chore(deps): update rust crate pyo3 to v0.28.2 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pyo3	dependencies	patch	0.28.0 → 0.28.2

GitHub Vulnerability Alerts

GHSA-47qc-857f-7w7f

PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.

It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.

PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.

---

Release Notes

pyo3/pyo3 (pyo3)

v0.28.2

Compare Source

Fixed

• Fix complex enum __qualname__ not using python name #​5815
• Fix FFI definition PyType_GetTypeDataSize (was incorrectly named PyObject_GetTypeDataSize). #​5819
• Fix memory corruption when subclassing native types with abi3 feature on Python 3.12+ (newly enabled in PyO3 0.28.0). #​5823

v0.28.1

Compare Source

Fixed

• Fix *args / **kwargs support in experimental-async feature (regressed in 0.28.0). #​5771
• Fix clippy::declare_interior_mutable_const warning inside #[pyclass] generated code on enums. #​5772
• Fix ambiguous_associated_items compilation error when deriving FromPyObject or using #[pyclass(from_py_object)] macro on enums with Error variant. #​5784
• Fix __qualname__ for complex #[pyclass] enum variants to include the enum name. #​5796
• Fix missing std::sync::atomic::Ordering import for targets without atomic64. #​5808

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.