Third Party Libraries

except the library of Babel

Author

Karsten Naert

Published

October 20, 2026

Third party libraries

One of the things that makes Python so popular is the enormous amount of third party packages that are available. We have already encountered some of them, like requests and numpy in earlier lectures. This lecture, we will explore some additional packages.

There is no fixed scenario for this lecture. Just investigate the documentation, install the packages, and try to build something with them!

Some suggestions

Astral — sun and moon positions, sunrise and sunset times. Small, self-contained, and a nice excuse to work with timezones.
Polars — a dataframe library, and the main modern alternative to Pandas.
Textual — build a text user interface that runs in the terminal. Compare it with the curses module from the standard libraries.
Rich — Textual’s little sibling: colours, tables, progress bars and pretty tracebacks in the terminal. If you did the Pokémon table exercise from lesson 1 by hand, this is what you were reinventing.
Typer or Click — command line interfaces. Compare against the argparse we saw in the standard libraries.
attrs and pydantic — two takes on the problem that dataclasses solves. Where does each go further?

A case study: httpx and httpx2

For making HTTP requests, the library everybody used to name was requests. Its modern successor is httpx, which offers the same style of API plus async support and HTTP/2.

Except that if you go looking for it today, you will find something confusing: a package called httpx2, maintained by the Pydantic team, that does the same job. It is worth understanding how that happened, because this is a situation you will meet again with other libraries.

The short version:

httpx spent years on version numbers below 1.0. Under semantic versioning, that is a signal that the API is not yet stable, and the maintainer used it: breaking changes landed in minor releases, for instance between 0.27 and 0.28. Downstream projects found their code broken by what looked like a routine upgrade.
A 1.0 was announced that would have brought substantial further breaking changes.
Meanwhile releases dried up: at the time of writing the newest release on PyPI is 0.28.1, from December 2024. Bug fixes and security patches were not shipping.
Pydantic — who depend on it heavily — took over stewardship under a new name. The install is pip install httpx2 and, importantly, the import name changes too: import httpx2.

There are other forks as well; httpxyz is another attempt at the same problem.

Exercise

This is a good one to think about rather than code.

Read the httpx2 README and at least skim the original 1.0 discussion on the httpx repository. Try to state each side’s position fairly.
Suppose you are starting a new project today that needs an HTTP client. Which do you pick, and what would you want to check before deciding? Consider: when was the last release, how many maintainers are there, who depends on it, and what happens to you if the project stops.
The import name changed from httpx to httpx2. Why might the maintainers have chosen that, rather than keeping import httpx so existing code keeps working?

The general lesson

Every third party dependency is a bet on somebody else continuing to do work for free. Before adding one, it costs you two minutes to look at: the date of the last release, the number of people with commit rights, and the open issue count. That is not cynicism about open source — it is the same judgement you would apply to any supplier.

--- title: "Third Party Libraries" subtitle: "except the library of Babel" author: "Karsten Naert" date: today toc: true execute: echo: true output: true --- # Third party libraries One of the things that makes Python so popular is the enormous amount of third party packages that are available. We have already encountered some of them, like `requests` and `numpy` in earlier lectures. This lecture, we will explore some additional packages. There is no fixed scenario for this lecture. Just investigate the documentation, install the packages, and try to build something with them! ## Some suggestions - [Astral](https://sffjunkie.github.io/astral/) — sun and moon positions, sunrise and sunset times. Small, self-contained, and a nice excuse to work with timezones. - [Polars](https://pola.rs/) — a dataframe library, and the main modern alternative to Pandas. - [Textual](https://textual.textualize.io/) — build a text user interface that runs in the terminal. Compare it with the `curses` module from [the standard libraries](06-standard-libraries.qmd). - [Rich](https://rich.readthedocs.io/) — Textual's little sibling: colours, tables, progress bars and pretty tracebacks in the terminal. If you did the Pokémon table exercise from [lesson 1](01-control-structures.qmd) by hand, this is what you were reinventing. - [Typer](https://typer.tiangolo.com/) or [Click](https://click.palletsprojects.com/) — command line interfaces. Compare against the `argparse` we saw in [the standard libraries](06-standard-libraries.qmd). - [attrs](https://www.attrs.org/) and [pydantic](https://docs.pydantic.dev/) — two takes on the problem that `dataclasses` solves. Where does each go further? ## A case study: httpx and httpx2 For making HTTP requests, the library everybody used to name was `requests`. Its modern successor is [httpx](https://www.python-httpx.org/), which offers the same style of API plus async support and HTTP/2. Except that if you go looking for it today, you will find something confusing: a package called [httpx2](https://github.com/pydantic/httpx2), maintained by the Pydantic team, that does the same job. It is worth understanding how that happened, because this is a situation you will meet again with other libraries. The short version: - httpx spent years on version numbers below 1.0. Under [semantic versioning](https://semver.org/), that is a signal that the API is not yet stable, and the maintainer used it: breaking changes landed in *minor* releases, for instance between 0.27 and 0.28. Downstream projects found their code broken by what looked like a routine upgrade. - A 1.0 was announced that would have brought substantial further breaking changes. - Meanwhile releases dried up: at the time of writing the newest release on PyPI is 0.28.1, from December 2024. Bug fixes and security patches were not shipping. - Pydantic — who depend on it heavily — took over stewardship under a new name. The install is `pip install httpx2` and, importantly, the **import name changes too**: `import httpx2`. There are other forks as well; `httpxyz` is another attempt at the same problem. ::: {.callout-note icon=false} ## Exercise This is a good one to think about rather than code. 1. Read the [httpx2 README](https://github.com/pydantic/httpx2) and at least skim the original [1.0 discussion](https://github.com/encode/httpx/discussions/3344) on the httpx repository. Try to state each side's position fairly. 2. Suppose you are starting a new project today that needs an HTTP client. Which do you pick, and what would you want to check before deciding? Consider: when was the last release, how many maintainers are there, who depends on it, and what happens to you if the project stops. 3. The import name changed from `httpx` to `httpx2`. Why might the maintainers have chosen that, rather than keeping `import httpx` so existing code keeps working? ::: ::: {.callout-tip} ## The general lesson Every third party dependency is a bet on somebody else continuing to do work for free. Before adding one, it costs you two minutes to look at: the date of the last release, the number of people with commit rights, and the open issue count. That is not cynicism about open source — it is the same judgement you would apply to any supplier. :::