3.1   Deb Nicholson

• Worked on staff capacity planning
• Worked with staff to identify gaps and opportunities for possible future work
• Supported preparations for the PSF Board Election and (inaugural) Packaging Council Election
• Respond to administrative legal emails
• Support backend financial work
• Work with board on Strategic Plan
• Conversations about fiscal sponsor program
• Conversations about package repository sustainability
• Discuss ongoing open source policy issues

3.2   Oliva Sauls

• PyCon US 2026 budget wrap-up
  • Hotel rebates and commissions
  • F&B credit and final bill review
  • Electric review and negotiation
  • Working with business counsel regarding Westin attrition damages
• PyCon US 2026 recording review and edits
• PyCon US 2026 post-conference report drafting
• PyCon US 2027 design and planning
• Began PyCon US 2028/2029 RFP and selection process

3.3   Laura Graves

• Ongoing accounting activities
  • Investment meeting with PNC regarding what to do with idle funds
  • Review of grants program reopening documentation
  • Working with Kelly for donation pages for PyLadies NYC and PyLadies Vancouver
  • Work with Meetup to get account permissions moved from Phyllis to Marie/Laura
  • Work with Marie regarding members of our org giving tax advice on public platforms
  • Ongoing work with PNC and BoA to get Phyllis removed from bank accounts
  • Clean up work on YE 2025
  • AP System review with Sutro Li
  • Response to board treasurer regarding financial report request and grants program status
• PyPI
  • Orgs repricing research and discussions
  • New proposal idea review
  • UBIT analysis
  • Search for any documentation previously created about orgs
  • Contract review for orgs with current contracts up for renewal
  • PyPI ToS analysis
  • UBIT support documentation drafting
  • Stripe tax threshold notification review and correspondence with Legal regarding VAT/EU OSS registration obligations
• PyCon US
  • Legal and insurance work from 2026
  • California sales tax calculation and remittance
  • Sales tax documentation for why we didn’t charge/remit sales tax on certain line items
  • PyLadies Auction documentation for PyLadies
• Reporting
  • Registered Agent Renewals for Alabama, California, Colorado, Minnesota, and Wisconsin
• Human Resources
  • BCBS Illinois health and dental insurance renewal analysis, scenario modeling, and recommendation to leadership
  • Research and correction of payroll tax withholding coding error
  • JustWorks complaint documentation covering onboarding migration errors

3.4   Loren Crary

July report not provided.

3.5   Marie Nordin

• Program Administration
  • Fellows
  • Community Partner Program
  • Meetups
  • Office hours
• PSF Board & Python Packaging Elections
  • Revisiting 2025 retrospective and implementing changes in timeline and approach
  • Project management
  • Communications
  • Coordination of [psfmember.org](http://psfmember.org) & [python.org](http://python.org) updates
  • Resolving individual membership issues
• Grants
  • Proposal for special funding round
• Communications & promotion
  • Q2 newsletter
  • Supporting staff communications (blog posts, social posts)
  • Humble bundle
  • Meta 10 years of sponsorship
• Python Developers Survey
  • Coordination of review/analysis of 2026 data
  • Proposal for future of Python Developers Survey
• Future of wiki
  • Worked with Jacob on collecting community feedback
  • Prompting Board feedback
• PyCon US/PSF Booth
  • 1:1 calls with team members
• Strategic Plan
  • Promotion of community feedback/deadline
  • Compilation of community feedback
• D&I WG
  • Advising from PSF
  • Setting up D&I WG office hours with Georgi

