7 ms·

There's no mention of what Python version this is actually in. After some digging, it looks like the answer is 3.14 [0], so we won't be seeing this until Octob

There's no mention of what Python version this is actually in. After some digging, it looks like the answer is 3.14 [0], so we won't be seeing this until October [1]. One could argue that this is a security fix (just read the first sentence of the blog post) and should be included in all the currently supported versions (>=3.9) of Python [2]. [0] https://github.com/python/cpython/blob/main/Doc/whatsnew/3.14.rst#hmac https://github.com/python/cpython/blob/main/Doc/whatsnew/3.1... [1] https://peps.python.org/pep-0745/ https://peps.python.org/pep-0745/ [2] https://devguide.python.org/versions/ https://devguide.python.org/versions/

ashishb 1y ago
Many famous libraries like Spacy do not support Python 3.13 and are stuck on Python 3.12 (Oct 2023). So, even if this comes out in Python 3.14, any non-trivial project will have to wait till Oct 2026 (or Oct 2027) to be able to use it. 1 - https://github.com/explosion/spaCy/issues/13658 https://github.com/explosion/spaCy/issues/13658
- pbronez 1y ago
  Just ran into something similar with Great Expectations. Python 3.12 is the newest I can run.
  - 0cf8612b2e1e 1y ago
    uv seems to have reverted to defaulting to 3.12 instead of 3.13. Which I fully endorse owing to how many packages are not yet compatible.
  - ashishb 1y ago
    Exactly, many compiled languages like Java and Go do not suffer from this issue.
    - fiddlerwoaroof 1y ago
      Tell that to all the companies stuck on Java 8 with old versions of Spring and Hibernate. This is the cost of an ecosystem where major libraries make breaking changes.
      - lmm 1y ago
        Spring and Hibernate broke the rules of the language and paid the price, and nevertheless all the companies I'm aware of managed to migrate the best part of a decade ago.
    - LtWorf 1y ago
      It's not about being compiled or not compiled. Python is now making breaking changes on every release instead of piling up a bunch of them and making python 4. So what we get is a a mini python2/3 situation on every single release instead.
      - ashishb 1y ago
        Yeah. Even patch version upgrade from 3.12.3 to 3.12.4 broke a lot of packages. https://github.com/langchain-ai/langchain/issues/22692 https://github.com/langchain-ai/langchain/issues/22692
- arp242 1y ago
  Good grief that issue is a clusterfuck of bozos. Sometimes I wish there was a GitHub with entry exam. "A library you use has a bug, you find a find a 3 month old bug report for your exact issue. Do you 1) add a comment with "me too", 2) express your frustration this issue hasn't been fixed yet, 3) demand the maintainers fix it as soon as possible as it's causing issues for you, or 4) do nothing". Only half joking.
  - rowanG077 1y ago
    I actually find that hugely helpful that so many people are actually actively expressing they are hitting this. It's not easy to be able to get an idea what issues people are actually hitting with anything you have made. An issue being bumped with essentially "me too" is a highly valuable signal.
    - hkt 1y ago
      Reactions, though.
    - stingraycharles 1y ago
      It’s not just that, it’s people commenting “this is unacceptable” and “I hate this library” that add very little value. Also, you can upvote issues as well / leave reactions without leaving comments. It ensures a better signal:noise ratio in the actual discussion.
    - arp242 1y ago
      Do you really think the maintainers don't understand that "doesn't work with Python 3.13" isn't going to affect tons of people? There's some bozo asking "any news? I cant downgrade because another lib requirement" just two days after the maintainer wrote several paragraphs explaining how difficult it is to make it work with Python 3.13. This adds no value for anyone and is just noise. Anyone interested in actual useful information (workarounds, pointers on how to help) has to wade though a firehose of useless nonsense to get at anything remotely useful. Any seriously discussions of maintainers wanting to discuss things is constantly interrupted by the seagulls from Finding Nemo: "fix? fix? fix? fix? fix?"" Never mind the demanding nature of some people in that thread. Just upvote. That's why this entire feature was added.
