--- title: Ruff v0.16.0 expands defaults sevenfold, PyPI locks down... description: Ruff v0.16.0 jumped from 59 to 413 default rules — run it against an existing project and expect a long triage list. PyPI now rejects file uploads to releases... canonical: https://daily.dev/posts/ruff-v0-16-0-expands-defaults-sevenfold-pypi-locks-down-old-releases-pchnopbab twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ruff v0.16.0 expands defaults sevenfold, PyPI locks down old releases | daily.dev og:description: Ruff v0.16.0 jumped from 59 to 413 default rules — run it against an existing project and expect a long triage list. PyPI now rejects file uploads to releases... og:url: https://daily.dev/posts/ruff-v0-16-0-expands-defaults-sevenfold-pypi-locks-down-old-releases-pchnopbab og:image: https://api.daily.dev/og/posts/PCHNopbaB.png og:image:alt: Ruff v0.16.0 expands defaults sevenfold, PyPI locks down old releases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ruff v0.16.0 expands defaults sevenfold, PyPI locks down old releases **[Python Digest](https://daily.dev/sources/python_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Ruff v0.16.0 jumped from 59 to 413 default rules — run it against an existing project and expect a long triage list. PyPI now rejects file uploads to releases older than 14 days, a direct response to supply chain attacks on LiteLLM and Telnyx. Django 6.1 RC1 is out with a final release targeting August 5. The Python Packaging Council is holding its first election, with nominations opening July 28th. ## Content **TLDR:** Ruff v0.16.0 jumped from 59 to 413 default rules — run it against an existing project and expect a long triage list. PyPI now rejects file uploads to releases older than 14 days, a direct response to supply chain attacks on LiteLLM and Telnyx. Django 6.1 RC1 is out with a final release targeting August 5. The Python Packaging Council is holding its first election, with nominations opening July 28th. --- ## Ruff v0.16.0 expands default rules from 59 to 413 The jump is real — Simon Willison ran it against sqlite-utils and got 1,618 flagged issues on first pass. The new defaults focus on syntax errors and runtime bugs rather than style nitpicks, so the noise-to-signal ratio should be reasonable even if the initial count looks alarming. This release also adds Markdown code block formatting, inline diffs for check/format output, and new `ruff: ignore` suppression comment formats. One breaking change worth noting: JSON output field nullability has changed, so if you're parsing Ruff's output programmatically, check the release notes before upgrading. [Read more](https://daily.dev/posts/SPWxqhGGA) ## PyPI rejects uploads to releases older than 14 days, GitHub Dependabot adds 72-hour cooldown PyPI's new rule was triggered by attacks on LiteLLM and Telnyx packages, where compromised publishing tokens were used to quietly poison old, trusted releases. The 14-day window has minimal real-world impact — only 56 of the top 15,000 packages had published cp314 wheels more than 14 days after a release. GitHub's Dependabot now enforces a default 72-hour waiting period before auto-adopting newly published package updates, giving security tools time to flag malicious packages. Both changes target the same attack pattern: compromise a token, poison a release before anyone notices. [Read more](https://daily.dev/feed-by-ids?id=Ht2tsbclg&id=04kSyP92r) ## Django 6.1 RC1 out, final release targeting August 5 Django 6.1 release candidate 1 marks the string freeze — translators should submit translations now. If no major bugs surface, the final release lands around August 5. The RC also coincides with DjangoCon US 2026 in Chicago (August 24–28), where the hotel room block deadline is August 3. Carlton Gibson's Talk Python appearance this week is worth a listen for the async story update: the Tasks framework for background work, fetch modes for N+1 problems, and database-level cascades are all landing in 6.0/6.1. [Read more](https://daily.dev/feed-by-ids?id=UMCk57pwe&id=UqLEV855M&id=40oqRBJYC&id=7KphTFQa9) ## Python Packaging Council holds first