
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
xpresso
Advanced tools
Xpresso is an ASGI web framework built on top of Starlette, Pydantic and di, with heavy inspiration from FastAPI.
Some of the standout features are:
Python 3.7+
pip install xpresso
You'll also want to install an ASGI server, such as Uvicorn.
pip install uvicorn
Create a file named example.py:
from pydantic import BaseModel
from xpresso import App, Path, FromPath, FromQuery
class Item(BaseModel):
item_id: int
name: str
async def read_item(item_id: FromPath[int], name: FromQuery[str]) -> Item:
return Item(item_id=item_id, name=name)
app = App(
routes=[
Path(
"/items/{item_id}",
get=read_item,
)
]
)
Run the application:
uvicorn example:app
Navigate to http://127.0.0.1:8000/items/123?name=foobarbaz in your browser. You will get the following JSON response:
{"item_id":123,"name":"foobarbaz"}
Now navigate to http://127.0.0.1:8000/docs to poke around the interactive Swagger UI documentation:

For more examples, tutorials and reference materials, see our documentation.
Xpresso is mainly inspired by FastAPI. FastAPI pioneered several ideas that are core to Xpresso's approach:
Xpresso takes these ideas and refines them by:
Annotated (PEP 593) instead of default values (param: FromQuery[str] instead of param: str = Query(...)).This project is under active development. It should not be considered "stable" or ready to be used in production. It is however ready for experimentation and learning!
Most of this APIs will be generally stable going forward, although some minor aspects like argument names will probably change at some point.
xpresso.binders): this is public, but should be considered experimental and is likely to change. The high level APIs (FromPath[str] and Annotated[str, PathParam(...)]) are likely to be stable.See this release on GitHub: v0.46.0
FAQs
A developer centric, performant Python web framework
We found that xpresso demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.