mirror of
https://github.com/vinta/awesome-python.git
synced 2026-11-10 01:34:28 -06:00
Merge branch 'audit/star-scan-2026-11-08'
This commit is contained in:
Vinta Chen
@@ -722,6 +722,7 @@ _Libraries for debugging code._
|
||||
- [pyinstrument](https://github.com/joerick/pyinstrument) - A statistical wall-clock profiler with low overhead and readable call-tree output.
|
||||
- [scalene](https://github.com/plasma-umass/scalene) - A high-performance, high-precision CPU, GPU, and memory profiler for Python.
|
||||
- Others
|
||||
- [debugpy](https://github.com/microsoft/debugpy) - A Debug Adapter Protocol debugger for Python, used by VS Code for remote debugging.
|
||||
- [django-debug-toolbar](https://github.com/django-commons/django-debug-toolbar) - Display various debug information for Django.
|
||||
- [django-silk](https://github.com/jazzband/django-silk) - Live profiling and inspection of HTTP requests and database queries for Django.
|
||||
- [icecream](https://github.com/gruns/icecream) - Inspect variables, expressions, and program execution with a single, simple function call.
|
||||
@@ -1190,6 +1191,7 @@ _Tools for auditing dependencies against known vulnerabilities and scanning for
|
||||
_Libraries for application-layer web security._
|
||||
|
||||
- [nh3](https://github.com/messense/nh3) - Python binding to the ammonia HTML sanitizer, a fast replacement for bleach.
|
||||
- [django-cors-headers](https://github.com/adamchainz/django-cors-headers) - Handles Cross-Origin Resource Sharing (CORS) headers for Django apps.
|
||||
- [secure](https://github.com/TypeError/secure) - HTTP security headers for Python web applications with ASGI and WSGI middleware.
|
||||
|
||||
**Other**
|
||||
|
||||
@@ -160,6 +160,33 @@ Projects the maintainer decided not to list, with the evidence at decision time,
|
||||
- Yelp/detect-secrets -- 2026-10-16, 9,698,855 downloads/month (ClickPy): Weak maintenance: last release 2024-05, last code commit 2025-01, and only a CI commit in 2026. Demand rose 6.6x with no explained cause.
|
||||
- youssofal/MTPLX -- 2026-10-16, 7,276 downloads/month (ClickPy): Narrow: its own summary is "Native MTP speculative decoding for Qwen3-Next on Apple Silicon". Repo created 2026-05-02, and it hard-requires mlx-lm, which is already listed, so it is an add-on rather than a separate pick.
|
||||
- ytdl-org/youtube-dl -- 2026-10-16, 164,180 downloads/month (ClickPy): The 2026-03-21 removal (f50bd8f, replaced by yt-dlp) still holds: no release since 2021.12.17, commits stopped 2025-11, and downloads are falling.
|
||||
- adamchainz/django-mysql -- 2026-11-08, 598,170 downloads/month (pypistats): MySQL-specific features for the Django ORM: neither an ORM nor a driver.
|
||||
- cactus-compute/cactus -- 2026-11-08, 1,012 downloads/month (pypistats, package cactus-compute): Far below the smallest Local LLM Inference entry (llama-cpp-python, 519,085), and its 4.x line centres on Cactus's own small models rather than running open-weight LLMs.
|
||||
- carltongibson/django-filter -- 2026-11-08, 13,792,807 downloads/month (pypistats): A queryset-filtering add-on for DRF or Django views, not an API framework, as with drf-extensions.
|
||||
- charles-001/dolphie -- 2026-11-08, 2,341 downloads/month (pypistats): A top-style MySQL monitor, not a query shell like the Database CLIs entries, at a fifth of the smallest one's demand (iredis, 11,965).
|
||||
- cloudflare/security-audit-skill -- 2026-11-08, no PyPI download signal: A language-agnostic security-audit skill, and trailofbits-skills already covers security. Not Python work.
|
||||
- DietrichGebert/ponytail -- 2026-11-08, no PyPI download signal: A language-agnostic anti-over-engineering prompt pack. Not Python work.
