Undeclared dependencies: what an LLM plugin break teaches about supply-chain hygiene
A small fix in llm-tools-datasette 0.1.1 shows how a core library's HTTP client swap can break plugins that never declared the dependency. It is a low-severity bug, and a useful reminder for anyone running AI tooling in production.
Python 3.15 ships and 3.10 is unsupported: a security upgrade checklist
Python 3.15 adds explicit lazy imports and a sampling profiler that can attach to a running process. With Python 3.10 now out of support, teams still pinned to it have a security reason to move.
Python 3.15.0 lands in GitHub Actions: a CI supply-chain checklist
Python 3.15.0 is now in actions/python-versions, so teams can add it to CI test matrices. It's a routine moment to check how much of your build pipeline silently trusts a moving interpreter.
Wrapture's Zero-Code Monkey-Patching Is a Supply-Chain Question, Not Just a Dev One
Graham Dumpleton's new Python library wrapture patches arbitrary call sites for testing and tracing without touching source code — a capability worth reviewing like any other dependency with deep runtime access.
EVE Online's Python 3 Migration Is a Masterclass in Legacy Runtime Risk
CCP Games is finally moving 2.4 million lines of EVE Online off Python 2 — six years after the interpreter stopped receiving security fixes. It's a useful case study in how technical debt in a runtime, not just an application, becomes a security liability.
Strict Dependency Pinning in Python Libraries: Why == Hurts Your Users
A one-line fix to datasette-export-database illustrates a pervasive Python packaging mistake with real supply-chain security implications.