Developer · Weekly · March 22, 2026

python tooling after the ***Astral*** acquisition

OpenAI is acquiring Astral, the company behind the Python package manager uv and the linter Ruff, explicitly to bolster its Codex ecosystem.[1] uv is already "revolutionizing" Python package management and is now seeing nearly double the monthly downloads of Poetry, putting it on a clear adoption curve.[2]

Developers like its speed but point out it still can't magically fix Python dependency hell, so lockfile and native-lib issues remain.[3]

Ruff is praised for being extremely fast in real projects but still lags tools like Pylint in some checks, so teams are trading coverage for speed.[4]

The acquisition triggered worries about future paywalls or proprietary forks, with people explicitly talking about forking uv/Ruff if OpenAI tightens control.[5]

ai coding stacks are converging

Codex usage is climbing fast, and GPT‑5.4 mini is tuned for coding while being about 2x faster than GPT‑5 mini, so it’s becoming the default engine for many workflows.[6]

Codex now has subagents that run tasks in parallel while keeping a clean main context, and there is already a catalog of over 130 subagents for different dev tasks.[7]

Users report Codex is particularly strong at implementation details, terminals, and long-context sessions, sometimes cutting their API bills in half via dynamic context caching.[8]

At the same time, many experienced devs still prefer Claude Code for large multi-file refactors and reliability on tricky prompts, and some rate its overall experience higher than Codex.[9]

Cursor’s Composer 2, built on Kimi K2.5 with RL fine-tuning, reportedly beats Claude Opus 4.6 on benchmarks at lower cost, but its undisclosed model origins and Moonshot’s claim of no permission granted have made a chunk of the community distrust the stack.[10]

ai-generated code volume vs review and reliability

Top AI coding tools are still wrong roughly one in four times, even as Frontier LLMs hit 85–95% on standard coding benchmarks.[11] Stripe’s internal agent reportedly merges over 1,300 pull requests a week without humans in the loop, while CodeRabbit now reviews around 1 million PRs weekly across 3 million repos.[12]

This is colliding with communities like Node.js core, where maintainers are pushing back hard, including a petition to ban LLM-assisted PRs and blocking a Claude-generated patch from landing.[13]

Developers describe "vibe coding"—leaning heavily on assistants for structure and edits—as making QA and long-term maintainability much harder, and several threads note traditional code review culturally eroding as people lean on tools like Codex, Claude Code, and OpenCode to "review" themselves.[14]

OpenCode sits in an odd niche here: it’s open-source and cheaper for simple tasks, but users question its transparency and say it trails frontier models on complex work, which keeps it secondary rather than primary in most stacks.[15]

agents with shell/infra access are already breaking things

Shell-command agents moved from toy demos to real frameworks: LangChain’s Deep Agents can execute shell commands, and new shell command agents can auto-run OS commands, explicitly raising the risk of system damage.[16]

OpenShell positions itself as a security runtime for long-running autonomous agents, enforcing fine-grained privacy and access controls, and NVIDIA’s NemoClaw bakes this in while offering one-command Nemotron model installs.[17]

At the same time, a hacker used prompt injection in an automated GitHub workflow to push malware to about 4,000 computers, and another supply-chain attack abused invisible Unicode in GitHub Actions configs, showing how fragile CI pipelines are once agents can touch them.[18]

MCP servers, which many agents rely on for tool access, are failing basic quality checks—76.6% got an F in one evaluation—and often ship without meaningful access control, even as some, like the Stripe MCP server, can issue refunds and create payment links without rate limits.[19]

IAM around all of this is lagging badly: most GitHub Actions OIDC policies allow virtually any repo to assume AWS roles, and some GenAI pilots already let agents modify records and make IAM requests over OAuth.[20]

containers, homelabs, and the docker + ***Caddy*** sweet spot

Self-hosted stacks keep clustering around Docker Compose plus a reverse proxy, and Caddy is increasingly the default for newcomers because it ships auto-SSL, simple config, and good Cloudflare tunnel integration.[21]

Power users note that Caddy is less flexible than Nginx for complex edge cases, so some advanced routing setups still fall back to the older stack.[22]

Docker itself is under scrutiny: people report that its default behavior can bypass host firewalls, creating unexpected vulnerabilities, and that not pinning image versions regularly turns restores into painful archaeology when data formats change.[23]

For small deployments, many stick with single-host Docker or simple Compose files, while Kubernetes or Swarm+MicroCeph-style clusters tend to show up only once people are juggling lots of services or multi-host homelabs.[24]

All of this usually sits on Linux distributions glued together by systemd, which just picked up a local root escalation (CVE‑2026‑3888) and continues to be hard to replace because tooling is tightly coupled to it.[25]

local llms and cheap gpu tricks are now practical

Unsloth Studio gives a browser-based UI that can train and run LLMs fully offline on macOS, Windows, and Linux, claiming around 2x faster training while using 70% less VRAM than typical setups.[26]

It doesn’t even require a GPU in many cases, and can turn PDFs, CSVs, and DOCX files into datasets automatically, though users report some ValueError crashes in quickstart flows.[27]

Google Colab’s new open-source MCP server lets any local agent offload Python execution and GPU work to Colab runtimes, effectively turning free T4 or A100 sessions into disposable backends.[28]

On the hardware side, Nvidia’s GreenBoost can transparently extend GPU VRAM with system RAM or NVMe, and users report running models like Qwen3.5 35B that need about 27GB on GPUs like the RTX 5090 with 32GB of VRAM.[29]

The local stack is still rough—standard AI installers are currently failing on RTX 50‑series Blackwell cards, and multi-GPU vLLM setups can hang when tensor or pipeline parallelism is enabled—but for many workloads a single Mac with 64GB RAM or a rented RTX 6000 on Runpod is now enough.[30]