The uv-audit bug has no automatic guard outside the bundled-entry
case, so the hazard has to live in the audit process instead. The
sweep only queries names matching PYPI_NAME_RE, so a display name
with a space is skipped outright; renaming it into a PyPI-shaped name
starts it being queried, which is how 'uv audit' became 'uv-audit'
and picked up an unrelated third-party package by rocshers.
The gotcha tells the auditor to fetch PyPI metadata for any renamed
entry and add a null override when the package isn't the linked
project. It also records two broader checks that were measured
against the full list and rejected, so a future audit doesn't spend
time re-proposing them: the repo-backlink check misses this case
entirely since uv-audit declares no repo URL, as do 26 legitimate
entries, and it flags 10 benign org moves; the name-versus-repo-name
check returns 46 hits that are all legitimate, including uv-build
with the shape identical to uv-audit.
Co-Authored-By: Claude <noreply@anthropic.com>
The uv-audit bug had no automated guard: pypi_name_overrides.json is
a manual registry, so a wrong-package mapping is only caught if
someone already suspects it.
Two broader checks were measured against the real list and rejected.
Checking that PyPI metadata links back to the entry's GitHub repo
would not have caught uv-audit, since that package declares no
home_page or project_urls, landing it in a 26-entry bucket of
packages that simply don't declare a repo (numba, selenium, pyglet,
etc.), plus 10 benign cases of orgs moving or splitting bindings.
Flagging display-name/repo-name mismatches yields 46 hits, all
legitimate python-X-repo-to-X-package pairs, with uv-build sitting
among them despite being a real Astral package with the identical
shape to uv-audit.
What discriminates is the bundled marker itself: a "(part of X)"
entry ships inside something else and has no package of its own, so
the sweep must never query it. This test walks the real README and
requires a null override for every bundled entry whose normalized
name is PyPI-shaped. Verified it fails with exactly the uv-audit
message when that override is removed, and passes with it restored,
across the three current bundled entries with no false positives. It
runs offline, fitting the existing network-less CI.
Co-Authored-By: Claude <noreply@anthropic.com>
Renaming the entry from "uv audit" to "uv-audit" made the name PyPI-shaped: normalize() leaves spaces alone, so "uv audit" failed PYPI_NAME_RE and collect_names skipped it, but "uv-audit" passes, so the next sweep would have queried PyPI for it.
A uv-audit package does exist on PyPI, but it is version 0.1.9 by Alekse Marusich of rocshers, an unrelated third-party tool whose summary ("uv Tool for checking dependencies for vulnerabilities") is close enough to be mistaken for Astral's built-in uv audit subcommand. Without the override the entry would have shown that stranger's download count and lost its Bundled badge.
The sweep now writes uv-audit as NOT_FOUND, which load_downloads skips, so the badge is unaffected.
Co-Authored-By: Claude <noreply@anthropic.com>
Keep the docs link inline in the description instead of as the primary entry link, matching the format used by other entries.
Co-Authored-By: Claude <noreply@anthropic.com>
azure-sdk-for-python and google-cloud-python were rendering "Not on
PyPI", which is misleading. Both do ship on PyPI, just as many
per-service packages (azure-identity, azure-storage-blob,
google-cloud-storage, etc.) rather than under the repo name.
pypi_name_overrides.json already recorded that distinction in its
reason field; those two entries now carry an optional "badge" value
that build.py reads into the PyPI Downloads column. The other sixteen
no-count entries (cpython, renpy, agent skill repos, etc.) keep
"Not on PyPI" since that remains accurate for them.
Co-Authored-By: Claude <noreply@anthropic.com>
django.db.models, geodjango, httpx.URL and uv audit were rendering
"Not on PyPI" alongside eighteen genuinely standalone projects that
simply are not packaged on PyPI, conflating two different reasons for
a missing download count.
These four entries now carry a "(part of X)" description prefix in
README.md, mirroring the existing "(Python standard library)"
convention. build.py reads that prefix into a bundled flag that both
templates render as a "Bundled" badge.
