Stop watching your CI pipeline get backdoored. PyPI’s 2026 security upgrades — Trusted Publishing, Sigstore attestations, and the PSF’s $1.5M Anthropic grant — finally give maintainers real defenses against supply chain attacks. Here is what changed and what to do now.
Fire off 50 async tasks and one timeout can bring down 49 others. asyncio.TaskGroup fixes this with structured concurrency — here are the patterns that matter in 2026.
