
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Air
Advanced tools
The new Python web framework by the authors of Two Scoops of Django. Built with FastAPI, Starlette, and Pydantic.
The first web framework designed for AI to write.
Built on FastAPI, Pydantic, and HTMX.
response_class=HtmlResponse and templates.TemplateResponse for every HTML viewWebsite: https://airwebframework.org
Documentation: https://docs.airwebframework.org
Source Code: https://github.com/feldroy/air
[!CAUTION] Air is in alpha. APIs may change between releases.
Install Air with uv:
uv venv
source .venv/bin/activate
uv init
uv add air
uv add)You can install each optional feature (extras) like this:
Standard — FastAPI’s recommended extras
uv add "air[standard]"
Air's API is fully typed and comprehensively documented in-source. AI coding assistants can understand the framework by reading the installed package, without fetching external documentation.
For AI context, use llms-full.txt (complete docs) or llms.txt (index with links to individual sections).
Third-party context providers: Code Wiki by Google, DeepWiki by Devin.
Air gives you two paths to HTML. Start with whichever fits your workflow.
Have your AI generate an HTML mockup, or write one yourself. Drop it in a template, wire it up with minimal Python:
templates/index.html:
<!doctype html>
<html>
<head>
<title>My Website</title>
</head>
<body>
<h1>Hello, world!</h1>
</body>
</html>
main.py:
import air
app = air.Air()
jinja = air.JinjaRenderer(directory="templates")
@app.page
def index(request: air.Request):
return jinja(request, name="index.html")
Write HTML as typed Python classes. Your editor autocompletes attributes, your type checker validates nesting:
main.py:
import air
app = air.Air()
@app.page
def index():
return air.Html(air.H1("Hello, world!"))
air run
Open http://127.0.0.1:8000 to see the result. Both paths produce the same thing: a working web page.
Air is powered by FastAPI. You get Air's HTML tools for your pages and FastAPI's full capabilities for your API, all in one app.
Two separate apps, clean split. Air serves pages, FastAPI serves your API at /api.
from fastapi import FastAPI
import air
app = air.Air()
api = FastAPI()
@app.page
def index():
return air.Html(
air.Head(air.Title("My Website")),
air.Body(
air.H1("My Website"),
air.P(air.A("API Docs", target="_blank", href="/api/docs")),
),
)
@api.get("/")
def api_root():
return {"message": "My Website is powered by FastAPI"}
# Mount the FastAPI app under /api
app.mount("/api", api)
One app. Air adds its features on top. You get OpenAPI docs, response_model, and WebSockets alongside your pages.
from fastapi import FastAPI
import air
fastapi_app = FastAPI()
app = air.Air(fastapi_app=fastapi_app)
@app.page
def index():
return air.H1("Hello, world!")
@app.fastapi_app.get("/api/users")
def api_users():
return [{"name": "Audrey M. Roy Greenfeld"}]
Maintenance of this project is made possible by all the contributors and sponsors. If you would like to support this project and have your avatar or company logo appear below, please sponsor us. 💖💨
Consider this low-barrier form of contribution yourself. Your support is much appreciated.
[!IMPORTANT] Have a feature idea? Open an issue first. Air's core is intentionally minimal: new features are built as separate packages in the Air ecosystem, not added to this base package.
For guidance on setting up a development environment and how to make a contribution to Air, see Contributing to Air.
Thanks to all the contributors to the Air 💨 web framework!
FAQs
The new Python web framework by the authors of Two Scoops of Django. Built with FastAPI, Starlette, and Pydantic.
We found that Air demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.