From df518203bc842dbf898a2491bb02e4b138e2eca8 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 1/8] feat: add mlflow to Machine Learning Mints an Experiment Tracking use case, since General holds modeling libraries; mlflow is its obvious choice at 19,887,934 downloads/month. Co-Authored-By: Claude --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 816d3df6..d64b83c7 100644 --- a/README.md +++ b/README.md @@ -225,6 +225,8 @@ _Libraries for machine learning. Also see [awesome-machine-learning](https://git - Hyperparameter Optimization - [optuna](https://github.com/optuna/optuna) - A hyperparameter optimization framework with define-by-run search spaces and pruning of unpromising trials. - [hyperopt](https://github.com/hyperopt/hyperopt) - Distributed asynchronous hyperparameter optimization with Tree-structured Parzen Estimators. +- Experiment Tracking + - [mlflow](https://github.com/mlflow/mlflow) - An open-source platform for tracking experiments, managing models, and evaluating LLM apps. ### Natural Language Processing From f67c3c8c32a46e5c8766d75ac9de9c0b6be60989 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 2/8] feat: add smart-open to File Manipulation Mints a Remote Files use case for streaming files from cloud and remote storage; about 35.9M of smart-open's 57.5M downloads/month is its own after weasel and gensim. Co-Authored-By: Claude --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index d64b83c7..e61aac66 100644 --- a/README.md +++ b/README.md @@ -988,6 +988,8 @@ _Libraries for file manipulation._ - [mimetypes](https://docs.python.org/3/library/mimetypes.html) - (Python standard library) Map filenames to MIME types. - [python-magic](https://github.com/ahupp/python-magic) - A Python interface to the libmagic file type identification library. - [magika](https://github.com/google/magika) - Detects file content types with a deep-learning model. +- Remote Files + - [smart-open](https://github.com/piskvorky/smart_open) - Stream files from S3, GCS, Azure, HDFS, and HTTP as a drop-in replacement for open(). **Media** From da031029ed73fddcef56bf71c768eb69c6f81197 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 3/8] feat: add fsspec to File Manipulation The unified filesystem interface that torch, huggingface-hub, and datasets build on, placed first in Remote Files by downloads (556.9M/month, mostly pulled in by those libraries). Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index e61aac66..eb78b7a8 100644 --- a/README.md +++ b/README.md @@ -989,6 +989,7 @@ _Libraries for file manipulation._ - [python-magic](https://github.com/ahupp/python-magic) - A Python interface to the libmagic file type identification library. - [magika](https://github.com/google/magika) - Detects file content types with a deep-learning model. - Remote Files + - [fsspec](https://github.com/fsspec/filesystem_spec) - A unified filesystem interface for local, cloud, and remote storage. - [smart-open](https://github.com/piskvorky/smart_open) - Stream files from S3, GCS, Azure, HDFS, and HTTP as a drop-in replacement for open(). **Media** From 53d90ff375b9dadcb082128e7ce38e63801be0bc Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 4/8] feat: add pytest-benchmark to Testing Mints a Benchmarking use case, since microbenchmarking isn't profiling; 10,066,606 downloads/month. Co-Authored-By: Claude --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index eb78b7a8..9d399cd9 100644 --- a/README.md +++ b/README.md @@ -692,6 +692,8 @@ _Libraries for testing codebases and generating test data. Also see [awesome-pyt - [seleniumbase](https://github.com/seleniumbase/SeleniumBase) - Python framework for web automation & testing, with stealth options. - Load Testing - [locust](https://github.com/locustio/locust) - Scalable user load testing tool written in Python. +- Benchmarking + - [pytest-benchmark](https://github.com/ionelmc/pytest-benchmark) - A pytest fixture for benchmarking code. - API Testing - [schemathesis](https://github.com/schemathesis/schemathesis) - Automatic property-based testing of web APIs from OpenAPI or GraphQL schemas. - Mock From 8ce02b5f6d48a60cae54741a00e03957136acea0 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 5/8] feat: add aiortc to WebSocket Splits the flat section into General and WebRTC, since a subcategory can't repeat the section name; aiortc is the WebRTC/ORTC stack for asyncio at 1,647,618 downloads/month, nearly all direct. Co-Authored-By: Claude --- README.