[deps]: Update Rust crate pyo3 to 0.24.0 [SECURITY] #1226
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
Great job, no security vulnerabilities found in this Pull Request |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1226 +/- ##
=======================================
Coverage 10.17% 10.17%
=======================================
Files 19 19
Lines 1101 1101
=======================================
Hits 112 112
Misses 989 989 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This PR contains the following updates:
0.22.1->0.24.0GitHub Vulnerability Alerts
GHSA-pph8-gcv7-4qj5
PyString::from_objecttook&strarguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the&strdata and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).In PyO3 0.24.1 this function will now allocate a
CStringto guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes&CStrarguments.Release Notes
pyo3/pyo3 (pyo3)
v0.24.1Compare Source
This release is a security fix for the
PyString::from_objectmethod, which passed&strdata to the Python C API without checking for a terminating nul byte. All historical PyO3 versions are affected, and we recommend you upgrade if you are usingPyString::from_object. Thank you to @vthib for the report and @Dr-Emann for the fix. A RUSTSEC advisory will be published shortly.Aside from the security fix, this release contains a number of other non-breaking additions:
abi3-py313feature to support compiling with the Python 3.13 stable ABI.PyAnyMethods::getattr_optto get optional attributes without paying the cost of a Python exception when the attribute in question does not exist.PyInt::new.with_critical_section2for locking two objects at the same time on the free-threaded build.Option<&str>andOption<&T>(whereT: PyClass) function arguments no longer being permittedThere are also a few other small bug fixes for edge cases, mostly related to compile errors from PyO3's macro code.
Thank you to the following contributors for the improvements:
@bschoenmaeckers
@davidhewitt
@Dr-Emann
@emmagordon
@epontan
@Icxolu
@IvanIsCoding
@jelmer
@jonaspleyer
@ngoldbaum
@Owen-CH-Leung
@Tpt
@Trolldemorted
@XuehaiPan
v0.24.0Compare Source
Packaging
target-lexicondependency to 0.13. #4822jiffdependency to add conversions forjiffdatetime types. #4823inventoryversion to 0.3.5. #4954Added
PyIterator::sendmethod to allow sending values into a python generator. #4746PyCallArgstrait for passing arguments into the Python calling protocol. This enabled using a faster calling convention for certain types, improving performance. #4768#[pyo3(default = ...']option for#[derive(FromPyObject)]to set a default value for extracted fields of named structs. #4829#[pyo3(into_py_with = ...)]option for#[derive(IntoPyObject, IntoPyObjectRef)]. #4850PyThreadState_GetFrameandPyFrame_GetBack. #4866lastforBoundListIterator,BoundTupleIteratorandBorrowedTupleIterator. #4878Iterator::count()forPyDict,PyList,PyTuple&PySet. #4878nth,nth_back,advance_byandadvance_back_byforBoundTupleIterator#4897types.GenericAliasaspyo3::types::PyGenericAlias. #4917MutextExttrait to help avoid deadlocks with the GIL while locking astd::sync::Mutex. #4934#[pyo3(rename_all = "...")]option for#[derive(FromPyObject)]. #4941Changed