election, nominations open July 28 The PSF is launching the Python Packaging Council — the official technical body for packaging interoperability specs, meant to give competing tools (pip, uv, Poetry, conda) a governance layer that can actually settle disputes. Five seats fill in this first election: the top two vote-getters get two-year terms, the next three get one-year terms. Nominations close August 11, voting runs September 1–15. If you maintain anything that touches Python packaging, now is the time to either run or confirm you're eligible to vote. [Read more](https://daily.dev/feed-by-ids?id=lH5gZZzv5&id=RmrPoxjQm) --- ## Also notable - **mrmustard 0.7.4 PyPI package contained credential-stealing malware:** An attacker compromised a maintainer's GitHub account, used the project's own CI to steal the PyPI publishing token, then uploaded a poisoned package that exfiltrates SSH keys, AWS credentials, and Kubernetes configs on every import — and installs three persistence mechanisms that survive package removal. [Read more](https://daily.dev/posts/NZ7IWdUDf) - **pip 26.2 adds --only-deps flag, resolving a 16-year-old frustration:** The new flag installs only a package's runtime dependencies without installing the package itself — previously requiring manual workarounds or `uv sync --no-install-project` — and is particularly useful for CI workflows and building source distributions. [Read more](https://daily.dev/posts/eRWljQDxC) - **PyCharm 2026.2 ships Pyrefly type engine and native uv workspace support:** The release integrates the Pyrefly type engine for faster type checking in large codebases, promotes debugpy to default debugger via the Debug Adapter Protocol, and adds out-of-the-box support for uv, Poetry, and Hatch multi-project workspaces. [Read more](https://daily.dev/posts/oSnoY1EzQ) - **FastAPI async def blocking calls caused 90-second request freezes in production:** Synchronous weasyprint (~420ms) and requests.post (up to 1.4s) inside async handlers held the event loop hostage, causing health check timeouts and pod cycling — fixed by wrapping CPU-bound work in run_in_threadpool and replacing requests with httpx.AsyncClient, with flake8-async added to block future PRs. [Read more](https://daily.dev/posts/Rt72TpJ7m) - **PEP 751 pylock.toml standardizes tool-agnostic Python lock files:** Generated by pip v25.1+ or uv and consumable by pip, uv, and pdm interchangeably, pylock.toml records exact versions, artifact URLs, and SHA256 hashes — cross-tool portability that requirements.txt never offered. [Read more](https://daily.dev/posts/Z0WEYr53V) --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django) [View this post on daily.dev](https://daily.dev/posts/ruff-v0-16-0-expands-defaults-sevenfold-pypi-locks-down-old-releases-pchnopbab) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/ruff-v0-16-0-expands-defaults-sevenfold-pypi-locks-down-old-releases-pchnopbab","headline":"Ruff v0.16.0 expands defaults sevenfold, PyPI locks down old releases","text":"Ruff v0.16.0 jumped from 59 to 413 default rules — run it against an existing project and expect a long triage list. PyPI now rejects file uploads to releases older than 14 days, a direct response to supply chain attacks on LiteLLM and Telnyx. Django 6.1 RC1 is out with a final release targeting August 5. The Python Packaging Council is holding its first election, with nominations opening July 28th.","url":"https://daily.dev/posts/ruff-v0-16-0-expands-defaults-sevenfold-pypi-locks-down-old-releases-pchnopbab","datePublished":"2026-07-27T04:21:33.937Z","dateModified":"2026-07-27T04:21:54.345Z","author":{"@type":"Organization","name":"Python Digest","logo":"https://media.daily.dev/image/upload/s--_8Rk7XLS--/f_auto,q_auto/v1776326905/logos/python_digest","url":"https://daily.dev/sources/python_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/python_digest","name":"Python Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Python Digest","item":"https://daily.dev/sources/python_digest"},{"@type":"ListItem","position":3,"name":"Ruff v0.16.0 expands defaults sevenfold, PyPI locks down old releases"}]} ```