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 9d399cd9..40ae62b6 100644 --- a/README.md +++ b/README.md @@ -321,10 +321,13 @@ _ASGI and WSGI compatible web servers._ _Libraries for working with WebSocket._ -- [websockets](https://github.com/python-websockets/websockets) - A library for building WebSocket servers and clients with a focus on correctness and simplicity. -- [channels](https://github.com/django/channels) - Brings WebSocket, long-poll HTTP, and other async support to Django. -- [flask-socketio](https://github.com/miguelgrinberg/Flask-SocketIO) - Socket.IO integration for Flask applications. -- [autobahn-python](https://github.com/crossbario/autobahn-python) - WebSocket & WAMP for Python on Twisted and [asyncio](https://docs.python.org/3/library/asyncio.html). +- General + - [websockets](https://github.com/python-websockets/websockets) - A library for building WebSocket servers and clients with a focus on correctness and simplicity. + - [channels](https://github.com/django/channels) - Brings WebSocket, long-poll HTTP, and other async support to Django. + - [flask-socketio](https://github.com/miguelgrinberg/Flask-SocketIO) - Socket.IO integration for Flask applications. + - [autobahn-python](https://github.com/crossbario/autobahn-python) - WebSocket & WAMP for Python on Twisted and [asyncio](https://docs.python.org/3/library/asyncio.html). +- WebRTC + - [aiortc](https://github.com/aiortc/aiortc) - A WebRTC and ORTC implementation for asyncio, with audio, video, and data channels. ### Template Engines From caf471e4ec5daacfdcf6265f841f8fec31a4bec3 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 6/8] feat: add pydantic-monty to AI and Agents Mints a Code Sandboxes use case for running AI-written code locally; 4,353,276 downloads/month, 1.0.0 and Production/Stable. Hosted-sandbox clients stay out as vendor clients. Co-Authored-By: Claude --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 40ae62b6..1c6eff95 100644 --- a/README.md +++ b/README.md @@ -155,6 +155,8 @@ _Libraries for building AI applications, LLM integrations, and autonomous agents - Model Context Protocol - [mcp](https://github.com/modelcontextprotocol/python-sdk) - The official Python SDK for building Model Context Protocol servers and clients. - [fastmcp](https://github.com/PrefectHQ/fastmcp) - A high-level, Pythonic framework for building MCP servers and clients. +- Code Sandboxes + - [pydantic-monty](https://github.com/pydantic/monty) - A secure Python sandbox written in Rust for running AI-written code. - Personal Assistants - [hermes-agent](https://github.com/NousResearch/hermes-agent) - An adaptive personal AI assistant that grows with you. - [AstrBot](https://github.com/AstrBotDevs/AstrBot) - A multi-platform AI assistant that connects LLMs to chat apps like Telegram, Slack, and QQ, extensible with Python plugins. From 35b1f75f71caa61b9080a3f5d1350339f0da2d24 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 7/8] feat: add flask-cors to Web Security CORS for Flask at 39,864,140 downloads/month, twice django-cors-headers; placed first by downloads, which moves secure to challenger. Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 1c6eff95..2d0da017 100644 --- a/README.md +++ b/README.md @@ -1202,6 +1202,7 @@ _Tools for auditing dependencies against known vulnerabilities and scanning for _Libraries for application-layer web security._ +- [flask-cors](https://github.com/corydolphin/flask-cors) - A Flask extension for handling Cross-Origin Resource Sharing (CORS). - [nh3](https://github.com/messense/nh3) - Python binding to the ammonia HTML sanitizer, a fast replacement for bleach. - [django-cors-headers](https://github.com/adamchainz/django-cors-headers) - Handles Cross-Origin Resource Sharing (CORS) headers for Django apps. - [secure](https://github.com/TypeError/secure) - HTTP security headers for Python web applications with ASGI and WSGI middleware. From 79317a98b42a804ccbdd2c71e93615341028d83a Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:58:42 +0800 Subject: [PATCH 8/8] docs: record rejections from the parked star review Logs 19 starred projects declined on 2026-11-08 under Rejected Additions, so later scans skip them. Co-Authored-By: Claude --- docs/audit-logs.