nth,nth_back,advance_byandadvance_back_byforBoundListIterator. #4810DerefToPyAnyin blanket implementations ofFrom<Py<T>>andFrom<Bound<'py, T>>forPyObject. #4593io::ErrorKind::IsADirectory/NotADirectoryto the corresponding Python exception on Rust 1.83+. #4747PyAnyMethods::calland friends now requirePyCallArgsfor their positional arguments. #4768PyObject_Vectorcall(Method)on the stable abi on 3.12+. #4853#[pyo3(from_py_with = ...)]now take a path rather than a string literal #4860PathBuf&Pathinto Pythonpathlib.Pathinstead ofPyString. #4925pthread_exittrying to acquire the GIL when the interpreter is shutting down. This mimics the Python 3.14 behavior and avoids undefined behavior and crashes. #4874Removed
DerefforPyAnyand other "native" types. #4593Fixed
PyIter_Sendto return aPySendResult. #4746v0.23.5Compare Source
Packaging
Fixed
__builtins__to__globals__in code executed byPython::py_run(was removed in PyO3 0.23.0). #4921v0.23.4Compare Source
Added
PyList::locked_for_each, which uses a critical section to lock the list on the free-threaded build. #4789pyo3_build_config::add_python_framework_link_argsbuild script API to set rpath when using macOS system Python. #4833Changed
datetime.foldto distinguish ambiguous datetimes when converting to and fromchrono::DateTime<Tz>(rather than erroring). #4791Fixed
py.allow_threadsGIL-switch when attempting to access contents of aPyErrwhich originated from Python (could lead to unintended deadlocks). #4766BoundDictIteratoron the free-threaded build. #4788BoundDictIteratoron the free-threaded build. #4788chrono::DateTime<Tz>to-Python conversion whenTzischrono_tz::Tz. #4790#[pyclass]not being able to be namedProbe. #4794abi3feature is enabled. #4806abi3feature is enabled. #4808r#boxinderive(FromPyObject). #4814#[pyclass]enum variants with more than 12 fields. #4832v0.23.3Compare Source
Packaging
python3-dll-adependency to 0.2.11. #4749Fixed
abi3features enabled. #4733generate-import-libfeature. #4749PYO3_CONFIG_FILEwould not reconfigure PyO3 for the new interpreter. #4758v0.23.2Compare Source
Added
IntoPyObjectExttrait. #4708Fixed
abi3orabi3-pyxxfeatures are enabled. #4719ambiguous_associated_itemslint error in#[pyclass]and#[derive(IntoPyObject)]macros. #4725v0.23.1Compare Source
Re-release of 0.23.0 with fixes to docs.rs build.
v0.23.0Compare Source
Packaging
hashbrownoptional dependency to include version 0.15. #4604eyreoptional dependency to 0.6.8. #4617hashbrownoptional dependency to 0.14.5. #4617indexmapoptional dependency to 2.5.0. #4617num-complexoptional dependency to 0.4.6. #4617chrono-tzoptional dependency to 0.10. #4617Added
IntoPyObject(fallible) conversion trait to convert from Rust to Python values. #4060#[pyclass(str="<format string>")]option to generate__str__based on aDisplayimplementation or format string. #4233PartialEqforBound<'py, PyInt>withu8,u16,u32,u64,u128,usize,i8,i16,i32,i64,i128andisize. #4317PartialEq<f64>andPartialEq<f32>forBound<'py, PyFloat>. #4348as_superandinto_supermethods forBound<T: PyClass>. #4351PyCFunctionFastandPyCFunctionFastWithKeywords#4415PyMutexon Python 3.13 and newer. #4421PyDict::locked_for_eachto iterate efficiently on freethreaded Python. #4439PyObject_GetOptionalAttr,PyObject_GetOptionalAttrString,PyObject_HasAttrWithError,PyObject_HasAttrStringWithError,Py_CONSTANT_*constants,Py_GetConstant,Py_GetConstantBorrowed, andPyType_GetModuleByDefon Python 3.13 and newer. #4447IntoPyObject. #4495Borrowed::as_ptr. #4520PyImport_AddModuleRef. #4529PyAnyMethods::try_iter. #4553pyo3::sync::with_critical_section, a wrapper around the Python Critical Section API added in Python 3.13. #4587#[pymodule(gil_used = false)]option to declare that a module supports the free-threaded build. #4588PyModule::gil_usedmethod to declare that a module supports the free-threaded build. #4588PyDateTime_CAPSULE_NAME. #4634PyMappingProxytype to represent themappingproxyPython class. #4644PyList_ExtendandPyList_Clear. #4667IntoPyObjectRef. #4674pyo3::sync::OnceExtandpyo3::sync::OnceLockExttraits. #4676Changed
