From 65d217b0ea684e00ffdadc2fb9c1d357b1065300 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:25:19 +0800 Subject: [PATCH 1/3] feat: add debugpy to Debugging Tools 78,662,693 downloads/month on pypistats (fetched 2026-11-08), about 24.0M of it its own after subtracting ipykernel, which requires it; VS Code's Python debugging docs tell users to pip install it for remote and attach debugging. Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7a37c4b9..35dd425b 100644 --- a/README.md +++ b/README.md @@ -722,6 +722,7 @@ _Libraries for debugging code._ - [pyinstrument](https://github.com/joerick/pyinstrument) - A statistical wall-clock profiler with low overhead and readable call-tree output. - [scalene](https://github.com/plasma-umass/scalene) - A high-performance, high-precision CPU, GPU, and memory profiler for Python. - Others + - [debugpy](https://github.com/microsoft/debugpy) - A Debug Adapter Protocol debugger for Python, used by VS Code for remote debugging. - [django-debug-toolbar](https://github.com/django-commons/django-debug-toolbar) - Display various debug information for Django. - [django-silk](https://github.com/jazzband/django-silk) - Live profiling and inspection of HTTP requests and database queries for Django. - [icecream](https://github.com/gruns/icecream) - Inspect variables, expressions, and program execution with a single, simple function call. From 5e563d62a05562e639ef43b2ef3e5c39b703c4a5 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:25:59 +0800 Subject: [PATCH 2/3] feat: add django-cors-headers to Web Security 18,834,120 downloads/month on pypistats (fetched 2026-11-08), 9x secure; Django REST framework's docs name it as the way to handle CORS. Co-Authored-By: Claude --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 35dd425b..03c32588 100644 --- a/README.md +++ b/README.md @@ -1191,6 +1191,7 @@ _Tools for auditing dependencies against known vulnerabilities and scanning for _Libraries for application-layer web security._ - [nh3](https://github.com/messense/nh3) - Python binding to the ammonia HTML sanitizer, a fast replacement for bleach. +- [django-cors-headers](https://github.com/adamchainz/django-cors-headers) - Handles Cross-Origin Resource Sharing (CORS) headers for Django apps. - [secure](https://github.com/TypeError/secure) - HTTP security headers for Python web applications with ASGI and WSGI middleware. **Other** From 4f64cf0717026d8199620821c1373cc3c819bebf Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 8 Nov 2026 21:25:59 +0800 Subject: [PATCH 3/3] docs: record star scan rejections Logs 27 starred projects judged and declined on 2026-11-08 under Rejected Additions, so later scans skip them. Co-Authored-By: Claude --- docs/audit-logs.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/audit-logs.md b/docs/audit-logs.md index 15a1152d..44616dda 100644 --- a/docs/audit-logs.md +++ b/docs/audit-logs.md @@ -160,6 +160,33 @@ Projects the maintainer decided not to list, with the evidence at decision time, - Yelp/detect-secrets -- 2026-10-16, 9,698,855 downloads/month (ClickPy): Weak maintenance: last release 2024-05, last code commit 2025-01, and only a CI commit in 2026. Demand rose 6.6x with no explained cause. - youssofal/MTPLX -- 2026-10-16, 7,276 downloads/month (ClickPy): Narrow: its own summary is "Native MTP speculative decoding for Qwen3-Next on Apple Silicon". Repo created 2026-05-02, and it hard-requires mlx-lm, which is already listed, so it is an add-on rather than a separate pick. - ytdl-org/youtube-dl -- 2026-10-16, 164,180 downloads/month (ClickPy): The 2026-03-21 removal (f50bd8f, replaced by yt-dlp) still holds: no release since 2021.12.17, commits stopped 2025-11, and downloads are falling. +- adamchainz/django-mysql -- 2026-11-08, 598,170 downloads/month (pypistats): MySQL-specific features for the Django ORM: neither an ORM nor a driver. +- cactus-compute/cactus -- 2026-11-08, 1,012 downloads/month (pypistats, package cactus-compute): Far below the smallest Local LLM Inference entry (llama-cpp-python, 519,085), and its 4.x line centres on Cactus's own small models rather than running open-weight LLMs. +- carltongibson/django-filter -- 2026-11-08, 13,792,807 downloads/month (pypistats): A