- rtpg 1y ago
  I was going to write something glib about getting things fixed but that thread looks gnarly! To be honest I know so many people who use Pydantic and so many people who seem to get stuck because of Pydantic 2. I’m glad I have minimal exposure to that lib, personally. I suppose the biggest issue really is type annotation usage by libs being intractable
- rhdunn 1y ago
  I hit this when upgrading to Ubuntu 25.04 as that upgraded to Python 3.13. I'm running the various python projects I want in a venv. For the projects stuck on 3.12 I ended up building and installing it from source to my local directory (removing the unprefixed links for compatibility) as the ppa for Python ports doesn't (didn't?) support the latest Ubuntu. I dislike using something like docker or conda as I don't want to install/use a separate distro just to be able to use a different version of Python. My setup is working well so far.
  - turbocon 1y ago
    Everyone has there own preferences, but I'd look into uv if I were you. It allows you to specify the python version, and for scripts you can even specify the python version as part of the shebang
    - Imustaskforhelp 1y ago
      uv is literally the goat except I haven't able to make vllm work in uv for some reason. Though aside from that, I think I need to use shebang more because I don't use it as often right now.
- sitkack 1y ago
  I have been getting paid to write Python since the late 90s and it amazes me how it consistently has these needless own goals, yet still keeps on going in spite of itself. Way to go Python! spaCy should make Cython optional hard fork Cython to not used stringitized annotations stay on Python 3.12 forever and then skip to 3.15 It is like have a crowd of people trying to outdo each other on how much self harm they can induce.
  - ChrisMarshallNY 1y ago
    > It is like have a crowd of people trying to outdo each other on how much self harm they can induce. See: Lemmings[0] [0] https://en.wikipedia.org/wiki/Lemmings_(National_Lampoon) https://en.wikipedia.org/wiki/Lemmings_(National_Lampoon)
    - sitkack 1y ago
      I am picturing a whole dis track at pycon where we creatively mock everything and everyone.
  - martinky24 1y ago
    What exactly is the own goal here…? They’re making the language better in the upcoming release. This is how normal software works. In no world is this an “own goal”. God forbid they take on a big task for the betterment of the future language.
    - sitkack 1y ago
      I don’t think you understand the whole issue of why spaCy can’t move to Python 3.13 God forbid.
    - yjftsjthsd-h 1y ago
      > What exactly is the own goal here…? They’re making the language better in the upcoming release. This is how normal software works. Backward incompatible changes are an own goal because they either (depending on your view) make the software worse, or make it better and then make those improvements unavailable to users.
- bsoles 1y ago
  Does that mean that a point release of Python has breaking changes? If true, that sounds crazy.
  - dymk 1y ago
    Yes, things like format string syntax change between 3.10 and 3.11 and it’s incredibly frustrating
  - aftbit 1y ago
    Yes, every Python 3 release for me (at least since 3.6) has had a breaking change or two that affects a library I use. Most of the time, the fix is pretty trivial, but not always.
devrandoom 1y ago
> One could argue How?
- chrisrodrigue 1y ago
  From https://github.com/python/cpython/issues/99108#issue-1436673526 https://github.com/python/cpython/issues/99108#issue-1436673...: > As evidenced by the recent SHA3 buffer overflow, cryptographic primitives are tricky to implement correctly. There might be issues with memory management, exceeding lengths, incorrect buffer management, or worse, incorrect implementations in corner cases. This is a proactive fix for zero days that may be lurking in the wild.

