chore(deps): Update pyo3 requirement from 0.28 to 0.29 in /rust#537
chore(deps): Update pyo3 requirement from 0.28 to 0.29 in /rust#537dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [pyo3](https://github.com/pyo3/pyo3) to permit the latest version. - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](PyO3/pyo3@v0.28.0...v0.28.3) --- updated-dependencies: - dependency-name: pyo3 dependency-version: 0.28.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Superseded by #548, which bumps both |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps the Rust backend's pyo3 and numpy crates 0.28 -> 0.29 in lockstep (numpy 0.29 requires pyo3 ^0.29), resolving two RustSec advisories that affect pyo3 < 0.29: - RUSTSEC-2026-0176 (GHSA-36hh-v3qg-5jq4, High): out-of-bounds read in the PyList/PyTuple nth/nth_back iterators. - RUSTSEC-2026-0177 (GHSA-chgr-c6px-7xpp, Medium): missing Sync bound on PyCFunction::new_closure closures. Neither vulnerable path is reachable in this crate: the Rust source has no PyList/PyTuple iteration, no PyCFunction::new_closure, and builds no free-threaded wheels. This is a binding-layer-only change -- the math/RNG crates (ndarray 0.17, faer 0.24, rand 0.10, rand_xoshiro 0.8) are unchanged, and the Rust-backend bit-identity snapshot test confirms zero numerical drift. Supersedes Dependabot PRs igerber#537 (pyo3) and igerber#538 (numpy), which each bumped one crate alone and so could not resolve (the numpy/pyo3 version constraint couples them). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Updates the requirements on pyo3 to permit the latest version.
Release notes
Sourced from pyo3's releases.
Changelog
Sourced from pyo3's changelog.
... (truncated)
Commits
743af64release: 0.28.32042b4cfix deadlock when initializing enum viainto_pyobject()(#5928)0157247ci: update UI tests for Rust 1.94 (#5859)e234f8aUpdate getting-started.md (#5899)c06848dfix ffi-check in 3.15.0a7 (#5873)83f4283remove unusedtry_trait_v2feature when enabling thenightlyfeature (#5868)0de57edFix unsoundness inPyBytesWriter::write_vectored(#5907)49cd13ffixes #5900 -- address race condition with initialization and site.py loading...c90d163[fix] Fixstd::ffiimport for_Py_NegativeRefcount(#5847)b79d725fix(pyo3-macros): allow pyclass named Probe (#5837)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)