tl;dr: a new feature is coming in Python 3.15 whereby the `import` lines (which allow arbitrary code execution by design) in .pth files will be skipped whenever a corresponding .start file is found in the same folder; this file specifies one or more entry points to code in the environment (which will run after paths have been collected and added from the .pth files). This is intended to separate responsibilities and make the environment easier to audit. However, it doesn't protect against the sort of malice we've seen with Shai-Hulud type attacks.
There is a deprecation plan whereby the `import` lines in .pth files will become silently ignored (even if there is no .start file) in 3.18, and then start emitting a warning in 3.20. This seems entirely backwards to me, but whatever. (The natural approach, IMO, would be to start warning now while still processing them, and later remove the code entirely such that the import lines then become invalid paths.)
tl;dr: a new feature is coming in Python 3.15 whereby the `import` lines (which allow arbitrary code execution by design) in .pth files will be skipped whenever a corresponding .start file is found in the same folder; this file specifies one or more entry points to code in the environment (which will run after paths have been collected and added from the .pth files). This is intended to separate responsibilities and make the environment easier to audit. However, it doesn't protect against the sort of malice we've seen with Shai-Hulud type attacks.
There is a deprecation plan whereby the `import` lines in .pth files will become silently ignored (even if there is no .start file) in 3.18, and then start emitting a warning in 3.20. This seems entirely backwards to me, but whatever. (The natural approach, IMO, would be to start warning now while still processing them, and later remove the code entirely such that the import lines then become invalid paths.)