[dependabot]

Bumps the example-cargo group with 1 update in the /crates/bashkit-python/test-fixtures/random-fs directory: pyo3.
Bumps the example-cargo group with 1 update in the /examples/hyperlight directory: wit-bindgen.

Updates pyo3 from 0.29.3 to 0.30.1

Release notes

Sourced from pyo3's releases.

PyO3 0.30.1 is a re-release of PyO3 0.30.0 after investments in CI security unfortunately led to a failed crates.io publish. Rather than delete the failed tag, this new tag comes after the CI issues have (hopefully) been corrected.

Thanks to @​davidhewitt @​Tpt and @​viicos for the investigation and fixes.

PyO3 0.30.0

This release brings confirmed testing against Python 3.15.0 final. Support for Python 3.8 has been dropped. The minimum supported Rust version has also been increased to 1.85.

The largest sets of improvements come to PyO3 0.29.0's experimental-inspect feature, which has received substantial feedback since 0.29.0 and subsequently has seen many refinements to improve the quality and coverage to the generated stubs. Thank you to everyone who has helped to continue to drive this feature towards completion.

New safe wrappers for PyFrozenDict (3.15+) and PyContext have been added.

PyO3 now contains meson build files, which should make it possible for projects using meson-python to more straightforwardly use Rust and PyO3 for additional components.

Additionally, a number of small optimizations have landed, including:

• simplifications to core implementations of PyAnyMethods,
• reduced overhead from PyO3's internal "reference pool" used to dispose of Py<T> values dropped when not attached to the interpreter,
• optimizations to num-bigint conversions, and
• better generated code from IntoPyObject and IntoPyObjectRef derives.

There are also many other incremental improvements, bug fixes and smaller features; full detail can be found in the CHANGELOG.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​adamgerhant-ai @​alex @​bschoenmaeckers @​charliermarsh @​chirizxc @​clin1234 @​davidhewitt @​dependabot[bot] @​dylanpulver @​elbaro @​exg @​florentinl @​FranciscoTGouveia @​Icxolu @​imfeh2 @​IvanIsCoding @​JMak-Security @​jonasdedden @​jorenham @​konstin @​latent-9 @​MatthieuDartiailh @​mattip @​mejrs @​msimacek

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.30.1] - 2026-10-14

Packaging

• Support PyPy 3.12. #6448

[0.30.0] - 2026-10-13

NB PyO3 0.30.0 failed to push to crates.io due to a CI issue, so 0.30.1 was prepared and pushed with minimal other changes other than confirming support for PyPy 3.12.

Packaging

• Drop support for Python 3.8. #6128
• Bump MSRV to 1.85. #6459
• Support meson-python as a build backend. #6483
• Bump minimum supported GraalPy version to 25.4. #6491
• Support Python 3.15.0 final. #6517

Added

• Add support for PyFrozenDict on 3.15+ #6174
• Add PyContext type. #6227
• experimental-inspect: classes which extend their base's instance layout are now decorated with disjoint_base in the generated stubs, as per PEP 800. #6362
• Add methods PyBuffer::as_slice_ptr and PyBuffer::as_fortran_slice_ptr. #6382
• Implement Copy for PyVisit. #6412
• Add non-poisoning variant of PyMutex #6437
• Add PyStringMethods::code_point_len. #6455
• FFI Definitions:
  • Add FFI definition PyThread_get_thread_ident. #6056
  • Add FFI definitions for PEP 731 (PyInitConfig). #6152
  • Add FFI definitions PyContext_AddWatcher and PyContext_ClearWatcher on Python 3.14+. #6204
  • Add FFI definitions for PEP 539 ("Thread-Specific Storage" API). #6262
  • Enable FFI definitions PyObject_GC_Track and PyObject_GC_UnTrack on PyPy. #6299
  • Add FFI definitions PyUnicode_DecodeMBCS, PyUnicode_DecodeMBCSStateful, PyUnicode_DecodeCodePagetateful, PyUnicode_AsMBCSString, PyUnicode_EncodeCodePage, and PyUnicode_Equal. #6349
  • Add FFI definitions PyFloat_Pack{2,4,8} and PyFloat_Unpack{2,4,8}. #6350
  • Add FFI definitions PyFunction_GET_CODE, PyFunction_GET_GLOBALS, PyFunction_GET_MODULE, PyFunction_GET_DEFAULTS, PyFunction_GET_KW_DEFAULTS, PyFunction_GET_CLOSURE, PyFunction_GET_ANNOTATIONS, PyClassMethod_Type, PyStaticMethod_Type, PyClassMethod_New, and PyStaticMethod_New. #6351

