[dependabot]

Bumps the cargo group with 2 updates: pyo3 and rand.

Updates pyo3 from 0.29.2 to 0.29.3

Release notes

Sourced from pyo3's releases.

PyO3 0.29.3

This release is a series of fixes worth landing to the PyO3 0.29 series; the PyO3 0.30 release is planned to follow within a few weeks, however during the development cycle a number of rough edges were discovered which were deemed worth a backport.

The patch broadly includes:

• a further fix the to the opt-out of raw-dylib linking for Windows introduced in PyO3 0.29.1 (the switch to raw-dylib linking was introduced in PyO3 0.29.0),
• fixes to support GraalPy on windows,
• a handful of small performance optimizations,
• a number of non-breaking fixes to the experimental-inspect type stub generation (expect more improvements in 0.30), and
• various other bugfixes such as to FFI definitions, to resolve crashes, and to fix clippy lints caused by PyO3 macros.

For a full list of the exact fixes please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​adamgerhant-ai @​alex @​bschoenmaeckers @​charliermarsh @​chirizxc @​davidhewitt @​dependabot[bot] @​dylanpulver @​exg @​FranciscoTGouveia @​JMak-Security @​jonasdedden @​jorenham @​konstin @​latent-9 @​mejrs @​ngoldbaum @​Person-93 @​PeterFaiman @​sneakers-the-rat

Changelog

Sourced from pyo3's changelog.

[0.29.3] - 2026-09-30

Packaging

• Support GraalPy on Windows. #6406

Added

• Add FFI definitions PyModule_GetState_DuringGC, PyModule_GetToken_DuringGC, PyObject_GetTypeData_DuringGC, PyType_GetModuleState_DuringGC, PyType_GetBaseByToken_DuringGC, PyType_GetModule_DuringGC, and PyType_GetModuleByToken_DuringGC for Python 3.15 and up. #6419

Changed

• Optimize u128/i128 conversions on Python 3.15+. #6160
• Preallocate output sets when extracting Python set and frozenset values into Rust hash sets. #6225
• Optimize PyBytes::as_bytes() when not using abi3 or abi3t. #6377

Removed

• Remove FFI definitions PyExc_RecursionErrorInst and Py_UseClassExceptionsFlag (not present in supported Python versions). #6421

Fixed

• Revert removal of FFI definition _PyFrameEvalFunction, _PyInterpreterState_GetEvalFrameFunc and _PyInterpreterState_SetEvalFrameFunc, which are not currently treated as CPython private API despite their name. #6195
• Fix FFI definition PyUnstable_Eval_RequestCodeExtraIndex FFI binding to link to the private CPython symbol on Python versions before 3.12. #6195
• Fix FFI definitions PyByteArray_GET_SIZE, PyList_GET_SIZE, and PySet_GET_SIZE to use an atomic load for free-threaded Python. #6230
• experimental-inspect: deduplicate repeated members of a type union in the generated stubs, and put a space on both sides of the | rather than only before it. #6273
• experimental-inspect: __next__ and __anext__ returning Option<T> (or PyResult<Option<T>>) are now introspected as returning T, since None stops the iteration instead of being yielded. #6274
• Fix clippy::clone_on_copy warnings triggered on nightly Rust by #[pyclass(from_py_object)] on classes which implement Copy. #6309
• experimental-inspect: __pow__, __rpow__ and __get__ now introspect their trailing argument as defaulting to None, matching the CPython slot wrappers which substitute None when it is omitted. #6363
• experimental-inspect: fix the stubs of a package nested inside another package being written into a directory named after its parent instead of its own name. #6365
• Fix many unresolved symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6389
• Fix empty tuple type hints being rendered as invalid tuple[] instead of tuple[()] in generated stubs and PyStaticExpr display. #6393
• experimental-inspect: escape stub docstrings to prevent invalid Python syntax. #6394
• experimental-inspect: fix the generated type annotation for PyBuffer on python <3.12 by using typing_extensions.Buffer instead of collections.abc.Buffer. #6395
• Fix string constants containing control characters rendering as invalid Python in Display for PyStaticExpr. #6397
• Fix crash when a detached thread is terminated while trying to reattach during interpreter finalization. #6404
• Fix link failures on 32-bit Windows when raw-dylib linking is disabled. #6410
• Fix DLL load failures on Windows with PyPy when raw-dylib linking is disabled. #6410
• Fix FFI definition PyVectorcall_Call failing to link on Python 3.11 and older. #6410
• Fix many unresolved data symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6421
• Fix linker errors on PyPy for outdated FFI definitions where PyPy moved from a function to a macro. #6422
• Fix crash when GC traverses a #[pyclass] type object during class attribute initialization. #6453

Commits

• 451d99f release: 0.29.3
• a19b491 ci: Exclude the Python extensions article from guide checks (#6472)
• d76560a ci: exclude current release tag from link check (#6463)
• 91c0e7d fix crash with GC during attribute initialization (#6453)
• 9d467b1 only override env vars on Python 3.8
• 945e62a bump GraalPy versions tested in CI, test graalpy on windows (#6406)
• 9712753 fix 3.8 ffi checks
• 42a8fcc fix clippy lint (#6334)
• 018dbcc Add DuringGC FFI bindings for 3.15 (#6419)
• 75ada93 fix FFI cases where PyPy replaced function with macro (#6422)
• Additional commits viewable in compare view

Updates rand from 0.9.5 to 0.10.1

Changelog

Sourced from rand's changelog.

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)
• Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
• Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
• Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

• Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
• Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
• Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
• Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

• Removed ReseedingRng (#1722)
• Removed unused feature "nightly" (#1732)
• Removed feature small_rng (#1732)

#1632: rust-random/rand#1632 #1642: rust-random/rand#1642 #1649: rust-random/rand#1649 #1652: rust-random/rand#1652 #1653: rust-random/rand#1653 #1659: rust-random/rand#1659 #1665: rust-random/rand#1665 #1669: rust-random/rand#1669 #1674: rust-random/rand#1674 #1677: rust-random/rand#1677 #1693: rust-random/rand#1693 #1695: rust-random/rand#1695 #1697: rust-random/rand#1697

... (truncated)

Commits

• 27ff4cb Prepare v0.10.1: deprecate feature log (#1763)
• 98d0638 make_rng: document panic and add #[track_caller] (#1761)
• 54e5eaa Fix doc error (#1758)
• 1ce4c08 Bump itoa from 1.0.17 to 1.0.18 in the all-deps group (#1756)
• ccb734b docs: fix typo in doc comment (#1754)
• 357eb7d Bump libc from 0.2.182 to 0.2.183 in the all-deps group (#1753)
• 5e77fe5 Fix trait references in documentation (#1752)
• da89185 Bump the all-deps group with 3 updates (#1751)
• 50516ff Bump the all-deps group with 2 updates (#1749)
• fd71de9 Bump the all-deps group with 2 updates (#1747)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (0851006) to head (57fdb2e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #419   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           46        46           
  Lines         2584      2584           
=========================================
  Hits          2584      2584           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

The advertised direct rand upgrade is missing because Dataframely still uses 0.9.5, so either the upgrade and API migration must be completed or the PR title and description corrected.

No open issues 🎉

_{Review effort: Balanced}