chore(deps): bump pyo3 0.28 -> 0.29 (v0.7.1) - #33
Merged
Conversation
pyo3 0.28 carries two advisories, both fixed in 0.29: - RUSTSEC-2026-0176: out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators - RUSTSEC-2026-0177: missing `Sync` bound on `PyCFunction::new_closure` closures The binding touches neither API — it is one `#[pyfunction]` taking `&Bound<PyBytes>` — so this is not an exploitable path here. It still has to be fixed: `cargo audit` is a release-workflow job, and `github-release` depends on it, so the v0.7.0 run skipped release creation and every later release would too. `cargo audit` now exits 0 (the remaining rkyv `unsound` notice is an allowed warning). No source changes were needed for the pyo3 upgrade. Verified: 32 Rust tests, 197 fixture cases, clippy clean on stable for both feature sets, and the binding's encode / bytes / max_depth / delimiter paths by hand.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pyo3 0.28 carries two advisories, both fixed in 0.29:
nth/nth_backforPyListandPyTupleiteratorsSyncbound onPyCFunction::new_closureclosuresThe binding touches neither API (it is one
#[pyfunction]taking&Bound<PyBytes>), so this is not an exploitable path here.It still has to be fixed because it blocks releases:
cargo auditis a job inrelease.ymlandgithub-releasedepends on it, so the v0.7.0 run skipped release creation entirely and the release had to be assembled by hand. Every subsequent release would hit the same wall.cargo auditnow exits 0 — the remaining rkyvunsoundnotice (RUSTSEC-2026-0122, reached via sonic-rs) is an allowed warning, not a failure.Verification
No source changes were needed for the upgrade.
cargo test --no-default-features— 32 passpytest tests/test_spec_fixtures.py— 197 passcargo +stable clippy --all-targetsand--features python --all-targets— cleancargo audit— exit 0bytesfast path,max_depthrejection, anddelimitervalidation all behave as before