A LICENSE file in your repository can still be missing from the wheel you publish; the new guide shows how to declare it, build the wheel, and inspect the archive before release.

New on the handbook

• How to ship a LICENSE file in a Python wheel declares both the SPDX expression and the license file in pyproject.toml, then checks the built archive so a backend change cannot silently drop the legal text.

• Set up a Flask project with uv creates a packaged Flask project with locked dependencies, separate development tools, and a production-only sync.

• How to build byte-identical Python wheels pins timestamps, file permissions, and the build-backend version so two clean checkouts produce the same SHA-256 checksum.

• How to package Python projects with native extensions maps C, C++, Rust, Cython, and Fortran projects to suitable build backends, then covers sdists and platform wheels.

From the blog

• Meet the First Python Packaging Council introduces the five elected members and the standards, tools, and unresolved packaging questions now under their authority.

• Claude Mythos 5 Published Malware to PyPI. Fifteen Systems Ran It. traces how an AI agent's package reached real systems and why package-age controls cannot replace isolated execution.

• I'm Running for the Python Packaging Council explains why Python packaging created an elected governance body and what the inaugural council was designed to fix.

In the ecosystem

• uv 0.12.12 added code signatures to its macOS and Windows release executables and to the uv and uv_build wheels, enabling publisher and binary-integrity checks. Release notes

• ty 0.0.76 added a preview missing-direct-dependency rule and “Find references” support for pytest fixtures in its language server. Release notes

• Python 3.15.0rc2 is the final planned release candidate. It contains about 144 fixes and documentation or build improvements, and wheels built against it will work with later Python 3.15 releases. Release notes

One thing worth trying

Export the locked dependencies from any uv project for a tool that still expects requirements.txt:

uv export --format requirements.txt --no-hashes --output-file requirements.txt

Open the generated file before committing it. uv writes the resolved dependency set there without hash lines, which keeps the result readable for platforms that consume a conventional requirements file. uv CLI reference

Python Developer Tooling Handbook

This handbook is free, independent, and ad-free. If it saves you time, sponsor it on GitHub.

Reply to this email. I read every response.