The prefix approach was chosen over a separate data file so README.md
stays the single source of content truth, and over inferring from the
entry name because geodjango is neither dotted nor spaced and would
have been missed. Redundant tail wording was trimmed from the
httpx.URL, geodjango and uv audit descriptions now that the prefix
names the parent.
The new entry format is documented in CONTRIBUTING.md and the
vocabulary in CONTEXT.md.
Co-Authored-By: Claude <noreply@anthropic.com>
Standard-library entries rendered "Not on PyPI" in the PyPI Downloads
column, which read like missing data rather than a deliberate category
— the build already forces downloads to None for them so they never
pick up a same-named PyPI backport. They now render a "Stdlib" badge
instead, while genuine non-PyPI entries keep "Not on PyPI".
The filter tag is renamed to match, so the source-type value, the row
filter tag, and the synthetic category heading all read Stdlib now.
The literal "Built-in" strings scattered through build.py are routed
through the existing BUILTIN_FILTER constant so the label lives in one
place. The category page slug stays "built-in" so the public URL
/categories/built-in/ does not break.
Co-Authored-By: Claude <noreply@anthropic.com>
Add a Stability Exceptions section to docs/audit-logs.md documenting
the zensical override (admitted pre-1.0 to displace a dying mkdocs
upstream). Add a matching evidence bullet to CLAUDE.md and AGENTS.md
warning that a download count is not automatically independent demand
when one listed entry depends on another, using mkdocs / mkdocs-material
as the worked example. Both facts were discovered during this sitting
and need to persist so the next audit doesn't rediscover them.
Co-Authored-By: Claude <noreply@anthropic.com>
Material for MkDocs went into maintenance mode on 2025-11-05 and its
own team called upstream mkdocs unmaintained since 2024-08 and a
supply chain risk; the mkdocs repo was last pushed 2025-10-20. Since
mkdocs-material hard-depends on mkdocs, mkdocs' download count is
almost entirely mkdocs-material pulling it in (18,360,677/month vs
mkdocs-material's 18,167,775/month, ~1% delta), so dropping the
redundant direct entry costs little. zensical is a clean replacement
with no mkdocs dependency, built by the same Material for MkDocs
team, at 1,585,786 downloads/month and 5,540 stars, pushed
2026-08-21. Added as a challenger, placed last below pdoc, keeping
the section at 5 of 5. Approved via verdict preview.
Co-Authored-By: Claude <noreply@anthropic.com>
Obvious choice for physical units and dimensional analysis in Python: 8,647,557 downloads/month (pepy.tech, 2026-08-23), more than twice astropy (3,713,879) and thirty-six times obspy (237,352), 2,781 stars, created 2012, pushed 2026-08-05. PyPI classifier still reads Beta at v0.25.3, treated as stale given fourteen years of history and download scale (judgment call). Listed under Physics and Engineering per maintainer choice over minting a Units and Quantities subcategory.
Co-Authored-By: Claude <noreply@anthropic.com>
Audit of proposed additions from a YouTube video roundup. Admitted as
a challenger: 761,507 downloads/month (pepy.tech, 2026-08-23) already
outranks the incumbent prospector (497,880), the repo is active
(pushed 2026-08-21, version 7.0.1, Production/Stable) and it has
reached 794 stars since being created in January 2024. It fills a
real gap: ruff's PLR0912 measures cyclomatic complexity while
complexipy measures cognitive complexity, and the two are
complementary. Adoption-trajectory evidence is thin, so the
challenger tier is a judgment call. Placed last in the subcategory
since position marks tier and challengers follow obvious choices.
Co-Authored-By: Claude <noreply@anthropic.com>
Audit of proposed additions from a YouTube video roundup. transitions
has not been pushed since 2025-09-11 and crosses the 12-month activity
line on 2026-09-11, while python-statemachine is actively developed
(pushed 2026-08-17, version 3.2.1 released 2026-08-01) and covers
strictly more (SCXML-compliant statecharts, compound and parallel
states, history, sync and async). Downloads 1,422,332/month vs
transitions 3,137,416/month (pepy.tech, 2026-08-23).