3.6   Seth Larson

• United Nations Open Source Week
  • Led a session during the “Maintain-a-thon” about LLM “Vulnerability Flood”
  • Published a blog post: [https://sethmlarson.dev/un-open-source-week-2026](https://sethmlarson.dev/un-open-source-week-2026)
• Mitigated API authentication bypass
  • Blog post: [https://blog.python.org/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org/](https://blog.python.org/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org/)
  • Wrapped up the audit with Trail of Bits
• Open Sourced the “PSRT GHSA bot”
  • [https://github.com/python/psrt-ghsa-bot](https://github.com/python/psrt-ghsa-bot)
  • Added Sentry monitoring for alerting
• “Everything Security at PyCon US” blog post: [https://pyfound.blogspot.com/2026/06/everything-security-at-pycon-us-2026.html](https://pyfound.blogspot.com/2026/06/everything-security-at-pycon-us-2026.html)
• Discussion to improve the state of the PyPA Advisory Database
  • [https://github.com/pypa/advisory-database/issues/313](https://github.com/pypa/advisory-database/issues/313)
• Discussion to “Close” releases to new files on PyPI over time
  • [https://discuss.python.org/t/restricting-open-ended-releases-on-pypi/43566](https://discuss.python.org/t/restricting-open-ended-releases-on-pypi/43566)
• Promoted to a Python core developer:
  • [https://discuss.python.org/t/vote-to-promote-seth-larson/107622](https://discuss.python.org/t/vote-to-promote-seth-larson/107622)
• Created a tool for exporting data from GHSA for reporting metrics:
  • [https://github.com/sethmlarson/ghsa-cli](https://github.com/sethmlarson/ghsa-cli)
• Published advisories and CVE records for 4 advisories.
• Added a section on security backports to the security policy:
  • [https://devguide.python.org/security/policy/#when-are-security-fixes-released-or-backported](https://devguide.python.org/security/policy/#when-are-security-fixes-released-or-backported]

3.7   Mike Fiedler

• Malware Response
  • June's malware work was dominated by an active, coordinated campaign that published malicious packages across many accounts and projects.
  • Mike worked through it in batches over the second half of the month, prioritizing removal of the malicious releases,[advisories](https://github.com/pypa/advisory-database/pull/329) for the confirmed-malicious packages, and unblocking of the legitimate maintainers caught up in it.
  • Auto-quarantine contained most of the user-facing exposure automatically, blocking downloads ahead of manual review while Mike worked the longer tail of removals and follow-up.
  • Separately, Mike acted on a [report of leaked PyPI credentials from researchers at GitGuardian](https://blog.gitguardian.com/hunting-leaked-pypi-tokens-62-live-125-packages-exposed/), confirming which exposed tokens were still valid, invalidating the live ones, and notifying the affected account holders on PyPI.
  • This is the same long-lived-credential exposure that Trusted Publishing is designed to remove.
  • A 30-day snapshot shows the corroboration model working as intended.
  • Of 356 reports across 252 packages, the 182 corroborated by two or more independent observers were 100% accurate, against about 83% for single-observer reports.
  • That is what lets corroborated reports trigger action automatically, and roughly 77% of reported packages were auto-quarantined ahead of any manual review.
  • Mike also improved the tooling around malware response: extending [observer statistics to cover releases as well as projects](https://github.com/pypi/warehouse/pull/20225) now that quarantine can act at the release level, adding admin actions to [close sibling reports at once](https://github.com/pypi/warehouse/pull/20212) and [notify users when an API token is removed](https://github.com/pypi/warehouse/pull/20133), fixing two release-deletion admin bugs ([scope selector](https://github.com/pypi/warehouse/pull/20211), [multiple-versions POST](https://github.com/pypi/warehouse/pull/20222)), and adding a [trigger that clears orphaned release descriptions](https://github.com/pypi/warehouse/pull/20216).
  • He verified the [`pull_request_target` restriction](https://github.com/pypi/warehouse/pull/19601) for GitHub Trusted Publishers is enforced at upload.
  • Beyond the campaign advisories he published one for [`durabletask`](https://github.com/pypa/advisory-database/pull/310) and kept the advisory database current.
• Community Engagement and Conferences
  • June's community work centered on United Nations Open Source Week, where Mike [led a session on Trusted Publishing](https://miketheman.dev/files/Trusted-Publishing.pdf) at the Sovereign Tech Agency's Maintain-a-thon.
  • The message matched his May conference talks: the most reliable way to protect a publishing account is to remove the long-lived credential entirely.
  • He also engaged across the week's hallway track and supporting conversations, and attended AWS Summit NYC mid-month.
• Infrastructure and Hygiene
  • Routine maintenance kept the platform current and reduced risk:
    • Upgraded warehouse to [Python 3.14.6](https://github.com/pypi/warehouse/pull/20150)
    • Fixed [rate limiting on project creation](https://github.com/pypi/warehouse/pull/20163) and shipped a [performance improvement for the manage-project views](https://github.com/pypi/warehouse/pull/20218)
    • Continued a large, multi-step effort to [remove the `pretend` test-double library from the test suite](https://github.com/pypi/warehouse/pull/20182), a series of incremental refactors that retires a long-standing testing dependency and makes the suite easier to reason about.
    • Added an admin path to [release a prohibited project to an organization](https://github.com/pypi/warehouse/pull/20142), plus assorted template and styling fixes.
    • Shipped several Dependabot batches carrying security updates.
• Ecosystem Contributions
  • Beyond PyPI, Mike cut a [`readme-renderer` 45.0 release](https://github.com/pypa/readme_renderer/pull/360), contributed [build and tooling changes to `pyramid_openapi3`](https://github.com/Pylons/pyramid_openapi3/pull/312), and continued the [`wtforms` 3.3 migration](https://github.com/pallets-eco/wtforms/issues/922#issuecomment-4556806071) testing begun in May.