ashishb 1y ago

Many famous libraries like Spacy do not support Python 3.13 and are stuck on Python 3.12 (Oct 2023). So, even if this comes out in Python 3.14, any non-trivial project will have to wait till Oct 2026 (or Oct 2027) to be able to use it. 1 - https://github.com/explosion/spaCy/issues/13658 https://github.com/explosion/spaCy/issues/13658

pbronez 1y ago
Just ran into something similar with Great Expectations. Python 3.12 is the newest I can run.
- 0cf8612b2e1e 1y ago
  uv seems to have reverted to defaulting to 3.12 instead of 3.13. Which I fully endorse owing to how many packages are not yet compatible.
- ashishb 1y ago
  Exactly, many compiled languages like Java and Go do not suffer from this issue.
  - fiddlerwoaroof 1y ago
    Tell that to all the companies stuck on Java 8 with old versions of Spring and Hibernate. This is the cost of an ecosystem where major libraries make breaking changes.
    - lmm 1y ago
      Spring and Hibernate broke the rules of the language and paid the price, and nevertheless all the companies I'm aware of managed to migrate the best part of a decade ago.
  - LtWorf 1y ago
    It's not about being compiled or not compiled. Python is now making breaking changes on every release instead of piling up a bunch of them and making python 4. So what we get is a a mini python2/3 situation on every single release instead.
    - ashishb 1y ago
      Yeah. Even patch version upgrade from 3.12.3 to 3.12.4 broke a lot of packages. https://github.com/langchain-ai/langchain/issues/22692 https://github.com/langchain-ai/langchain/issues/22692
arp242 1y ago
Good grief that issue is a clusterfuck of bozos. Sometimes I wish there was a GitHub with entry exam. "A library you use has a bug, you find a find a 3 month old bug report for your exact issue. Do you 1) add a comment with "me too", 2) express your frustration this issue hasn't been fixed yet, 3) demand the maintainers fix it as soon as possible as it's causing issues for you, or 4) do nothing". Only half joking.
- rowanG077 1y ago
  I actually find that hugely helpful that so many people are actually actively expressing they are hitting this. It's not easy to be able to get an idea what issues people are actually hitting with anything you have made. An issue being bumped with essentially "me too" is a highly valuable signal.
  - hkt 1y ago
    Reactions, though.
  - stingraycharles 1y ago
    It’s not just that, it’s people commenting “this is unacceptable” and “I hate this library” that add very little value. Also, you can upvote issues as well / leave reactions without leaving comments. It ensures a better signal:noise ratio in the actual discussion.
  - arp242 1y ago
    Do you really think the maintainers don't understand that "doesn't work with Python 3.13" isn't going to affect tons of people? There's some bozo asking "any news? I cant downgrade because another lib requirement" just two days after the maintainer wrote several paragraphs explaining how difficult it is to make it work with Python 3.13. This adds no value for anyone and is just noise. Anyone interested in actual useful information (workarounds, pointers on how to help) has to wade though a firehose of useless nonsense to get at anything remotely useful. Any seriously discussions of maintainers wanting to discuss things is constantly interrupted by the seagulls from Finding Nemo: "fix? fix? fix? fix? fix?"" Never mind the demanding nature of some people in that thread. Just upvote. That's why this entire feature was added.
rtpg 1y ago
I was going to write something glib about getting things fixed but that thread looks gnarly! To be honest I know so many people who use Pydantic and so many people who seem to get stuck because of Pydantic 2. I’m glad I have minimal exposure to that lib, personally. I suppose the biggest issue really is type annotation usage by libs being intractable
rhdunn 1y ago
I hit this when upgrading to Ubuntu 25.04 as that upgraded to Python 3.13. I'm running the various python projects I want in a venv. For the projects stuck on 3.12 I ended up building and installing it from source to my local directory (removing the unprefixed links for compatibility) as the ppa for Python ports doesn't (didn't?) support the latest Ubuntu. I dislike using something like docker or conda as I don't want to install/use a separate distro just to be able to use a different version of Python. My setup is working well so far.
- turbocon 1y ago
  Everyone has there own preferences, but I'd look into uv if I were you. It allows you to specify the python version, and for scripts you can even specify the python version as part of the shebang
  - Imustaskforhelp 1y ago
    uv is literally the goat except I haven't able to make vllm work in uv for some reason. Though aside from that, I think I need to use shebang more because I don't use it as often right now.
sitkack 1y ago
I have been getting paid to write Python since the late 90s and it amazes me how it consistently has these needless own goals, yet still keeps on going in spite of itself. Way to go Python! spaCy should make Cython optional hard fork Cython to not used stringitized annotations stay on Python 3.12 forever and then skip to 3.15 It is like have a crowd of people trying to outdo each other on how much self harm they can induce.
- ChrisMarshallNY 1y ago
  > It is like have a crowd of people trying to outdo each other on how much self harm they can induce. See: Lemmings[0] [0] https://en.wikipedia.org/wiki/Lemmings_(National_Lampoon) https://en.wikipedia.org/wiki/Lemmings_(National_Lampoon)
  - sitkack 1y ago
    I am picturing a whole dis track at pycon where we creatively mock everything and everyone.
- martinky24 1y ago
  What exactly is the own goal here…? They’re making the language better in the upcoming release. This is how normal software works. In no world is this an “own goal”. God forbid they take on a big task for the betterment of the future language.
  - sitkack 1y ago
    I don’t think you understand the whole issue of why spaCy can’t move to Python 3.13 God forbid.
  - yjftsjthsd-h 1y ago
    > What exactly is the own goal here…? They’re making the language better in the upcoming release. This is how normal software works. Backward incompatible changes are an own goal because they either (depending on your view) make the software worse, or make it better and then make those improvements unavailable to users.
bsoles 1y ago
Does that mean that a point release of Python has breaking changes? If true, that sounds crazy.
- dymk 1y ago
  Yes, things like format string syntax change between 3.10 and 3.11 and it’s incredibly frustrating
- aftbit 1y ago
  Yes, every Python 3 release for me (at least since 3.6) has had a breaking change or two that affects a library I use. Most of the time, the fix is pretty trivial, but not always.

devrandoom 1y ago

> One could argue How?

chrisrodrigue 1y ago
From https://github.com/python/cpython/issues/99108#issue-1436673526 https://github.com/python/cpython/issues/99108#issue-1436673...: > As evidenced by the recent SHA3 buffer overflow, cryptographic primitives are tricky to implement correctly. There might be issues with memory management, exceeding lengths, incorrect buffer management, or worse, incorrect implementations in corner cases. This is a proactive fix for zero days that may be lurking in the wild.