Standard Library Highlights Summary

Every highlight bullet from the 12 pages in this section, gathered on one page and grouped by the page it came from.

The Standard Library Mental Model

• Each core stdlib module owns exactly one platform job - paths, civil time, data interchange, text patterns, or process orchestration
• Stdlib evolves conservatively and by PEP, so its guarantees hold across years, not just until the next release
• The str/bytes boundary is the seam that cuts across pathlib, json, and subprocess alike
• Reaching for PyPI too early trades a stable dependency-free contract for ergonomics you may not actually need

Standard Library Overview

• Use pathlib for file paths and argparse for CLI arguments
• Reach for stdlib before adding dependencies to your project
• Use hashlib and secrets for hashing and token generation
• Choose httpx or aiohttp over requests for production HTTP
• Avoid subprocess with shell=True due to injection risks
• Review Python release notes for stdlib changes per version

pathlib & os

• Use Path objects to join path segments portably across platforms
• Specify utf-8 encoding when reading text to avoid mojibake on Windows
• Use rglob for recursive globbing instead of manual directory walking
• Call resolve before comparing paths to handle symlinks and anchors
• Open files in try except instead of checking exists to avoid TOCTOU races
• Use shutil.rmtree for deleting directory trees since pathlib has no delete

datetime, zoneinfo & time

• Store API timestamps in UTC with timezone-aware datetime
• Convert for display only using zoneinfo, not for storage
• Use timedelta for durations instead of integer seconds
• Use perf_counter for performance benchmarks, not datetime
• Reject naive datetimes in domain layer functions
• Install tzdata package on Windows for zoneinfo

json & Serialization

• Encode Python objects to JSON with custom default encoder and object_hook for round-trips
• Use Pydantic 2 at API boundaries, json module for config files and simple REST
• Dict keys coerce to strings in JSON, normalize keys when loading parsed data
• Guard untrusted JSON input from denial of service via limiting parser size
• Use Decimal as string for money, not float, to avoid precision loss
• orjson from PyPI is faster for hot paths, json module fine for CLI and config

re - Regular Expressions

• Compile regex patterns once at module level for performance in hot paths
• Use raw strings with re to make escape sequences readable and clear
• Match anchors at start of string while search finds pattern anywhere
• Avoid catastrophic backtracking by using possessive limits or atomic groups
• Prefer string methods when simple patterns do not require regex engine features
• Avoid incomplete email and URL validation via regex without secondary checks

subprocess

• Prefer argument lists over shell form to prevent command injection vulnerabilities
• Use run for one-shot commands and Popen for streaming IO or background processes
• Set check=True to detect failures, timeout to prevent zombie hangs, text=True for strings
• Capture output with capture_output=True and set stdin=DEVNULL when no input needed
• Never use shell=True with untrusted input, always set timeout in services, stream large output
• Explicitly set cwd parameter to prevent running relative binaries from wrong directory

collections, itertools & functools Recap

• Counter tallies frequencies without manual dict increments
• Use deque for FIFO operations and LRU cache at O(1) both ends
• groupby on unsorted input splits the same key twice
• Apply lru_cache to memoize expensive function results efficiently
• itertools chain, islice, and batched compose lazily
• defaultdict supplies default values for missing keys

dataclasses, enum & contextlib

• Apply dataclass to eliminate boilerplate in data objects
• Use StrEnum for type safe named constants in code
• Simplify context managers with contextlib utilities
• Set frozen=True on dataclass for immutable objects
• Use field default_factory to avoid mutable defaults
• Wrap contextmanager yield in try finally for errors

argparse & configparser

• argparse builds CLI interfaces with flags, subcommands, and help text
• configparser reads INI-style files for layered defaults and overrides
• CLI arguments override file config which overrides default values
• Fix boolean flags with action=store_true not type=bool
• Store secrets in environment variables, never in INI files
• Use tomllib for new projects, configparser only for legacy INI

hashlib, secrets & uuid

• Pick the right tool: hashlib for checksums, secrets for tokens, uuid4 for keys
• Password hashing requires argon2 or bcrypt, never use hashlib alone
• secrets provides CSPRNG tokens, the random module is predictable for security
• uuid4 creates random IDs by default, uuid7 is time-ordered for better indexes
• Use compare_digest to prevent timing leaks when comparing security values
• Hash large files incrementally with file_digest to avoid memory overload

Standard Library Best Practices

• Prefer stdlib batteries-included modules before reaching for PyPI packages
• Use subprocess with list args and shell=False to prevent injection attacks
• Hash passwords with argon2 or bcrypt via established libraries, never sha256 alone
• Use Path objects with explicit utf-8 encoding instead of string path concatenation
• Store dates as UTC and convert with zoneinfo for display, reject naive datetimes
• Configure logging in main function, not in library modules using getLogger