Python This Week — September 2, 2026: 3.15 RC2, a pip Security Fix, and PSF Board Voting Opens

A busy start to September in the Python world: the final release candidate for Python 3.15 landed, pip shipped a security fix, and Python Software Foundation board voting opened. Here are the highlights from the past week.

Python 3.15.0 release candidate 2 ships — final due October 1

Python 3.15.0rc2 was released on September 1, the second and final release candidate before the stable 3.15.0 build scheduled for October 1. It rolls up roughly 144 bug fixes, build tweaks, and documentation changes from 76 contributors since rc1. With the branch feature-frozen, only clear bug fixes will be accepted between now and the final release — a good moment to start testing your code against it. source

What's actually new in 3.15: lazy imports, frozendict, and the Tachyon profiler

The headline features locked into 3.15 are worth knowing. PEP 810 adds an explicit lazy import keyword that defers module loading until first use, cutting startup time dramatically on large codebases. A built-in frozendict arrives as a hashable, immutable mapping, and the new high-frequency Tachyon sampling profiler can attach to a running process with near-zero overhead and emit flamegraphs. UTF-8 also becomes the platform-agnostic default encoding, and JIT speedups land in the 8–13% range depending on architecture. source

pip fixes a path-traversal vulnerability (CVE-2026-13346)

A medium-severity flaw in pip, CVE-2026-13346, was disclosed and patched in pip 26.2. pip incorrectly handled doubly-encoded package URLs from an index, which could let files be written to arbitrary locations on disk. Exploitation requires a malicious package index (not just a malicious package) and materially affects users running pip download with --only-binary. Distributions including SUSE pushed updated packages at the end of August. Upgrading pip is the fix. source

PSF Board election voting is now open

The Python Software Foundation opened voting for its 2026 Board of Directors election on September 1, with the ballot closing September 15. Eligible voting members who affirmed their intent to vote can now cast ballots for the announced slate of candidates. If you're a PSF member, check your inbox. source

uv keeps up its rapid release pace

Astral's uv continued its steady stream of releases through late August, with updates landing as recently as August 27. Recent changes include opt-in TLS diagnostics that prefer post-quantum key exchange, a new uv check --no-install-project flag, and additional bundled CPython patch builds. If you manage Python environments with uv, it's worth staying current. source

That's the week in Python. See you next Wednesday.