queryset-filtering add-on for DRF or Django views, not an API framework, as with drf-extensions. +- charles-001/dolphie -- 2026-11-08, 2,341 downloads/month (pypistats): A top-style MySQL monitor, not a query shell like the Database CLIs entries, at a fifth of the smallest one's demand (iredis, 11,965). +- cloudflare/security-audit-skill -- 2026-11-08, no PyPI download signal: A language-agnostic security-audit skill, and trailofbits-skills already covers security. Not Python work. +- DietrichGebert/ponytail -- 2026-11-08, no PyPI download signal: A language-agnostic anti-over-engineering prompt pack. Not Python work. +- django-hijack/django-hijack -- 2026-11-08, 2,698,297 downloads/month (pypistats): User impersonation, not an admin panel, and no Authentication use case covers it. +- django-import-export/django-import-export -- 2026-11-08, 2,316,201 downloads/month (pypistats): An import/export add-on with admin integration, not an admin panel; tablib, which it wraps, is already listed. +- firecrawl/anydoc -- 2026-11-08, 6,181,793 downloads/month (pypistats, package firecrawl-anydoc): Its downloads look automated: 80.7% come from Python 3.14, against about 7% for markitdown and docling. Version 0.2.x with no release since 2026-08-27. Re-check at 1.0. +- garrytan/gstack -- 2026-11-08, no PyPI download signal: Product and role skills (CEO, design, QA, deploy). Not Python work. +- ghostsecurity/skills -- 2026-11-08, no PyPI download signal: Language-agnostic AppSec skills with 439 stars. Not Python work. +- goauthentik/authentik -- 2026-11-08, no PyPI download signal: A self-hosted identity provider deployed with Docker or Helm, not a library; Python apps integrate through OIDC libraries like the listed authlib. +- google/skills -- 2026-11-08, no PyPI download signal: A Google product skill pack: 171 of its 192 skills are for Cloud, and one is for Python. +- hankcs/HanLP -- 2026-11-08, 9,596 downloads/month (pypistats, package hanlp): 0.2% of jieba's demand (4,787,084); its 36.5k stars don't show up as installs. +- jazzband/django-categories -- 2026-11-08, 2,890 downloads/month (pypistats): Fails Active: last default-branch commit 2024-05-23. It depends on django-mptt, which declares itself unmaintained. +- JohnSnowLabs/spark-nlp -- 2026-11-08, 691,866 downloads/month (pypistats): Below the smallest NLP General entry (stanza, 765,627), and a Spark-only niche. +- lightseekorg/tokenspeed -- 2026-11-08, 136 downloads/month (pypistats): Fails Stable: version 0.1.1, with production hardening still planned in its launch post. Re-check at 1.0. +- mattpocock/skills -- 2026-11-08, no PyPI download signal: General engineering skills whose only language-specific ones are for TypeScript. Not Python work. +- microsoft/SynapseML -- 2026-11-08, 1,161,151 downloads/month (pypistats, package synapseml): Spark-only and Beta, with a count of unexplained origin; Distributed Computing, its natural home, is at cap with pyspark. +- MikeChongCan/scylla -- 2026-11-08, 121 downloads/month (pypistats): Last PyPI release 2019-08, pinning requests 2.22.0 and Python 3.6. A proxy pool, not a scraping framework. +- obra/superpowers -- 2026-11-08, no PyPI download signal: A language-agnostic engineering methodology pack with no Python content. Not Python work. +- ollaya-dev/ollaya -- 2026-11-08, no PyPI download signal: A Rust server for decision models that never generates text, so not LLM inference, and it has no Python surface. +- openclaw/openclaw -- 2026-11-08, no PyPI download signal: A TypeScript/Node assistant with TypeScript plugins. Not Python work. +- paradigmxyz/flood -- 2026-11-08, 13 downloads/month (pypistats, package paradigm-flood): Fails Active: last commit on main 2023-08-30. It benchmarks Ethereum nodes only. +- planetscale/database-skills -- 2026-11-08, no PyPI download signal: Four database-vendor skills for any language. Not Python work. +- revsys/django-friendship -- 2026-11-08, 2,797 downloads/month (pypistats): Negligible demand, and no use case. +- yutiansut/QUANTAXIS -- 2026-11-08, 1,396 downloads/month (pypistats, package quantaxis): Fails Stable: last PyPI upload 2.0.0.dev33 in 2021-12. A trading and backtesting platform, not a financial-data library. ## Last Audited