3.8   Jaime Barrera

• PyCon US 2026 Charlas recording review and edits

3.9   Jacob Coffee

July report not provided.

3.10   Maria Ashna

July report not provided.

3.11   Kelly Ragland

• PyCon US 2026 Revenue Recognition & Reconciliation (major undertaking)
  • Built the full journal entry package to recognize ~$950,000+ in PyCon US 2026 conference revenue out of the deferred revenue liability account (2500515), covering six months of collection (Dec 2025–May 2026):
  • Monthly reclassification JEs
  • The May 15, 2026 recognition JE
  • Monthly fee-reallocation JEs for class corrections
• Built a custom classification engine to route every revenue line item (registration, tutorials, donations, t-shirts, PyLadies auction bids, lead retrieval licenses, sales tax, table deposits) to the correct account and fiscal-sponsorship class.
• Built a reversal JE that precisely cancels QuickBooks' automatic Revenue Recognition entry for non-registration items only, leaving registration recognition intact — required identifying and correcting the QBO sub-accounts.
• Reconciled the full PyCon Registration Transaction Report against the JE source data by payout/charge ID — confirmed final reconciliation.
• Fixed issue in the sales-receipt routing script where certain refund descriptions were falling through to the wrong product category.
• Processed a Stripe reserve JE import (13 payouts) as a clean balance-sheet reclass with no P&L impact.
• Result: two Python scripts now fully automate manual journal entry work, producing ready-to-import QBO files plus a review summary reconciling back to Stripe's net-to-bank figures.
• Built a Python/QuickBooks REST API pipeline to correct ~138 mis-categorized PyCon US 2026 registration sales receipts, since no bulk-update existed for this. January's corrections completed.
• Collaborated with Laura, looking at how California sales tax applies to the full gross bid amount at silent auctions, with no deduction allowed for payment processor fees.
• Reconciled Dec-May Stripe account, identified issues in pipeline that resulted from PyCascades revenue flowing through that account (a separate PyCascades Stripe account was set up)
• Fiscal Sponsoree Support
  • Untangled a multi-year sponsor account history for sponsor: Kraken (fiscal sponsoree: PyLadies), spanning a 2023 unpaid invoice, a 2024 bad-debt write-off, an April 2025 wire payment, and a separate legitimate 2025 sponsorship payment — confirmed these were distinct transactions (not a duplicate) and current balance is $0.00. Produced a clean customer-facing statement for the sponsor.
  • Created a new Stripe connected account for PyLadies Vancouver under the PSF org umbrella, connected this to their LUMA account.
  • Provided regular AR Aging reporting for PyCon sponsorships.
  • Continued fundraiser tracking support for PyOhio and
  • Provided BAPYA (and sub groups) first financial report since 2023 (carried forward from June).
  • Set up donation pages for two PyLadies chapters.
  • Continued general maintenance/improvement on automated fiscal-sponsoree reporting.
• Vendor & Administrative Operations and Misc. Accounting
  • Resolved loss of admin access to Microsoft vendor supplier portal after both prior admins left the organization — escalated to vendor support and secured a new ticket with an active response window. (issue finally resolved – ticket opened in FEB 2026)
  • Investigated and resolved tax-threshold notices from a payment processor for two fiscal-sponsoree accounts (flagged in different countries); Laura has flagged VAT/OSS questions to tax counsel given PSF's role as fiscal sponsor across sponsoree accounts.
  • Reviewed a vendor's Supplier Code of Conduct attestation requirement (due August 19, 2026) and began a vendor registration for a new software vendor.
  • Investigate GSoC transaction booking— determining how amounts are recorded (account/class)
• CiviCRM Administration
  • Resolved a duplicate constituent record issues, confirming donation/membership history remained intact on the correct record.
  • Diagnosed and resolved a member-facing permissions issue affecting profile page visibility. (affecting multiple members)
  • Built a donation import workflow for paper-check donations (Excel template plus field-mapping process).
  • Took over moderation of the donor inbox following temp staff departure (Katie).
• Reporting Infrastructure Maintenance
  • Ongoing debugging of the CiviCRM/QBO reconciliation workbook — traced recurring pivot table display issues to how QBO exports data, plus several formula fixes.
  • Continued refinement of the underlying QBO reporting pipeline scripts, fixing multiple classification bugs including one affecting revenue recognition rows.
  • Workspace admin improvements: email routing for donation receipts, calendar accessibility, and document permissions troubleshooting.
• Sutro Li
  • As this is the first report from Sutro Li, this is for work completed from the beginning of the engagement through June 30, 2026. Future reports will cover one month at a time.
• Onboarding with Finance Team
  • Weekly Sutro Li and PSF Finance Team meetings
  • Set up financial accounts access for bank, credit card, investment and payroll accounts
  • Set up file sharing systems between Sutro Li and PSF
  • Collect accounting records needed for 2024 reconciliation of books to tax return
  • Collect accounting records needed to complete 2025 accounting
  • Complete DARCI matrix to identify division of accounting tasks
  • Meetings to discuss simplification of Chart of Accounts
  • Identify timeline for drafting 2027 budget
  • Assume Earth Class Mail management and related recordkeeping tasks
• Accounting and Finance
  • Prepare 1099 account list
  • Discuss 1042 filing requirements with Finance Team
  • CA sales tax research re: ticket sales with food, winning auction bids and gifted T-shirts
  • Set up automatic bank feeds in QBO for unsynced bank and credit card accounts, where software integration was allowed
  • Begin 2025 payroll reconciliation of books to quarterly 941s; identify variances
  • Schedule 2025 personnel allocations, to be posted after variances in payroll reconciliations are resolved
  • Record all missing transactions affecting cash and cash equivalents accounts in QBO for the period September 1, 2024 through December 31, 2025
  • Complete all bank account, investment account, credit card, PayPal and Stripe reconciliations through December 31, 2025
  • Create list of uncoded bank lines to resolve for Jan-May 2026
  • Begin review/revision of 2025 deferred revenue transactions
  • Schedule 2025 prepaid expenses
  • Prepare finance summary report and preliminary financials for June Board of Directors meeting

