From ad5f3931c9a48d8ac0db8d95e1716abef0603016 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:50:37 +0800 Subject: [PATCH 1/7] feat: add tarfile to File Manipulation Mints the Archives use case. The standard library is the obvious choice for tar archives, and the null override keeps the downloads sweep from querying a same-named PyPI package. Co-Authored-By: Claude --- README.md | 2 ++ website/data/pypi_name_overrides.json | 1 + 2 files changed, 3 insertions(+) diff --git a/README.md b/README.md index ebfaf9cc..03471580 100644 --- a/README.md +++ b/README.md @@ -1005,6 +1005,8 @@ _Libraries for file manipulation._ - [zstandard](https://github.com/indygreg/python-zstandard) - Python bindings to the Zstandard (zstd) compression library. - [brotli](https://github.com/google/brotli) - Python bindings for Google's Brotli compression library. - [lz4](https://github.com/python-lz4/python-lz4) - Python bindings for the LZ4 fast compression library. +- Archives + - [tarfile](https://docs.python.org/3/library/tarfile.html) - (Python standard library) Read and write tar archives, including gzip, bz2, lzma, and zstd compressed ones. **Media** diff --git a/website/data/pypi_name_overrides.json b/website/data/pypi_name_overrides.json index 4366e5ec..6792c0f6 100644 --- a/website/data/pypi_name_overrides.json +++ b/website/data/pypi_name_overrides.json @@ -40,6 +40,7 @@ "sqlite3": { "package": null, "reason": "stdlib module" }, "strawberry": { "package": "strawberry-graphql", "reason": "PyPI strawberry is an unrelated bookmarking service" }, "strawberry-django": { "package": "strawberry-graphql-django", "reason": null }, + "tarfile": { "package": null, "reason": "stdlib module" }, "thealgorithms": { "package": null, "reason": "educational monorepo, not a package" }, "tkinter": { "package": null, "reason": "stdlib module" }, "tomllib": { "package": null, "reason": "stdlib module" }, From 43dcc46e3918e53644c42483dffe76d1cc3ac587 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:50:48 +0800 Subject: [PATCH 2/7] feat: add zipfile to File Manipulation The standard library is the obvious choice for ZIP archives. Co-Authored-By: Claude --- README.md | 1 + website/data/pypi_name_overrides.json | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index 03471580..ed14f0b0 100644 --- a/README.md +++ b/README.md @@ -1007,6 +1007,7 @@ _Libraries for file manipulation._ - [lz4](https://github.com/python-lz4/python-lz4) - Python bindings for the LZ4 fast compression library. - Archives - [tarfile](https://docs.python.org/3/library/tarfile.html) - (Python standard library) Read and write tar archives, including gzip, bz2, lzma, and zstd compressed ones. + - [zipfile](https://docs.python.org/3/library/zipfile.html) - (Python standard library) Read and write ZIP archives. **Media** diff --git a/website/data/pypi_name_overrides.json b/website/data/pypi_name_overrides.json index 6792c0f6..eae6aa70 100644 --- a/website/data/pypi_name_overrides.json +++ b/website/data/pypi_name_overrides.json @@ -49,5 +49,6 @@ "uv-audit": { "package": null, "reason": "part of uv (the `uv audit` subcommand); PyPI uv-audit is an unrelated third-party tool by rocshers" }, "winpython": { "package": null, "reason": "distribution with its own installer; PyPI name is a 2012 relic" }, "wshobson-agents": { "package": null, "reason": "agent skills repo, not a package" }, + "zipfile": { "package": null, "reason": "stdlib module" }, "zoneinfo": { "package": null, "reason": "stdlib module" } } From ade3c84a927dfa879a86ef5e203b6b6675dc7660 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:50:56 +0800 Subject: [PATCH 3/7] feat: add py7zr to File Manipulation The 7-Zip library, with 11.4M downloads/month (pypistats, 2026-11-15) spread over 432 dependents (deps.dev). Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index ed14f0b0..4efb62ae 100644 --- a/README.md +++ b/README.md @@ -1008,6 +1008,7 @@ _Libraries for file manipulation._ - Archives - [tarfile](https://docs.python.org/3/library/tarfile.html) - (Python standard library) Read and write tar archives, including gzip, bz2, lzma, and zstd compressed ones. - [zipfile](https://docs.python.org/3/library/zipfile.html) - (Python standard library) Read and write ZIP archives. + - [py7zr](https://github.com/miurahr/py7zr) - A pure-Python library for reading and writing 7-Zip archives. **Media** From a95a545eccd8c43d0e771c3ac3f05cf3452c0833 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:51:00 +0800 Subject: [PATCH 4/7] feat: add pyzipper to File Manipulation A zipfile fork that adds AES encryption, which the standard library zipfile can't write, with 8.2M downloads/month (pypistats, 2026-11-15). Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 4efb62ae..1d9d0ef4 100644 --- a/README.md +++ b/README.md @@ -1009,6 +1009,7 @@ _Libraries for file manipulation._ - [tarfile](https://docs.python.org/3/library/tarfile.html) - (Python standard library) Read and write tar archives, including gzip, bz2, lzma, and zstd compressed ones. - [zipfile](https://docs.python.org/3/library/zipfile.html) - (Python standard library) Read and write ZIP archives. - [py7zr](https://github.com/miurahr/py7zr) - A pure-Python library for reading and writing 7-Zip archives. + - [pyzipper](https://github.com/danifus/pyzipper) - Read and write AES-encrypted ZIP files ([zipfile](https://docs.python.org/3/library/zipfile.html) fork). **Media** From b982372992f0fad57c51ca413967a6cd95b206f1 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:51:00 +0800 Subject: [PATCH 5/7] feat: add rarfile to File Manipulation The RAR reader, with 2.7M downloads/month (pypistats, 2026-11-15) spread over 318 dependents (deps.dev). Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 1d9d0ef4..2e0db082 100644 --- a/README.md +++ b/README.md @@ -1010,6 +1010,7 @@ _Libraries for file manipulation._ - [zipfile](https://docs.python.org/3/library/zipfile.html) - (Python standard library) Read and write ZIP archives. - [py7zr](https://github.com/miurahr/py7zr) - A pure-Python library for reading and writing 7-Zip archives. - [pyzipper](https://github.com/danifus/pyzipper) - Read and write AES-encrypted ZIP files ([zipfile](https://docs.python.org/3/library/zipfile.html) fork). + - [rarfile](https://github.com/markokr/rarfile) - A RAR archive reader with a zipfile-like API. **Media** From 3856003a3094130a2da70f8517636d09e4184677 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:52:58 +0800 Subject: [PATCH 6/7] docs: add archive libraries to File Manipulation intro Co-Authored-By: Claude --- website/data/category_intros/file-manipulation.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/website/data/category_intros/file-manipulation.md b/website/data/category_intros/file-manipulation.md index 510264cd..7474f1f1 100644 --- a/website/data/category_intros/file-manipulation.md +++ b/website/data/category_intros/file-manipulation.md @@ -14,6 +14,8 @@ How to choose: - Reading and writing .gz files: gzip - Denser compression than gzip at a similar speed: brotli - Compressing and decompressing as fast as possible: lz4 +- Tar and ZIP archives: tarfile and zipfile, or pyzipper for AES-encrypted ZIP files +- 7-Zip and RAR archives: py7zr, or rarfile to read .rar files If you aren't sure which pathlib class you need, the docs say [`Path` is most likely it](https://docs.python.org/3/library/pathlib.html): it makes a concrete path for the platform your code runs on. [Join paths with the `/` operator](https://docs.python.org/3/library/pathlib.html#basic-use), and list a directory with `iterdir()` or `glob()`. @@ -40,3 +42,13 @@ zstandard is [the most feature-rich zstd binding](https://python-zstandard.readt brotli is the Python module of the Brotli project, whose format is [similar in speed to deflate but denser](https://github.com/google/brotli#introduction). Call `brotli.compress()` and `brotli.decompress()` on bytes, or [feed a `brotli.Compressor` piece by piece](https://github.com/google/brotli/blob/master/python/brotli.py) with `process()`, then call `finish()`. lz4 binds the LZ4 library, built for [extremely