Anaconda Desktop public beta unifies conda environments and local LLM inference

Anaconda has launched Anaconda Desktop in public beta, a unified application for AI development that consolidates model discovery, local LLM inference, and conda environment management into a single tool. It replaces the older Anaconda Navigator while retaining all its features — conda environments, package management, Jupyter Notebooks — and adds local AI capabilities alongside them. Planned features include deploying multiple inference endpoints and expanding Anaconda MCP to give AI agents governed access to the conda ecosystem. Navigator will remain supported through end of 2026. Available on Windows, Mac, and Linux.

Python Environments extension for VS Code April update fixes 30-second hangs on large projects

The April 2026 update to the Python Environments extension for VS Code brings notable startup performance improvements, including lazy manager discovery for Pipenv, pyenv, and Poetry, faster environment resolution, and a narrower default workspace scan pattern that fixes 30+ second hangs on large or remote projects. Reliability improvements include PET crash recovery and a conda base environment restoration bug fix. New quality-of-life features include auto-refreshing package lists after pip installs, multi-project terminal environment selection prompts, and automatic PowerShell execution policy handling for virtual environment activation on Windows.

pip 26.1 ships pylock.toml support and drops Python 3.9

pip 26.1 has been released with several notable changes: dependency cooldowns, experimental support for pylock.toml files, and resolver improvements that bring pip closer to removing its legacy resolver. The release also includes security fixes and drops support for Python 3.9.

httpxyz fork of httpx ships async lock fix with 3.3x GET latency improvement

One month after forking the httpx Python HTTP client library, the httpxyz project has shipped significant bug fixes and performance improvements. Key highlights include forking the underlying httpcore transport layer into httpcorexyz, fixing async lock contention issues that reduce GET latency by ~3.3x, resolving HTTP/2 deadlocks, race conditions, proxy connection leaks, and SOCKS5 timeout hangs. A compatibility shim allows httpxyz to work alongside third-party packages that still import httpx. Lazy CLI imports cut import time roughly in half. The author now actively recommends switching from httpx to httpxyz given the accumulated improvements.

elementary-data PyPI package compromised via GitHub Actions script injection

A malicious version of the elementary-data Python package (0.23.3) was published to PyPI on April 24, 2026, via a GitHub Actions script injection attack. The attacker exploited a vulnerability in the project's own CI workflow, used the GITHUB_TOKEN to forge a signed release commit, and triggered the legitimate publishing pipeline — without touching the main branch. The compromised release includes a .pth file that executes a three-stage credential-stealing payload on every Python invocation. The same workflow also pushed a trojaned multi-arch Docker image to GHCR tagged as both 0.23.3 and latest. The payload harvests SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes configs, .env files, crypto wallet keys, and more, exfiltrating everything to an attacker-controlled endpoint.

CocoIndex V1 drops custom DSL for plain async Python and removes Postgres dependency

Honker brings Postgres NOTIFY/LISTEN semantics and durable queues to SQLite

honker is a SQLite extension with multi-language bindings that brings Postgres-style NOTIFY/LISTEN semantics to SQLite. It adds durable pub/sub, task queues with retries and scheduling, and event streams — all without a separate broker or polling. It works by watching SQLite's WAL file for changes, achieving cross-process notification with ~1ms latency. Jobs and events are inserted within the same transaction as business writes, enabling an outbox pattern by default. Bindings are available for Python, Node.js, Rust, Go, Ruby, Bun, Elixir, and C++. The project is experimental and targets apps where SQLite is the primary datastore, eliminating the need for Redis or Celery.

Ubuntu 26.04 LTS ships with updated Python toolchains and new Devpacks concept

nvmath-python 0.9.0 introduces Universal sparse tensor abstraction for deep learning

nvmath-python v0.9.0 introduces the Universal sparse tensor (UST), a flexible abstraction that decouples tensor sparsity from memory layout. Key features include zero-cost interoperability with PyTorch, SciPy, and CuPy; a DSL for defining custom sparse formats; polymorphic operations that auto-dispatch to optimized kernels or generate sparse code; and a PyTorch injection mechanism that lets researchers accelerate existing models without rewriting code. Performance benchmarks show speedups of 1.1x to 444x over CuPy and PyTorch for SpMV operations, with additional gains from transparent caching of planning phases.

Three malicious xinference PyPI versions steal AI server credentials in supply chain attack

Three malicious versions of the xinference PyPI package (2.6.0, 2.6.1, 2.6.2) were identified on April 22, 2026, as part of the ongoing TeamPCP supply chain attack series. The poisoned packages target AI inference infrastructure by executing a credential-harvesting payload on import. Unlike prior TeamPCP attacks, this wave lacks persistence mechanisms and data encryption — stolen credentials are gzipped and exfiltrated in plaintext to a new C2 domain. The harvester sweeps SSH keys, cloud credentials (AWS/GCP/Azure/K8s), Docker configs, database passwords, shell histories, and an unusually broad set of cryptocurrency wallet files. Any environment that imported the affected versions should immediately rotate all credentials.