Changed

• Optimized num-bigint conversions on Python 3.14 and newer. #6144
• Change #[pyclass] to not emit FromPyObject implementation by default (this was previously deprecated). #6188
• Deprecate #[pyclass(skip_from_py_object)] option (as it is now the default). #6188
• Deprecate pyo3_build_config::PythonAbi::from_build_env in favor of pyo3_build_config::PythonAbi::from_stable_abi. #6192
• Change pyo3_build_config::InterpreterConfig::from_sysconfigdata to no longer select a target ABI based on the content of abi3 or abi3t cargo features (it will now always select a version-specific ABI). #6192
• Optimize PyO3's internal reference pool used for disposal of Py<T> values dropped when not attached to the Python interpreter. #6200
• experimental-inspect: Emit __all__ for complete modules in the type stubs. #6242
• Change PyBytes::new_with_writer to take &mut PyBytesWriter instead of &mut dyn Write. #6251
• Change #[pymodule_init] to allow functions which do not take a module argument (for experimental-inspect, such modules are not marked Incomplete). #6271
• Change #[pymodule_init] to optionally allow functions to take a Python<'_> marker. #6271

... (truncated)

Commits

• f168538 release: 0.30.1
• b3c7361 pyo3-introspection sdist: skip maturin license lookup (#6528)
• b564d8c ci: require Cargo.lock to be up to date during testing (#6522)
• bbd862c support PyPy 3.12 (#6448)
• 196ca35 release: 0.30.0 (#6493)
• d3befaa remove all functionality deprecated in PyO3 0.28 (#6519)
• 3ee4e56 experimental-inspect: emit __all__ in the generated stubs (#6242)
• 071edec test against 3.15 final (#6517)
• 4c68d9c internal: remove no longer needed non_local_definitions allows (#6508)
• 65c8c7d Add example building with meson-python (#6483)
• Additional commits viewable in compare view

Updates wit-bindgen from 0.62.0 to 0.63.0

Commits

• 29e0393 Release wit-bindgen 0.63.0 (#1748)
• 99dab3b Update wasm-tools dependencies (#1749)
• 1559c82 Don't cancel spawned rust tasks on component task cancel (#1743)
• 3e8e729 rust: preserve WASIp3 TLS for no-std task context (#1745)
• 1145d46 rust: Suppress wake notifications while destroying async tasks (#1740)
• 673e9d5 feat(moonbit): migrate generated manifests to modern formats (#1741)
• ac8ff51 Replace --async with --sync (#1730)
• e9590b4 chore: bump go-pkg version (#1738)
• 83d497f Export the versioned cabi_realloc on native targets (#1736)
• 687dbb8 Fix non-determinism in the order of with remappings (#1737)
• Additional commits viewable in compare view

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	2f06c3e	Commit Preview URL Branch Preview URL	Nov 07 2026, 01:58 PM

[bashkit-pr-reviewer]

Dependabot group bump (pyo3 0.29→0.30, wit-bindgen 0.62→0.63) is not safe to land as-is: the workspace pyo3 bump is not matched by its lockstep companion crate, which breaks the bashkit-python build. Details inline.

[bashkit-pr-reviewer]

[P0] pyo3 is bumped to 0.30 but pyo3-async-runtimes stays at 0.29, and the two must move in lockstep. pyo3-async-runtimes 0.29.x is built against pyo3 0.29 (pre-bump Cargo.lock resolves exactly one pyo3 0.29.3), so after this change the graph contains pyo3 0.29 and pyo3 0.30 side by side — and types from different versions of the same crate never unify. crates/bashkit-python inherits both from the workspace (crates/bashkit-python/Cargo.toml:20,44) and mixes them directly: async_bridge.rs:114-115 passes py: Python<'_> (now 0.30) into pyo3_async_runtimes::generic::get_current_locals, and lib.rs:83,94 aliases TaskLocals as CallerLoopLocals used with 0.30 PyObject/PyResult values. That is an E0308-style type mismatch and the crate will not compile. Fix: bump pyo3-async-runtimes to a 0.30-based release in the same change, or hold this bump until such a release exists.

