools, sessions)
• Supports OpenAI, Anthropic, OpenAI Codex, OpenRouter, Hugging Face, and custom/local OpenAI-compatible endpoints
• Built-in tools (read/write/edit/bash), durable JSONL sessions with resume/branching, project instructions via AGENTS.md, and context compaction
• Core harness is UI-agnostic — same brain can power the TUI, print mode, or a custom frontend — usable as a standalone library too

Michael #4: Django Tasks and Django 6.1

• Django 6.0 finally ships first-party background tasks (django.tasks) - out of Jake Howard's DEP 14, accepted May 2024, after two decades of everyone bolting on Celery/RQ/Huey.
• It's an API, not a worker. Django handles task definition, validation, queuing, and result storage - it does not execute them. You bring the backend.
• The default backend traps people. ImmediateBackend runs tasks inline on the request thread and blocks until done - so out of the box .enqueue() backgrounds nothing (a 5-second task means a 5-second response). The other built-in, DummyBackend, runs nothing at all. Both are dev/test only.
• Nice API otherwise: slap @task on a function, call .enqueue(), get back a TaskResult you look up later by id - with async twins like aenqueue(). Gotcha: args and return values must survive a JSON round-trip, so a tuple sneakily comes back as a list.
• The community local backend to know: django-tasks-local by Chris Beaven (SmileyChris). A ThreadPoolExecutor backend that gives real background threads with zero infrastructure - no Redis, no Celery, no database - plus a ProcessPoolBackend for CPU-bound work → github.com/lincolnloop/django-tasks-local
• Its catch: results live in memory, so pending tasks vanish on restart or deploy. Great for dev and low-traffic production; for persistence, drop to Jake Howard's django-tasks (DatabaseBackend + worker command).

Extras

Calvin:

• Fixing the dictionary with Python 3.14 — Hugo van Kemenade stumbled on - and got fixed - a markup bug in the OED's own citation of a 1706 use of the pi symbol.

Michael:

• Bunny DNS is now free

Jokes:

• What's the object-oriented way to become wealthy? Inheritance
• To understand what recursion is... You must first understand what recursion is
• 3 SQL statements walk into a NoSQL bar. Soon, they walk out They couldn't find a table.

We discuss why the Milwaukee Bucks should be punished for their blatant circumvention of the salary cap with Gary Trent Jr, and whether it’s the most ridiculous contract in NBA history.

Victor Wembanyama limits himself to the 25% max. How does that simplify the Spurs’ future?

Plus, WATFOs on Bronny James, Jaylen Brown in Philly, the dregs of the West, the Bucks being punished, and Bronny James.

Join Dunc’d On Prime for 35% off using the code mockoffseason2026! It's the only place to get every episode with Nate & Danny, plus every pod with John Hollinger & Nate as well!

Subscribe on YouTube to get Dunc'd On Clutch Calls, Real Video Scouts, and more.

Or, sign up for our FREE mailing list to get Dan Feldman's Daily Duncs with all the major topics around the league twice a week.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

OA1279 - This week on Rapid Response Friday: A federal judge rips up the corrupt “settlement” Trump reached with his own IRS at the unprecedented request of a group of 35 former federal judges just in time time for aspiring Attorney General Todd Blanche’s confirmation hearing, humanizing the latest victims of ICE, and a metafootnote about a DC judge who hates footnotes nearly as much as Matt loves them.

The Agenda:

• Williams' IRS ruling

• Blanche confirmation hearing

• Salgado Araujo shooting

• Duran Guerrero shooting

• Boasberg's footnote crusade

Check out the OA Linktree for all the places to go and things to do!

Zach and Denver Nuggets head coach Michael Malone go behind the scenes on the Nuggets journey to the 2023 NBA title, then ESPN's Ohm Youngmisuk join to talk the Clippers at the crossroads, the James Harden situation, and more.  Learn more about your ad choices. Visit megaphone.fm/adchoices

Bill rambles about 90's heroine sheik, roller coaster malfunctions, and heli-hogging.

---

Squarespace:  Head to www.squarespace.com/BURR for a free trial, and when you’re ready to launch, use OFFER CODE: (BURR) to save 10% off your first purchase of a website or domain.

Hims:  To get simple, online access to personalized, affordable care for ED, Hair Loss, Weight Loss, and more, visit www.Hims.com/BURR 

Three frustrated Irish Catholics head to Long Island and share a couple of beers while revisiting Ed Burns’s 1996 romantic comedy, ‘She’s the One,’ starring Ed Burns, Jennifer Aniston, Cameron Diaz, and Mike McGlone. Producers: Craig Horlbeck, Chia Hao Tat, Eduardo Ocampo, and Matt Pevic Learn more about your ad choices. Visit podcastchoices.com/adchoices

In this special episode of The Bill Simmons Podcast, guest host Chris Ryan is joined by Arsenal legend Ian Wright to react to Argentina defeating England 2-1 in the World Cup semifinals. Then, Anthony Dabbundo joins the pod to preview the World Cup final between Spain and Argentina. Finally, Sean Fennessey hops on to talk ‘The Odyssey’ and Christopher Nolan. (0:00) Intro (2:57) Argentina eliminates England, with Ian Wright (34:47) World Cup final preview with Anthony Dabbundo (55:21) Sean Fennessey on ‘The Odyssey’ Host: Chris Ryan Guests: Ian Wright, Anthony Dabbundo, and Sean Fennessey Producers: Chia Hao Tat, Eduardo Ocampo, and Chris Wohlers Brought to you by PayPal. Learn more at paypal.comAs the Official Beer Sponsor of the FIFA World Cup 26, Michelob ULTRA away $1million in FIFA World Cup tickets and prizes. https://www.michelobultra.com/superioraccess/FIFAWORLDCUP26 MICHELOB ULTRA® FIFA® WORLD CUP 26TM SUPERIOR ACCESS. No Purchase Necessary. Open to US residents 21+. Begins on 12/1/25 and ends on 7/31/26. Multiple entry periods. Visit https://www.michelobultra.com/superioraccess/FIFAWORLDCUP26 for free entry, entry deadlines, and Official Rules. Message and data rates may apply. Void where prohibited.The Ringer is committed to responsible gaming. Please visit https://fanduel.com/playwithaplan to learn more about the resources and helplines Learn more about your ad choices. Visit podcastchoices.com/adchoices

Python has many string formatting styles which have been added to the language over the years. Early Python used the % operator to injected formatted values into strings. And we have string.format() which offers several powerful styles. Both were verbose and indirect, so f-strings were added in Python 3.6. But these f-strings lacked security features (think little bobby tables) and they manifested as fully-formed strings to runtime code. Today we talk about the next evolution of Python string formatting for advanced use-cases (SQL, HTML, DSLs, etc): t-strings. We have Paul Everitt, David Peck, and Jim Baker on the show to introduce this upcoming new language feature.

Episode sponsors

Posit
Auth0
Talk Python Courses

Links from the show