From 119682edfb73a3f0f91315061c6c9cd055468eb8 Mon Sep 17 00:00:00 2001
From: gabriel <admin@g4bri3l.de>
Date: Wed, 7 Oct 2026 13:52:45 +0200
Subject: [PATCH] fix(python): bump pyo3 to 0.29 for security advisories

pyo3 0.28.2 is compiled into the published wheels and is affected by two
advisories fixed in 0.29.0: an out-of-bounds read in PyList/PyTuple
iterator nth/nth_back (high), and a missing Sync bound on
PyCFunction::new_closure (medium). No source changes were needed.

Also refreshes the stale epaper-dithering-core entry in Cargo.lock
(4.0.1 -> 6.0.0, a path dependency).
---
 packages/python/Cargo.lock | 23 +++++++++++------------
 packages/python/Cargo.toml |  2 +-
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/packages/python/Cargo.lock b/packages/python/Cargo.lock
index 16694ee..19a6547 100644
--- a/packages/python/Cargo.lock
+++ b/packages/python/Cargo.lock
@@ -43,7 +43,7 @@ dependencies = [
 
 [[package]]
 name = "epaper-dithering-core"
-version = "4.0.1"
+version = "6.0.0"
 dependencies = [
  "rayon",
 ]
@@ -83,9 +83,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.28.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf85e27e86080aafd5a22eae58a162e133a589551542b3e5cee4beb27e54f8e1"
+checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655"
 dependencies = [
  "libc",
  "once_cell",
@@ -97,18 +97,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.28.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf94ee265674bf76c09fa430b0e99c26e319c945d96ca0d5a8215f31bf81cf7"
+checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.28.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "491aa5fc66d8059dd44a75f4580a2962c1862a1c2945359db36f6c2818b748dc"
+checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -116,9 +116,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.28.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d671734e9d7a43449f8480f8b38115df67bef8d21f76837fa75ee7aaa5e52e"
+checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -128,13 +128,12 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.28.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22faaa1ce6c430a1f71658760497291065e6450d7b5dc2bcf254d49f66ee700a"
+checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
  "quote",
  "syn",
 ]
diff --git a/packages/python/Cargo.toml b/packages/python/Cargo.toml
index 5d55a92..290c29e 100644
--- a/packages/python/Cargo.toml
+++ b/packages/python/Cargo.toml
@@ -9,4 +9,4 @@ crate-type = ["cdylib"]
 
 [dependencies]
 epaper-dithering-core = { path = "../rust/core" }
-pyo3 = { version = "0.28.2", features = ["extension-module"] }
+pyo3 = { version = "0.29", features = ["extension-module"] }