IntoPyObjectoverIntoPy<Py<PyAny>>>for#[pyfunction]and#[pymethods]return types. #4060#[pyclass]and#[pyo3(..)]attributes. #4243#[pymodule]are automatically treated as submodules (noPyInit_entrypoint is created). #4308PyAnyMethods::is_ellipsis(Py::is_ellipsiswas deprecated in PyO3 0.20). #4322PyLongin favor ofPyInt. #4347IntoPyDict::into_py_dict_boundtoIntoPyDict::into_py_dict. #4388PyModule::from_codenow expects&CStras arguments instead of&str. #4404#[pyfunction]s when compiling on abi3 for Python 3.10 and up. #4415CopyandClonefromPyObjectstruct FFI definition. #4434Python::evalandPython::runnow take a&CStrinstead of&str. #4435IPowModulo,PyClassAttributeDef,PyGetterDef,PyMethodDef,PyMethodDefType, andPySetterDeffrom PyO3's public API. #4441IntoPyObjectimpls forVec<u8>,&[u8],[u8; N],Cow<[u8]>andSmallVec<[u8; N]>now convert into Pythonbytesrather than alistof integers. #4442IntoPyDict::into_py_dictis now fallible due toIntoPyObjectmigration. #4493abi3feature will now override config files provided viaPYO3_BUILD_CONFIG. #4497GILProtectedstruct on free-threaded Python. #4504PyListMethods::get_item_uncheckedon free-threaded Python. #4539GILOnceCell::import. #4542PyAnyMethods::iterin favour ofPyAnyMethods::try_iter. #4553#[pyclass]macro now requires a types to beSync. (Except for#[pyclass(unsendable)]types). #4566PyList::newandPyTuple::neware now fallible due toIntoPyObjectmigration. #4580PyErr::matchesis now fallible due toIntoPyObjectmigration. #4595ToPyObjectin favour ofIntoPyObject#4595PyWeakrefMethods::get_option. #4597PyWeakrefMethodstrait. #4598PyNativeTypeInitializerandPyObjectInitfrom the PyO3 public API. #4611IntoPyin favor ofIntoPyObject#4618PyErr::take()andPyErr::fetch()on Python 3.11 and older. #4655IntoPy::type_outputtoIntoPyObject::type_output. #4657PyMapping::keys,PyMapping::valuesandPyMapping::itemstoBound<'py, PyList>instead ofBound<'py, PySequence>. #4661IntoPyObjectby reference or by value together withClone. This makesPy<T>available as field type. #4694Removed
PyUnicodein favour ofPyString. #4370gil-refsfeature. #4378_Py_IMMORTAL_REFCNT,_Py_IsImmortal,_Py_TPFLAGS_STATIC_BUILTIN,_Py_Dealloc,_Py_IncRef,_Py_DecRef. #4447_Py_c_sum,_Py_c_diff,_Py_c_neg,_Py_c_prod,_Py_c_quot,_Py_c_pow,_Py_c_abs. #4521_borrowedmethods ofPyWeakRefandPyWeakRefProxy. #4528_PyErr_ChainExceptions. #4534Fixed
lib_dirwhen cross-compiling. #4389Py_Isfor PyPy on 3.10 to call the function defined by PyPy. #4447#[cfg]attributes for simple enum variants. #4509non_snake_casemethod names inside#[pymethods]generated code. #4567#[derive(FromPyObject)]generic struct with trait bounds. #4645#[classmethod]and#[staticmethod]on magic methods. #4654unsafe_op_in_unsafe_fnin generated macro code. #4674#[pyclass] enums with custom__eq__implementation. #4692non_upper_case_globalslint firing for generated__match_args__on complex enums. #4705v0.22.6: PyO3 0.22.6Compare Source
This release corrects the check for free-threaded Python introduced in PyO3 0.22.2 to prevent users accidentally installing PyO3 packages on Python 3.13t; PyO3 0.22 does not support free-threaded Python. (Stay tuned for the 0.23 release coming very soon!)
Thanks @minrk for the report and @davidhewitt for the fix!
v0.22.5Compare Source
Fixed
__clear__slot andclearmethod generated code. #4619Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.