Python This Week — August 26, 2026: PyCon AU Opens, Python 3.15 Nears the Finish Line, and Polars 1.44

A busy week for the Python world: Australia's national conference kicks off in Brisbane, the 3.15 release candidate train rolls toward its October finale, Polars ships a fresh stable release, MCP's SDK shake-up keeps tripping up upgraders, and a new supply-chain advisory is worth a look. Here's what caught our eye over the past seven days.

PyCon AU 2026 opens in Brisbane

PyCon Australia 2026 runs August 26–30 at the Sofitel Brisbane Central. Workshops kick things off on Wednesday the 26th, the main conference and specialist "miniconf" tracks run Thursday through Saturday (27–29), and development sprints close out the event on Sunday the 30th. If you can't make it in person, talks are available via live stream, with online tickets bundling Discord access. source

Python 3.15 enters the home stretch

Python 3.15.0 reached release candidate 1 on August 4, with rc2 slated for September 1 and the final release scheduled for October 1, 2026. The core team notes there will be no ABI changes from the RC phase forward, so this is a good moment to start testing against 3.15. Highlights expected in the release include lazy imports, immutable dictionaries, a new profiling capability, and continued work on the experimental JIT compiler. source

Polars 1.44.0 lands on PyPI

The fast DataFrame library Polars pushed version 1.44.0 to PyPI on August 24, its latest stable release. Polars continues its rapid cadence — the project shipped a dozen releases in Q1 2026 alone — and remains a popular choice for teams looking to speed up data processing over pandas. Check the release notes for the full changelog before upgrading. source

MCP Python SDK 2.0 migration keeps biting

Following the July 28 release of MCP Python SDK 2.0, developers are still hitting ModuleNotFoundError: No module named 'mcp.server.fastmcp' as they upgrade. The v2 line moved every submodule under mcp.server.fastmcp.* to mcp.server.mcpserver.* and renamed the FastMCP class to MCPServer, alongside the protocol's shift to a stateless request/response model. If you maintain an MCP server, plan the rename before pinning to 2.x. source

Security: SymPy-powered RCE and a malicious package wave

On the supply-chain front, CVE-2026-55585 affects the qwed package, which passed attacker-controlled input directly to SymPy's parse_expr() without a restricted namespace — allowing authenticated remote code execution. Users should upgrade to 5.1.2 or later. Separately, researchers flagged a fresh wave of malicious PyPI packages tied to multi-stage campaigns, a reminder to pin dependencies and audit new additions. source

That's the week in Python. See you next time. 🐍