Pip 26.1 introduces dependency cooldowns, which enforce a waiting period before freshly published packages can be installed, and experimental support for `pylock.toml` lockfiles from PEP 751. The cool…
Process of registering the "CLI Market" server on the official MCP Registry, which involved creating a `mcp.json` file, proving ownership by embedding a specific HTML comment in the PyPI package's REA…
A maximum-severity vulnerability, tracked as CVE-2026-45829, has been discovered in the Python FastAPI version of the open-source AI database ChromaDB, allowing unauthenticated attackers to execute ar…
A developer has released an open-source supply-chain audit script, "Mini Shai-Hulud," designed to detect the TanStack Router and Mistral AI supply-chain attacks. The bash script checks for specific SH…
The PyTorch Lightning deep-learning framework was compromised on PyPI, with versions 2.6.2 and 2.6.3 containing a credential-stealing worm called Shai-Hulud. The malware activates when Python code run…