chore(deps): drop stale pyo3 advisory ignores resolved by 0.29#2125
Open
chaliy wants to merge 1 commit into
Open
chore(deps): drop stale pyo3 advisory ignores resolved by 0.29#2125chaliy wants to merge 1 commit into
chaliy wants to merge 1 commit into
Conversation
RUSTSEC-2026-0176 (OOB read in PyList/PyTuple iterators) and RUSTSEC-2026-0177 (missing Sync bound on PyCFunction::new_closure) were both patched in pyo3 >=0.29. The workspace now resolves pyo3 0.29.0 (and pyo3-async-runtimes 0.29.0) after #2122, so these advisory ignores in deny.toml are no longer needed — their own comments flagged them for removal on the 0.29 bump.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | d46f18f | Commit Preview URL Branch Preview URL |
Jun 26 2026, 09:15 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Remove two now-stale advisory ignores from
deny.toml:RUSTSEC-2026-0176— pyo3 OOB read inPyList/PyTuplenth/nth_backRUSTSEC-2026-0177— pyo3 missingSyncbound onPyCFunction::new_closureWhy
Both advisories were patched in pyo3 >= 0.29. The workspace now resolves
pyo3 0.29.0andpyo3-async-runtimes 0.29.0(after #2122), so these ignoresno longer match any advisory in the graph. Their own comments flagged them for
removal "on the pyo3 0.29 bump" — this is that follow-up.
The remaining ignores (
RUSTSEC-2023-0089atomic-polyfill,RUSTSEC-2026-0173proc-macro-error2) are unmaintained-transitive notices we can't control and are
kept.
How / Safety
deny.toml[advisories].ignoreis consulted only by the manualcargo deny check advisories(per AGENTS.md). CI's cargo-deny step runscheck licenses sourcesand cargo-audit carries its own ignore list, so thischange does not alter any CI gate — it removes config that no longer applies.
deny.tomlremains valid TOML and pyo3 resolves to 0.29.0 inCargo.lock.No code paths changed; config/hygiene only.
Generated by Claude Code