Bump pyo3 from 0.28.3 to 0.29.1

[dependabot]

Bumps pyo3 from 0.28.3 to 0.29.1.

Release notes

Sourced from pyo3's releases.

PyO3 0.29.1

This patch is a stack of fixes for PyO3 0.29. Particular themes include:

• Fixes addressing build failures with newer interpreters such as GraalPy 3.13 and CPython 3.15
• Fixes resolving potential memory leaks inside #[pyclass] implementation internals
• Fixes to the new experimental-inspect type stub machinery

For a full list of the fixes in these above themes and more, please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​alex @​bschoenmaeckers @​chirizxc @​davidhewitt @​dependabot[bot] @​exg @​ImFeH2 @​IvanIsCoding @​jonasdedden @​MatthieuDartiailh @​msimacek @​ngoldbaum @​Person-93 @​ratazzi @​rewitt94 @​scott-griffiths @​ShiroKSH @​tobni @​Tpt @​WaterWhisperer

PyO3 0.29.0

This release is a relatively large release with improvements across many areas of PyO3's API.

Build and packaging changes

This release brings full support for Python 3.15 beta. We encourage downstream projects to begin testing and distributing Python 3.15 beta wheels so that the ecosystem can prepare for the 3.15 final release later in the year.

Alongside Python 3.15 support comes support for its new "abi3t" stable ABI which supports both free-threaded and gil-enabled Python builds. For projects distributing stable ABI wheels, we recommend distributing (for each OS/architecture) an abi3 wheel built for your minimum supported Python version, a 3.14t version-specific wheel for free-threaded Python 3.14, and an abi3t wheel to support Python 3.15 (and future versions).

Support for Python 3.7 has been dropped. Support for Python 3.13t, the first experimental free-threaded release of CPython, has also been dropped. 3.14t (and soon 3.15t) is more stable, performant, and the starting point for CPython's own declaration of "support" for the free-threaded build.

The PyO3 build process (via the pyo3-build-config crate) has been adjusted to reduce the cost of rebuilds when the environment used to detect the Python interpreter changes; pyo3-build-config and pyo3-macros will no longer be rebuilt in such cases (although pyo3-ffi and crates downstream of it still will be rebuilt). As a consequence the pyo3_build_config APIs now require crates to have a direct dependency on pyo3 or pyo3-ffi. We hope to continue to reduce rebuild frequency and cost in a future PyO3 release.

Security updates

With the recent boom in AI-assisted security scanning, PyO3 has inevitably had several correctness issues exposed by AI-assisted scanning.

In particular, PyO3 0.29 fixes two security vulnerabilities we will be releasing to the RustSec Advisory Database imminently:

• Missing Sync bound on PyCFunction::new_closure closures

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.29.1] - 2026-08-02

Changed

• Use the inline definition of Py_TYPE in the unlimited API on 3.14+ #6179

Fixed

• Fix incorrect pointer arithmetic in FFI definitions PyObject_GET_WEAKREFS_LISTPTR and PyHeapType_GET_MEMBERS. #6145
• Fix compilation error with nightly feature on PyPy and GraalPy due to !Ungil implementations for FFI types not available on those platforms. #6146
• Fix append_to_inittab and PyInit_<module> internal module definition corruption on 32-bit and big-endian platforms on Python 3.15+. #6150
• Fix return value of PyClassGuardMutSuper::as_super being scoped to the full guard lifetime, now the &mut borrow of the as_super() call. #6181
• Fix builds for free-threaded interpreters older than 3.15 erroring with "cannot set a minimum Python version" when an abi3t-py3* feature is enabled and the configuration comes from PYO3_CONFIG_FILE, sysconfigdata or cross-compilation defaults. #6192
• Fix a memory leak when deallocating #[pyclass(dict)] instances with a populated __dict__. #6198
• Fix an abort inside a #[pyclass]'s GC traversal when the traversal is stopped early. #6206
• Fix reference cycles through the __dict__ of a #[pyclass(dict)] never being collected. #6206
• Fix building on GraalPy 3.13. #6208
• Fix reference count leak of references to #[pyclass] type objects held by their instances on instance deallocation. #6224
• Fix FFI definitions PyByteArray_GET_SIZE, PyList_GET_SIZE, and PySet_GET_SIZE to use an atomic load for free-threaded Python. #6230
• Fix a memory leak on Python 3.11 and 3.12 where creating an instance of a #[pyclass(dict)] class leaked one empty dict per instance. #6234
• Fix experimental-inspect type stubs to emit the arguments of many magic methods as positional-only to match runtime behavior, rather than positional-or-keyword. #6239
• Fix experimental-inspect type stubs to emit the Python name rather than the Rust name for #[pyfunction(name = "...")]. #6254
• Fix experimental-inspect generating invalid internal JSON when #[pymodule] members are gated by #[cfg]. #6255
• Fix __inplace_concat__ and __inplace_repeat__ overriding __concat__ and __repeat__ when both were defined. #6260
• Fix conversion of out-of-range time::Duration values to return OverflowError instead of panicking. #6266
• Fix experimental-inspect type stubs padding blank lines inside indented docstrings. #6270

[0.29.0] - 2026-06-11

Packaging

• Support the new PEP 803 abi3t ABI with new abi3t and abi3t-py315 features. #5807
• pyo3-macros-backend no longer depends on pyo3-build-config. #5809
• Drop support for Python 3.13t (3.14t and above continue to be supported; CPython declared free-threading supported starting with Python 3.14). #5865
• Drop support for Python 3.7. #5912
• Extend range of supported versions of hashbrown optional dependency to include version 0.17. #5973
• Support Python 3.15.0b1. #6014
• pyo3-ffi is now no_std. #6022

Added

• Add PyErr::set_traceback to set the traceback of an exception object. #5349
• Add PyUnicodeDecodeError::new_err_from_utf8 to create a PyErr from a str::Utf8Error. #5668
• experimental-inspect: implement INPUT_TYPE and OUTPUT_TYPE on optional third-party crate conversions. #5770
• experimental-inspect: include doc comments in generated stubs. #5782
• Add pyo3_build_config::PythonAbi, pyo3_build_config::PythonAbiKind, pyo3_build_config::PythonAbiBuilder, pyo3_build_config::InterpreterConfig::target_abi, and pyo3_build_config::InterpreterConfigBuilder::target_abi. #5807
• Add Borrowed::get as an equivalent to Bound::get and Py::get. #5849
• Add PyFrame::new, PyTraceBack::new, and PyFrameMethods::line_number. #5857
• Add PyUntypedBuffer::obj to retrieve the Python object owning the buffer. #5870
• Add PyCapsule::new_with_value and PyCapsule::new_with_value_and_destructor. #5881

... (truncated)

Commits

• d7ad41f release: 0.29.1
• b55cb76 internal: Avoid parallel test triggered GC to interfere with test_gc.rs (#6238)
• ab81fe7 add an AI contributions policy (#6141)
• a1640ca pyo3-introspection Fixes wheel publishing (#6130)
• e7516f1 docs: mention maturin develop --release in quickstart (#6131)
• d185ecb experimental-inspect: don't pad blank docstring lines with the body indenta...
• e268e6d experimental-inspect: introspect #[pyfunction] under its Python name (#6254)
• 2505e48 experimental-inspect: emit positional-only arguments for slot-backed magic ...
• 2b66c50 internal: Remove IMPLEMENTS_INTOPYOBJECT parameter from PyClassGetterGenerato...
• 0dbb34d sync Requires Rust in pyo3-ffi\README.md, src\lib.rs with README.md (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)