|
||||
- django-hijack/django-hijack -- 2026-11-08, 2,698,297 downloads/month (pypistats): User impersonation, not an admin panel, and no Authentication use case covers it.
|
||||
- django-import-export/django-import-export -- 2026-11-08, 2,316,201 downloads/month (pypistats): An import/export add-on with admin integration, not an admin panel; tablib, which it wraps, is already listed.
|
||||
- firecrawl/anydoc -- 2026-11-08, 6,181,793 downloads/month (pypistats, package firecrawl-anydoc): Its downloads look automated: 80.7% come from Python 3.14, against about 7% for markitdown and docling. Version 0.2.x with no release since 2026-08-27. Re-check at 1.0.
|
||||
- garrytan/gstack -- 2026-11-08, no PyPI download signal: Product and role skills (CEO, design, QA, deploy). Not Python work.
|
||||
- ghostsecurity/skills -- 2026-11-08, no PyPI download signal: Language-agnostic AppSec skills with 439 stars. Not Python work.
|
||||
- goauthentik/authentik -- 2026-11-08, no PyPI download signal: A self-hosted identity provider deployed with Docker or Helm, not a library; Python apps integrate through OIDC libraries like the listed authlib.
|
||||
- google/skills -- 2026-11-08, no PyPI download signal: A Google product skill pack: 171 of its 192 skills are for Cloud, and one is for Python.
|
||||
- hankcs/HanLP -- 2026-11-08, 9,596 downloads/month (pypistats, package hanlp): 0.2% of jieba's demand (4,787,084); its 36.5k stars don't show up as installs.
|
||||
- jazzband/django-categories -- 2026-11-08, 2,890 downloads/month (pypistats): Fails Active: last default-branch commit 2024-05-23. It depends on django-mptt, which declares itself unmaintained.
|
||||
- JohnSnowLabs/spark-nlp -- 2026-11-08, 691,866 downloads/month (pypistats): Below the smallest NLP General entry (stanza, 765,627), and a Spark-only niche.
|
||||
- lightseekorg/tokenspeed -- 2026-11-08, 136 downloads/month (pypistats): Fails Stable: version 0.1.1, with production hardening still planned in its launch post. Re-check at 1.0.
|
||||
- mattpocock/skills -- 2026-11-08, no PyPI download signal: General engineering skills whose only language-specific ones are for TypeScript. Not Python work.
|
||||
- microsoft/SynapseML -- 2026-11-08, 1,161,151 downloads/month (pypistats, package synapseml): Spark-only and Beta, with a count of unexplained origin; Distributed Computing, its natural home, is at cap with pyspark.
|
||||
- MikeChongCan/scylla -- 2026-11-08, 121 downloads/month (pypistats): Last PyPI release 2019-08, pinning requests 2.22.0 and Python 3.6. A proxy pool, not a scraping framework.
|
||||
- obra/superpowers -- 2026-11-08, no PyPI download signal: A language-agnostic engineering methodology pack with no Python content. Not Python work.
|
||||
- ollaya-dev/ollaya -- 2026-11-08, no PyPI download signal: A Rust server for decision models that never generates text, so not LLM inference, and it has no Python surface.
|
||||
- openclaw/openclaw -- 2026-11-08, no PyPI download signal: A TypeScript/Node assistant with TypeScript plugins. Not Python work.
|
||||
- paradigmxyz/flood -- 2026-11-08, 13 downloads/month (pypistats, package paradigm-flood): Fails Active: last commit on main 2023-08-30. It benchmarks Ethereum nodes only.
|
||||
- planetscale/database-skills -- 2026-11-08, no PyPI download signal: Four database-vendor skills for any language. Not Python work.
|
||||
- revsys/django-friendship -- 2026-11-08, 2,797 downloads/month (pypistats): Negligible demand, and no use case.
|
||||
- yutiansut/QUANTAXIS -- 2026-11-08, 1,396 downloads/month (pypistats, package quantaxis): Fails Stable: last PyPI upload 2.0.0.dev33 in 2021-12. A trading and backtesting platform, not a financial-data library.
|
||||
|
||||
## Last Audited
|
||||
|
||||
|
||||
Reference in New Issue
Block a user