From bb3e1d1bb4ba1a61a6089da26f4aeb888bd4f504 Mon Sep 17 00:00:00 2001
From: coseto6125 <80243681+coseto6125@users.noreply.github.com>
Date: Sat, 1 Aug 2026 08:59:13 +0800
Subject: [PATCH] chore(deps): bump pyo3 0.28 -> 0.29 (v0.7.1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pyo3 0.28 carries two advisories, both fixed in 0.29:
- RUSTSEC-2026-0176: out-of-bounds read in `nth` / `nth_back` for `PyList` and
  `PyTuple` iterators
- RUSTSEC-2026-0177: missing `Sync` bound on `PyCFunction::new_closure` closures

The binding touches neither API — it is one `#[pyfunction]` taking `&Bound<PyBytes>`
— so this is not an exploitable path here. It still has to be fixed: `cargo audit`
is a release-workflow job, and `github-release` depends on it, so the v0.7.0 run
skipped release creation and every later release would too.

`cargo audit` now exits 0 (the remaining rkyv `unsound` notice is an allowed
warning). No source changes were needed for the pyo3 upgrade. Verified: 32 Rust
tests, 197 fixture cases, clippy clean on stable for both feature sets, and the
binding's encode / bytes / max_depth / delimiter paths by hand.
---
 Cargo.lock               | 23 +++++++++++------------
 Cargo.toml               |  4 ++--
 python/etoon/__init__.py |  2 +-
 3 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cd39741..f534d79 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -41,7 +41,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "etoon"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
  "itoa",
  "memchr",
@@ -187,9 +187,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.28.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12"
+checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c"
 dependencies = [
  "libc",
  "once_cell",
@@ -201,18 +201,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.28.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e"
+checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.28.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e"
+checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -220,9 +220,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.28.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813"
+checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -232,13 +232,12 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.28.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb"
+checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
  "quote",
  "syn",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 3b401af..ab363f9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "etoon"
-version = "0.7.0"
+version = "0.7.1"
 edition = "2021"
 description = "Fast TOON (Token-Oriented Object Notation) encoder tracking spec v4.1. Up to 7.6x faster than toons, 3.0-8.3x faster than the official TS SDK."
 license = "Apache-2.0"
@@ -26,7 +26,7 @@ default = []
 python = ["dep:pyo3"]
 
 [dependencies]
-pyo3 = { version = "0.28", features = ["extension-module"], optional = true }
+pyo3 = { version = "0.29", features = ["extension-module"], optional = true }
 sonic-rs = { version = "0.5.8", default-features = false }
 itoa = "1.0.18"
 ryu = "1.0.20"
diff --git a/python/etoon/__init__.py b/python/etoon/__init__.py
index 72af1af..1e93923 100644
--- a/python/etoon/__init__.py
+++ b/python/etoon/__init__.py
@@ -10,7 +10,7 @@
 
 from etoon._etoon import dumps_bytes as _dumps_bytes
 
-__version__ = "0.7.0"
+__version__ = "0.7.1"
 __all__ = ["dumps"]
 
 Delimiter = Literal[",", "\t", "|"]