fix: bump pyo3 to 0.29.0 to clear RUSTSEC-2026-0176 / 0177 - #25
Merged
Conversation
cargo audit flagged pyo3 0.27.1 with two advisories (both dated
2026-06-11), failing the daily Security Audit on main:
RUSTSEC-2026-0176 Out-of-bounds read in nth/nth_back for PyList/PyTuple iterators
RUSTSEC-2026-0177 Missing Sync bound on PyCFunction::new_closure closures
Fix version for both is >=0.29.0. pyo3 is an optional dep behind the
python-bindings feature; the existing bindings already use the modern
Bound API, so the bump is source-compatible.
Repro: cargo audit
After: cargo audit reports no vulnerabilities (exit 0); fuzz/ audit
also clean; cargo build/clippy/test --features python-bindings
all pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Code Coverage job (cargo tarpaulin, nightly toolchain) was failing to link with: rust-lld: error: undefined symbol: _PyEval_RequestCodeExtraIndex referenced by pyo3_ffi::cpython::ceval tarpaulin.toml set `all-features = true`, which enables the optional `python-bindings` feature and compiles src/python.rs into the coverage test binary, link-binding libpython. Under the nightly toolchain's rust-lld (now the default linker) the private CPython symbol does not resolve, so the binary fails to link. This is deterministic, not a flake — re-running the job reproduces it. The bindings are a thin PyO3 FFI shim that cannot be exercised from Rust tests (they need a live interpreter), so src/python.rs always scored 0/36 lines and contributed nothing measurable. The real Python surface is covered by the maturin-built pytest suite. Set `all-features = false` so coverage builds the default feature set. This drops the unlinkable FFI shim from the build graph and, by removing 36 uncoverable lines from the denominator, nudges reported coverage up (80.85% -> 81.71% locally) rather than down. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The daily Security Audit workflow on
mainhas been failing since ~6/19 becausecargo auditflaggedpyo3 0.27.1with two advisories published 2026-06-11:RUSTSEC-2026-0176— Out-of-bounds read innth/nth_backforPyListandPyTupleiteratorsRUSTSEC-2026-0177— MissingSyncbound onPyCFunction::new_closureclosuresThe advised fix floor for both is
>=0.29.0.Change
Bump
pyo30.27.1→0.29.0(Cargo.toml+Cargo.lock).pyo3is an optional dependency behind thepython-bindingsfeature; the existing bindings already use the modernBoundAPI, so the bump is source-compatible.Testing
cargo audit— exit 0 (root andfuzz/)cargo build --features python-bindings— cleancargo clippy --features python-bindings --all-targets— cleancargo test --features python-bindings— 20 tests + 6 doc-tests pass🤖 Generated with Claude Code