3.12   Abigail Mesrenyame Dogbe

July report not provided.

3.13   Sheena O'Connell

• PyConZA:
  • Fundraising
  • Website development
  • Budget wrangling
  • Team wrangling
• EoW: ramping up activity, focus on Python-related folks
• PSF:
  • board office hours
  • Caught Georgi up on retro (still need to finish this)
• PyConZim: finding ways PyConZA can support

3.14   Denny Perez

July report not provided.

3.15   Cristián Maureira-Fredes

July report not provided.

3.16   Simon Willison

July report not provided.

3.17   Jannis Leidel

July report not provided.

3.18   Georgi Ker

July report not provided.

3.19   KwonHan Bae

• PSF - participated in board discussions via Slack and email
• PSF - attended board meeting
• COMMUNITY : Python Asia Organize
• COMMUNITY : PyCon KR 2026 Organize
• COMMUNITY : Draft Supply Chain Attack in Korea and Japan

3.20   Tania Allard

July report not provided.

3.21   Cheuk Ting Ho

July report not provided.

3.22   Chris Neugebauer

July report not provided.

4.1   Code of Conduct

• Nothing to report at this time.

4.2   Grants

• Nothing to report at this time.

4.3   Sponsors

• Nothing to report at this time.

4.4   Marketing

• Nothing to report at this time.

4.5   Jobs

• Of the 561 Job submissions created in July 2026:
  • 206 have status approved
  • 4 have status archived
  • 29 have status draft
  • 128 have status expired
  • 96 have status rejected
  • 95 have status removed
  • 3 have status review

4.6   Trademarks

• Nothing to report

4.7   Fellows

• Nothing to report

4.8   Packaging

• Nothing to report

4.9   Infrastructure

• Nothing to report

4.10   Scientific Python

• Nothing to report

4.11   Diversity & Inclusion Work Group

• Nothing to report

6.1   Grants

• None at this time.

6.2   Sponsors

• None at this time.

6.3   Scientific Python

• None at this time.