Update pyo3 to 0.29 to close three security advisories - #11
Merged
Conversation
The Python bindings pinned pyo3 0.22, which the dependency graph flags for an out-of-bounds read in the PyList and PyTuple iterators (high), a missing Sync bound on PyCFunction::new_closure (medium), and a buffer overflow in PyString::from_object (low), all fixed in 0.29.0. The only source change the bump needs is PyDict::new_bound, now spelled PyDict::new; the crate builds and links against pyo3 0.29.2 with abi3-py38 unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the three open Dependabot alerts on the Python bindings, all against
pyo3 < 0.29inbindings/python/Cargo.toml:nth/nth_backforPyListandPyTupleiteratorsSyncbound onPyCFunction::new_closureclosuresPyString::from_objectAll three are fixed in pyo3 0.29.0, so the pin moves
0.22to0.29.The only API change the bump needs is
PyDict::new_bound(py), which lost its_boundsuffix after 0.23 and is nowPyDict::new(py). Everything else (#[pymodule]over&Bound<PyModule>,wrap_pyfunction!,set_item,unbind) was already the modern Bound API and is unchanged.Verified locally: the crate compiles and links against pyo3 0.29.2 with
abi3-py38unchanged (a full extension-module link on macOS, with-undefined dynamic_lookup).