fast compression and an extremely fast decoder](https://github.com/lz4/lz4). Its docs recommend [the `lz4.frame` bindings](https://python-lz4.readthedocs.io/en/stable/quickstart.html#simple-usage), since the frame format works with other LZ4 implementations and language bindings. `lz4.frame.open()` is [the most convenient way to work with compressed files](https://python-lz4.readthedocs.io/en/stable/quickstart.html#working-with-compressed-files), and it works like `gzip.open()`. + +tarfile reads and writes tar archives through [`tarfile.open()`](https://docs.python.org/3/library/tarfile.html#tarfile.open), and a mode like `'r:gz'` or `'w:zst'` picks the compression. To extract, use `extractall()` with the [`'data'` filter](https://docs.python.org/3/library/tarfile.html#extraction-filters), which is meant for cross-platform data archives. Still, never extract an archive from an untrusted source without inspecting it first. + +zipfile works through [`ZipFile` as a context manager](https://docs.python.org/3/library/zipfile.html#zipfile-objects): `ZipFile('spam.zip', 'w')` to write, then `write()` each file. Before you call `extractall()` on an archive you didn't make, [inspect it first](https://docs.python.org/3/library/zipfile.html#zipfile.ZipFile.extractall), since members with absolute paths or `..` can land outside the target folder. + +py7zr opens 7-Zip archives with [`SevenZipFile` in a `with` block](https://github.com/miurahr/py7zr#sevenzipfile-class-usage): call `extractall()` in `'r'` mode, or `writeall()` in `'w'` mode to pack a whole folder. + +pyzipper is [a replacement for `zipfile` that reads and writes AES-encrypted ZIP files](https://github.com/danifus/pyzipper#usage), with the same API. Open the archive with `pyzipper.AESZipFile`, pass `encryption=pyzipper.WZ_AES` when writing, and call `setpassword()` with a bytes password. + +rarfile reads RAR archives through [an interface in the style of `zipfile`](https://github.com/markokr/rarfile). It parses archives in pure Python, but extracts compressed files with an external tool, so install unrar, the one it recommends. From 2d6b59c53d4b69d2ddd67963d0233e25ae4bd69f Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 15 Nov 2026 00:52:58 +0800 Subject: [PATCH 7/7] docs: update archive rejects now that Archives exists The stream-zip and libarchive-c Rejected Additions lines said no archives use case exists; Archives now exists and is at cap, so the reasons say that instead. Co-Authored-By: Claude --- docs/audit-logs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/audit-logs.md b/docs/audit-logs.md index df29e68e..9525039c 100644 --- a/docs/audit-logs.md +++ b/docs/audit-logs.md @@ -111,8 +111,8 @@ Projects the maintainer decided not to list, with the evidence at decision time, - pycompression/python-zlib-ng -- 2026-11-15, 3,387,853 downloads/month (pypistats, package zlib-ng): A faster drop-in for zlib and gzip with a niche audience (16 stars). - pycompression/python-isal -- 2026-11-15, 2,960,582 downloads/month (pypistats, package isal): A faster drop-in for zlib and gzip using Intel ISA-L, with a niche audience (61 stars). - python-hyper/brotlicffi -- 2026-11-15, 1,946,691 downloads/month (pypistats): The PyPy version of the listed brotli. HTTP clients pick it automatically on non-CPython. -- uktrade/stream-zip -- 2026-11-15, 980,636 downloads/month (pypistats): Builds ZIP files as a stream. Niche (21 stars), and no archives use case exists. -- Changaco/python-libarchive-c -- 2026-11-15, 824,581 downloads/month (pypistats, package libarchive-c): A libarchive binding with low demand (85 stars) that needs the system library. No archives use case exists. +- uktrade/stream-zip -- 2026-11-15, 980,636 downloads/month (pypistats): Builds ZIP files as a stream. Niche (21 stars), and Archives is at cap. +- Changaco/python-libarchive-c -- 2026-11-15, 824,581 downloads/month (pypistats, package libarchive-c): A libarchive binding with low demand (85 stars) that needs the system library. Archives is at cap. ## Last Audited