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/audit-logs.md b/docs/audit-logs.md index 4218dabf..d467aedc 100644 --- a/docs/audit-logs.md +++ b/docs/audit-logs.md @@ -188,6 +188,25 @@ Projects the maintainer decided not to list, with the evidence at decision time, - planetscale/database-skills -- 2026-11-08, no PyPI download signal: Four database-vendor skills for any language. Not Python work. - revsys/django-friendship -- 2026-11-08, 2,797 downloads/month (pypistats): Negligible demand, and no use case. - yutiansut/QUANTAXIS -- 2026-11-08, 1,396 downloads/month (pypistats, package quantaxis): Fails Stable: last PyPI upload 2.0.0.dev33 in 2021-12. A trading and backtesting platform, not a financial-data library. +- anomalyco/opencode -- 2026-11-08, no PyPI download signal: A language-agnostic terminal coding agent. Not Python work. +- disqus/django-bitfield -- 2026-11-08, 308,195 downloads/month (pypistats): Declined: no Django model add-ons use case, since these single-purpose tools don't compete. +- django-cms/django-filer -- 2026-11-08, 98,545 downloads/month (pypistats): A django-cms companion app with no use case. +- django-extensions/django-extensions -- 2026-11-08, 12,769,974 downloads/month (pypistats): A grab-bag of Django management commands, not a debugging tool. Its latest release (4.1, 2025-04) declares Django only through 5.2. +- django-mptt/django-mptt -- 2026-11-08, 1,061,690 downloads/month (pypistats): Its own README says it is unmaintained and points new projects to django-tree-queries. +- django-treebeard/django-treebeard -- 2026-11-08, 1,130,171 downloads/month (pypistats): Django trees have no clear leader: about 450K of its count is its own after wagtail and django-cms, django-mptt is unmaintained, and django-tree-queries has 173K. +- google-gemini/gemini-cli -- 2026-11-08, no PyPI download signal: A language-agnostic terminal coding agent written in TypeScript. Not Python work. +- jazzband/django-embed-video -- 2026-11-08, 27,356 downloads/month (pypistats): A small single-purpose app with no use case; last release 2024-05. +- jazzband/django-model-utils -- 2026-11-08, 4,634,168 downloads/month (pypistats): Declined: no Django model add-ons use case, since these single-purpose tools don't compete. Last release 2024-09. +- jazzband/django-push-notifications -- 2026-11-08, 237,516 downloads/month (pypistats): Push notifications have no use case (see xtrinch/fcm-django). Its classifiers stop at Django 4.0. +- jieter/django-tables2 -- 2026-11-08, 810,345 downloads/month (pypistats): A Django HTML-tables use case would hold one leader and no challengers, like the declined Dependency Injection use case. +- llazzaro/django-scheduler -- 2026-11-08, 19,627 downloads/month (pypistats): A small single-purpose calendar app with no use case. +- m-bain/whisperX -- 2026-11-08, 342,919 downloads/month (pypistats, package whisperx): A wrapper over faster-whisper for word timestamps and diarization, not a successor to any Speech entry. Its monthly downloads dipped instead of rising, and its release line pins torch~=2.8.0 with requires_python <3.14. +- makinacorpus/django-safedelete -- 2026-11-08, 1,906,926 downloads/month (pypistats): Declined: no Django model add-ons use case, since these single-purpose tools don't compete. Beta classifier. +- olucurious/PyFCM -- 2026-11-08, 199,324 downloads/month (pypistats, package pyfcm): A thin client for Google's FCM API; firebase-admin is the obvious choice, and vendor clients were declined (2d98426). +- openai/codex -- 2026-11-08, no PyPI download signal: A language-agnostic terminal coding agent written in Rust. Not Python work. +- openai/openai-python -- 2026-11-08, 295,856,631 downloads/month (pypistats, package openai): A vendor API client, declined with Third-party APIs (2d98426); OpenAI is already listed through openai-agents. Much of its count is pulled in by other libraries. +- saxix/django-concurrency -- 2026-11-08, 147,466 downloads/month (pypistats): Declined: no Django model add-ons use case, since these single-purpose tools don't compete. +- xtrinch/fcm-django -- 2026-11-08, 304,945 downloads/month (pypistats): Push notifications have no use case: Google's firebase-admin (14.86M) is the obvious choice, and vendor SDKs were declined with Third-party APIs (2d98426). ## Last Audited