pypa/abi3audit

Some Python packages include pieces written in C for speed. When developers distribute these, they can use a special tag called "abi3" that promises the code will work across multiple future versions of Python without needing to be recompiled. Unfortunately, Python doesn't actually verify that promise, a package can slap the abi3 tag on without anyone checking that the code truly meets the requirements. That mismatch can cause crashes or even security holes down the line. abi3audit is a tool that scans these packages and flags the problem. The tool inspects the compiled files inside a Python package and checks every function call against a master list of what's actually allowed under the abi3 rules. If it finds a function that only became "stable" in Python 3.10, but the package is tagged as compatible with Python 3.6, it reports a mismatch. You can run it on a single compiled file, a packaged wheel, or an entire package's history on PyPI. It can print a readable summary or spit out a JSON report for automation. The primary audience is anyone who builds or maintains packages that use the abi3 tag, developers of Python extensions written in C, and the packaging infrastructure that serves those extensions to users. For example, if a maintainer tags their package as compatible with Python 3.7 forward but accidentally uses a C function that wasn't stabilized until 3.10, this tool would flag it before users on older Python versions hit mysterious crashes. The tool is honest about its blind spots. It can't catch tricks where an extension sneaks around the rules at runtime, and it doesn't have an exhaustive list of every forbidden function, instead it flags anything starting with "Py_" or "_Py_" that isn't on the approved list. That approach could rarely produce a false positive, but it's far safer than no checking at all. The recommendation is to scan entire packaged wheels rather than loose files, since wheels carry the metadata needed to know what the intended compatibility target actually was.