Co-Authored-By: Claude <noreply@anthropic.com>
v7 blocks checking out fork PR heads under pull_request_target and
workflow_run. Neither workflow here uses those triggers, so the only
effect is staying current with the other repos.
Pydantic Services took over stewardship of the stalling httpx under the httpx2 name, Starlette already switched its TestClient, and it hit 144M downloads/month (pepy) within 3 months of first release at Production/Stable v2.12.0. Placed last in the challenger tier behind urllib3 per the downloads-descending ordering rule. Fork format and a rewritten description distinguish it from httpx, whose PyPI summary is identical.
Co-Authored-By: Claude <noreply@anthropic.com>
Project now requires Python >=3.14; the pin fails live (verified during
PR review), and plain uv run / make resolves correctly without it.
Co-Authored-By: Claude <noreply@anthropic.com>
The "most diffs sit on stale bases" claim was a one-time artifact of
the shortlist reform, not a durable fact about future PRs. Reworded to
state that diff context lines show the base the PR was written on,
which may have changed since, while keeping conflict-to-Merge-arm
routing.
Co-Authored-By: Claude <noreply@anthropic.com>
Two live review-prs runs surfaced fixes:
- Merge conflicts move from the screen-out rules to a local-merge path
in the Merge arm; 7/10 PRs conflicted only from the reform's stale
bases, and one such PR had already been merged this way.
- Target use case is now resolved from the current README instead of
stale diff context, since most PR bases no longer match live
sections.
- Judge gets a third verdict: no fitting use case is a structure
question, carried to Act for the maintainer to decide.
- Act's Close step gets a batching and checklist note, and the whole
step gets an explicit completion criterion after a verdict nearly
fell out of the question batches.
- Drop the "claude reviewed" label mechanism entirely: the fetch
filter, the Park arm, and the labeled-open terminal state.
Co-Authored-By: Claude <noreply@anthropic.com>
Add seleniumbase to Testing — Browser Automation as a challenger (2.86M downloads/month via pepy vs selenium 56.9M; admitted by maintainer decision). Entry placed per Entry Ordering, display name set to the canonical PyPI package name.
Superseded by the rewritten .claude/skills/review-prs/SKILL.md
committed just before (9ce2a21); leaving it in place would keep a
stale second copy of the PR-review instructions.
Co-Authored-By: Claude <noreply@anthropic.com>
The old review-pending-prs command carried a stale copy of CONTRIBUTING.md's rejection rules (100-star bar, "too niche") that contradicted the current shortlist model. This skill screens from the diff only, delegates admission judgment to the audit-the-list skill, then acts on GitHub: merge with section reconcile, AskUserQuestion-gated closes.
Co-Authored-By: Claude <noreply@anthropic.com>
Kicker now mirrors the hero kicker ("The definitive list that
answers..."), replacing the old "field guide" line changed in
8b14b4f. Subtitle now matches the current tagline ("An opinionated
guide to the best Python frameworks, libraries, and tools.") on one
line. PNG regenerated from the SVG.
Co-Authored-By: Claude <noreply@anthropic.com>
Entries now end with "(PyPI downloads/month: N, GitHub stars: M)" where
known, replacing the stars-only note, since download counts are the
list's stated primary evidence signal. annotate_entries_with_stars is
renamed to annotate_entries_with_stats and looks downloads up by the
first link's display name, skipping category-index bullets (which link
into the site itself) and Built-in entries (which would otherwise hit
same-named PyPI backports like logging or asyncio).
The intro now mirrors the README subtitle verbatim with the
project/category totals on their own line below, and the "opinionated
catalog" wording is gone since the shortlist ADR is literally titled
"shortlist, not a catalog".
