From c8854346fc27c8b6371eb257135fe5c097f342fc Mon Sep 17 00:00:00 2001 From: Robert Kruszewski Date: Wed, 17 Jun 2026 12:16:37 +0100 Subject: [PATCH] Upgrade pyO3 to 0.29.0 Signed-off-by: Robert Kruszewski --- Cargo.lock | 37 +++++++++++++++++----------------- Cargo.toml | 6 +++--- deny.toml | 10 +-------- vortex-python/src/dtype/mod.rs | 2 +- 4 files changed, 23 insertions(+), 32 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2f0965f5a8e..5bedb6481c0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6841,9 +6841,9 @@ dependencies = [ [[package]] name = "pyo3" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12" +checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c" dependencies = [ "chrono", "indexmap 2.14.0", @@ -6857,9 +6857,9 @@ dependencies = [ [[package]] name = "pyo3-async-runtimes" -version = "0.28.0" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e7364a95bf00e8377bbf9b0f09d7ff9715a29d8fcf93b47d1a967363b973178" +checksum = "b3ef68daa7316a3fac65e5e18b2203f010346de1c1c53456811a2624673ab046" dependencies = [ "futures-channel", "futures-util", @@ -6871,18 +6871,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e" +checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078" dependencies = [ "target-lexicon", ] [[package]] name = "pyo3-bytes" -version = "0.6.0" +version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d98190ac733bf1c9a3bdbd2856d85abee243f16b7ef1155feefcd613c8704a1" +checksum = "48cdf1b63af76396b70e0eca2c0d8f157c73ee85b873ec4ae7c01f8e71eef112" dependencies = [ "bytes", "pyo3", @@ -6890,9 +6890,9 @@ dependencies = [ [[package]] name = "pyo3-ffi" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e" +checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b" dependencies = [ "libc", "pyo3-build-config", @@ -6900,9 +6900,9 @@ dependencies = [ [[package]] name = "pyo3-log" -version = "0.13.3" +version = "0.13.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26c2ec80932c5c3b2d4fbc578c9b56b2d4502098587edb8bef5b6bfcad43682e" +checksum = "f64083bd3a16a353d9d62335808e8e13d0552d2a2b83fdb084496192dcfa9fcd" dependencies = [ "arc-swap", "log", @@ -6911,9 +6911,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813" +checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -6923,22 +6923,21 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb" +checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362" dependencies = [ "heck", "proc-macro2", - "pyo3-build-config", "quote", "syn 2.0.117", ] [[package]] name = "pyo3-object_store" -version = "0.9.0" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b3056dc8a77db5d44d32e7f740db0b01e5b65a43d181487a6917576959c6eb9a" +checksum = "13aaa9b876f9b02773cc18fd03dd359bddf3ca21978068024511f166c9c0c6a5" dependencies = [ "async-trait", "bytes", diff --git a/Cargo.toml b/Cargo.toml index a587ef1db16..b700b72195c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -209,10 +209,10 @@ proc-macro2 = "1.0.95" prost = "0.14" prost-build = "0.14" prost-types = "0.14" -pyo3 = { version = "0.28.0" } -pyo3-bytes = "0.6" +pyo3 = { version = "0.29.0" } +pyo3-bytes = "0.7" pyo3-log = "0.13.0" -pyo3-object_store = "0.9.0" +pyo3-object_store = "0.11.0" quote = "1.0.44" rand = "0.10.1" rand_distr = "0.6" diff --git a/deny.toml b/deny.toml index 1e2443c1fd8..b9f9c79a796 100644 --- a/deny.toml +++ b/deny.toml @@ -16,15 +16,7 @@ ignore = [ # Paste is no longer maintained because its essentially "finished". "RUSTSEC-2024-0436", # proc-macro-error-2 is unmaintained, only used by the `test_with` test dependency - "RUSTSEC-2026-0173", - # Out-of-bounds read in `nth`/`nth_back` on pyo3 list/tuple iterators, fixed only in pyo3 - # 0.29.0. We cannot bump until pyo3-bytes, pyo3-log, and pyo3-object_store support 0.29 (all - # pin pyo3 to <0.29, and pyo3-ffi `links = "python"` forbids two pyo3 versions in the graph). - # Not exploitable here: `vortex-python` never calls `nth`/`nth_back` on these iterators. - "RUSTSEC-2026-0176", - # Another issue that will be fixed once we can bump pyo3 to 0.29. - # PyCFunction::new_closure is missing a `Sync` bound. - "RUSTSEC-2026-0177" + "RUSTSEC-2026-0173" ] [licenses] diff --git a/vortex-python/src/dtype/mod.rs b/vortex-python/src/dtype/mod.rs index f84059005aa..bea25c133c1 100644 --- a/vortex-python/src/dtype/mod.rs +++ b/vortex-python/src/dtype/mod.rs @@ -194,7 +194,7 @@ impl PyDType { #[classmethod] #[pyo3(signature = (arrow_dtype, *, non_nullable = false))] fn from_arrow<'py>( - cls: &'py Bound<'py, PyType>, + cls: &Bound<'py, PyType>, #[pyo3(from_py_with = import_arrow_dtype)] arrow_dtype: DataType, non_nullable: bool, ) -> PyResult> {