[bashkit-pr-reviewer]

[P1] The root Cargo.lock was not regenerated for this manifest change: it still pins pyo3 0.29.3 (verified in the head snapshot) and is not among the PR's changed files, even though the sibling random-fs and hyperlight lockfiles were updated. CI runs several cargo ... --locked steps (e.g. .github/workflows/ci.yml:429,432 plus cargo vet --locked), which fail when the tracked lockfile is out of date with the workspace manifests. Fix: re-resolve and commit the updated root lockfile (cargo update -p pyo3 / cargo check to refresh) — after resolving the P0 above, since a correct resolve is only possible once the companion crate is aligned.

[bashkit-pr-reviewer]

Review summary — #2858 (dependabot pyo3 0.29→0.30 + wit-bindgen 0.62→0.63)

Verdict: request changes (unchanged after rebase onto 38d2c4c, head 2f06c3e). This push is again a rebase only — same 5 files, same shape (+85/-34). Both findings from the original review still stand, so no new inline comments were posted (same keys, already on the PR):

Findings (still open)

• [P0] pyo3-async-runtimes pinned at 0.29 while pyo3 moves to 0.30 → two pyo3 versions in one graph; Python<'_>/TaskLocals types don't unify where async_bridge.rs:114-115 and lib.rs:83 mix them. Re-verified at the new head (Cargo.toml:177-178 unchanged).
• [P1] Root Cargo.lock still pins pyo3 0.29.3 and is still absent from the changed files → --locked CI steps fail. Re-verified at the new head.

Context read beyond the diff (this push): refreshed snapshot at head 2f06c3e; root manifest/lockfile and the TaskLocals mixing sites unchanged in all relevant respects. Earlier context (CI on Rust 1.96 vs pyo3 0.30's MSRV 1.85, Python::attach already in use, abi3-py39 floor unaffected, isolated fixture/example workspaces with updated locks, knowledge files carrying no pinned pyo3 version) still applies.

Could not review: no build/test run possible here (reasoned from code only); registry state of a pyo3-0.30-compatible pyo3-async-runtimes release still unconfirmed — worth checking before re-rolling this bump.

[chaliy]

Superseded by #2852 - this bump cannot land alone: pyo3 0.30 collides on links=pyo3-python with jiter 0.17's pyo3 0.29 (and pyo3-async-runtimes 0.29), so resolution fails in every rust job. #2852 keeps your bumps and adds the required companions (jiter 0.18, pyo3-async-runtimes 0.30, whose required pyo3 deps move to ^0.30), removes the 8 now-deprecated skip_from_py_object options, and bumps the vet exemptions. Close this once #2852 lands.

[chaliy]

Analysed — this cannot merge as proposed, and #2876 + #2863 carry its content.

pyo3 0.30 here collides with jiter 0.17's pyo3 0.29 on links = pyo3-python, so cargo cannot select a version and every rust job fails at resolution. That is why 15 checks are red rather than any one test.

Landing pyo3 0.30 needs the companions the jump requires — jiter 0.18 (whose required pyo3 moves to ^0.30.1) and pyo3-async-runtimes 0.30 — which #2863 has. #2863 was itself blocked: jiter is declared in crates/bashkit-monty/Cargo.toml, and since #2861 the fork-drift check rejects any fork dependency differing from upstream Monty 1.4.0. #2876 adds the marker mechanism that makes a marked fork bump legal, so #2863 becomes landable on top of it.

wit-bindgen 0.62 → 0.63 in examples/hyperlight is independent of all of that and is also in #2863, so nothing here is dropped.

Closing once #2863 lands.

---

Generated by Claude Code

[chaliy]

Closing: this PR's content landed in #2863 (squashed as ddfa950), with the companions that made it resolvable.

pyo3 0.30 here collided with jiter 0.17's pyo3 ^0.29.2 on links = pyo3-python, so cargo could not select a version and every rust job failed before running anything. #2863 adds jiter 0.18 (required pyo3 ^0.30.1, verified against crates.io — the smallest release that resolves it) and pyo3-async-runtimes 0.30, leaving a single pyo3 0.30.1 in the lockfile.

That jiter bump edits a Monty fork manifest, which the drift check from #2861 rejects, so it needed the marker mechanism added in #2876 first. The chain was #2876 → #2863.

Also carried from here: syn 2 → 3 in the random-fs fixture, and the hyperlight/wit-bindgen 0.62 → 0.63 bump — nothing is dropped.

52 checks green on #2863, including the pytest matrix (3.9–3.14) and the CPython jobs, which are the real validation for a pyo3 major.

---

Generated by Claude Code