Co-Authored-By: Claude <noreply@anthropic.com>
Replaces the em dash in the PyPI Downloads column with a source-badge
pill labeled "Not on PyPI", reusing the existing badge style used by
the stars column for visual consistency. Sorting is unaffected since
non-numeric cells already parse as missing.
Co-Authored-By: Claude <noreply@anthropic.com>
Downloads is now the default sort, so it sits directly after the
project name in both the index and category table templates. The
source-type badge stays in the stars cell.
Co-Authored-By: Claude <noreply@anthropic.com>
Entries with a download count now sort first (descending), with
stars, then Built-in, then name as fallback tiers for entries that
lack a count. main.js mirrors this in its default activeSort, clean
URL check, and third-click reset target. Sorting by stars remains one
header click away.
Co-Authored-By: Claude <noreply@anthropic.com>
Every entry is now {"package": str|null, "reason": str|null} instead of
a bare string/null. Reasons are required for null packages, explaining
why the name must never be queried (squatted name, stdlib module,
monorepo umbrella, GitHub-only project, and so on). Reasons are
optional for remaps and kept only on the six non-obvious ones: pytorch
(squatter), jinja (jinja is Jinja1), strawberry (unrelated bookmarking
service), django-rules (abandoned fork), django-rest-framework (dead
alias), and devpi (deprecated metapackage); plain publishes-as-X
remaps get a null reason.
load_overrides() in the clickpy fetcher now extracts the package field
from each entry; resolve() and the pepy/bigquery cross-check scripts
are unchanged since they consume load_overrides()'s output.
Co-Authored-By: Claude <noreply@anthropic.com>
Every queried name now resolves 447/447. Adds 23 explicit null
overrides so squatters can never silently attach a PyPI number to
these names later: stdlib-named entries (concurrent-futures, difflib,
mimetypes, sqlite3, tkinter, tomllib, zoneinfo), interpreters
(micropython, pypy), monorepo umbrellas (azure-sdk-for-python,
google-cloud-python), self-hosted or distro-installed projects (odoo,
cloud-init, warehouse), GitHub-only projects (thealgorithms,
geodjango, django-db-models, django-ai-plugins, graphify,
sentry-skills, social-engineer-toolkit, trailofbits-skills), and
httpx-url (a class within httpx, not a package).
Caveat: graphify and django-ai-plugins are young projects that may
legitimately publish to PyPI later — flip their null to a remap
during a future audit if they do.
Co-Authored-By: Claude <noreply@anthropic.com>
autobahn-python publishes as autobahn (7.1M/mo), pangu-py as pangu, and
strawberry-django as strawberry-graphql-django (1.5M/mo). httpx.URL is
left unmapped deliberately since it's a class within the httpx package,
not a package of its own.
Co-Authored-By: Claude <noreply@anthropic.com>
Sourced from website/data/pypi_downloads.tsv the same way
github_stars.json feeds the stars column. The new sortable column
sits between GitHub Stars and Last Commit on the homepage and
category pages, formatted with thousands separators like stars, with
an em dash when no PyPI data exists. Rows are matched by normalized
README display name; Built-in entries never show counts since
same-named PyPI packages are stdlib backports (e.g. the asyncio
package).
Below 960px the column hides and the count moves into the expand
row, mirroring the existing Last Commit treatment. main.js gains the
downloads sort branch and URL param.
The deploy workflow fetches the TSV via the new
make fetch_pypi_downloads target with a daily actions/cache
fallback, mirroring the stars fetch, but non-fatal: the column
degrades to dashes when the fetch fails, unlike stars which the
build requires.
Co-Authored-By: Claude <noreply@anthropic.com>
A pypi.org identity sweep of all 438 cached rows (project_urls/home_page
vs entry GitHub URL) found download counts were looked up by README
display name, so entries whose name differs from the canonical package
silently measured squatters or dead predecessors: pytorch measured a
squatter (169,737/mo vs torch's 94M), jinja measured Jinja1 (3,168 vs
jinja2's 736M), django-rest-framework a dead alias package (real:
djangorestframework), django-rules an abandoned fork (real: rules),
strawberry an unrelated bookmarking service (real: strawberry-graphql),
devpi a deprecated metapackage (mapped to devpi-server).
New curated website/data/pypi_name_overrides.json maps normalized
README name to the real package, or null for projects not
pip-installable whose name is squatted or a relic (cpython, pyenv,
renpy, python-patterns, winpython); also maps mem0 to mem0ai, fasthtml
to python-fasthtml, and playwright-python to playwright.
All three fetch scripts resolve names through it; the clickpy TSV
cache gains a package column recording what each row actually
measured. .gitignore switches website/data/ to website/data/* with a
negation so the curated overrides file is tracked while caches stay
ignored.
Co-Authored-By: Claude <noreply@anthropic.com>
The entry linked hydra-ecosystem/hydra, an unrelated W3C Hydra API
toolkit, while the entry name and description describe
facebookresearch's Hydra configuration framework, mixing the wrong
repo's stars with the right package's identity. Found during the
downloads-column identity sweep.
Co-Authored-By: Claude <noreply@anthropic.com>
Exact reproducibility already lives in uv.lock via 'uv sync --locked',
so == in pyproject.toml only duplicates the lockfile and blocks
'uv lock --upgrade'. Locked versions are unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
watchdog 6.0.0 (last release 2024-11-01) ships no cp314 macOS wheel,
and uv has no per-package build allowlist under no-build = true, so
the preview file watcher moves to watchfiles, which ships cp314
wheels. watchfiles now lives in its own preview dependency group.
UV_PYTHON=3.13 is no longer needed on machines that only have 3.14.
Co-Authored-By: Claude <noreply@anthropic.com>
Removed the companion-project clause from the Sub-item definition in
CONTEXT.md's vocabulary. Its examples (aws-sdk-pandas under pandas,
flower under celery) went stale this sitting: those companions were
promoted, re-homed, or deleted. Per the maintainer's 2026-08-16 policy
decision, sub-items are now reserved for awesome-* also-see links only
- a companion project must earn a full Entry in its proper Use Case or
not be listed.
Co-Authored-By: Claude <noreply@anthropic.com>
Re-homed pyenv-win from a pyenv sub-item (Environment Management) to a full entry in Microsoft Windows, placed before winpython by downloads (25.8k/mo vs 172). Actively maintained, pushed 2026-08-14, 7,360 stars. Maintainer preference is to move sub-items to a fitting category rather than delete.
Co-Authored-By: Claude <noreply@anthropic.com>
Flower isn't a task queue, so nesting it under celery misclassified it; Task Queues is also at its entry cap. Monitoring and Processes is its honest home, ranking fourth by downloads (12.35M/mo ClickPy, between supervisor 17.0M and sh 11.8M), and Celery's own docs name it the recommended monitor. Repo pushed 2026-08-16 with 7,232 stars. This fills Monitoring and Processes to its 5-entry cap.
Co-Authored-By: Claude <noreply@anthropic.com>
Was a sub-item under mkdocs. By downloads it ranks second in the
section at 17.6M/mo (ClickPy), above mkdocs' 17.4M, and it powers
FastAPI, Pydantic, and Ruff/Polars docs (27,269 stars, pushed
2026-08-09). Documentation now sits at its 5-entry cap.
Co-Authored-By: Claude <noreply@anthropic.com>
Not a tool readers install: type checkers bundle it automatically as a
stub collection, it has no PyPI package, and no standalone use case.
The Type Checkers subcategory label already links to
awesome-python-typing for ecosystem depth.
Co-Authored-By: Claude <noreply@anthropic.com>
Sub-item policy reserves sub-items for awesome-* links. aws-sdk-pandas
promoted out as awswrangler in Data Ingestion / ETL > General
(85.3M downloads/mo, 10x dlt, active).
Co-Authored-By: Claude <noreply@anthropic.com>
Vinta ChenandClaude
Kar Petrosyan