chore(deps): bump the python-rust-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the python-rust-dependencies group with 6 updates in the /python directory:

Package	From	To
pyo3	0.26.0	0.29.0
geohash	0.13.1	0.13.2
serde_json	1.0.145	1.0.150
tempfile	3.23.0	3.27.0
thiserror	1.0.69	2.0.17
wkb	0.9.1	0.9.2

Updates pyo3 from 0.26.0 to 0.29.0

Release notes

Sourced from pyo3's releases.

PyO3 0.29.0

This release is a relatively large release with improvements across many areas of PyO3's API.

Build and packaging changes

This release brings full support for Python 3.15 beta. We encourage downstream projects to begin testing and distributing Python 3.15 beta wheels so that the ecosystem can prepare for the 3.15 final release later in the year.

Alongside Python 3.15 support comes support for its new "abi3t" stable ABI which supports both free-threaded and gil-enabled Python builds. For projects distributing stable ABI wheels, we recommend distributing (for each OS/architecture) an abi3 wheel built for your minimum supported Python version, a 3.14t version-specific wheel for free-threaded Python 3.14, and an abi3t wheel to support Python 3.15 (and future versions).

Support for Python 3.7 has been dropped. Support for Python 3.13t, the first experimental free-threaded release of CPython, has also been dropped. 3.14t (and soon 3.15t) is more stable, performant, and the starting point for CPython's own declaration of "support" for the free-threaded build.

The PyO3 build process (via the pyo3-build-config crate) has been adjusted to reduce the cost of rebuilds when the environment used to detect the Python interpreter changes; pyo3-build-config and pyo3-macros will no longer be rebuilt in such cases (although pyo3-ffi and crates downstream of it still will be rebuilt). As a consequence the pyo3_build_config APIs now require crates to have a direct dependency on pyo3 or pyo3-ffi. We hope to continue to reduce rebuild frequency and cost in a future PyO3 release.

Security updates

With the recent boom in AI-assisted security scanning, PyO3 has inevitably had several correctness issues exposed by AI-assisted scanning.

In particular, PyO3 0.29 fixes two security vulnerabilities we will be releasing to the RustSec Advisory Database imminently:

• Missing Sync bound on PyCFunction::new_closure closures
• Possible out of bounds read in BoundTupleIterator::nth_back and BoundListIterator::nth_back

Any code using the above APIs is advised to update as soon as possible.

This release also contains several other minor breaking changes to close soundness holes uncovered by AI-assisted scanning. Our assessment as maintainers was that, excluding the two vulnerability cases listed above, these correctness issues would likely have crashed immediately upon user testing rather than leading to attacker-exploitable pathways. We nevertheless wanted to see them closed without the usual deprecation cycle. These cases are noted in the migration guide.

Other major themes in this release

New in this release is a CLI in pyo3-introspection to generate type stubs along with the experimental-inspect feature. Downstream, maturin has also gained support to generate type stubs using the feature. The feature is reaching a point where substantial amount of type stubs can be generated automatically. We would like to encourage users to begin using this feature and helping us find what functionality is missing, with a hope we can declare its API stable given sufficient feedback.

A substantial amount of effort has been invested in pyo3-ffi as part of the process of extending it with 3.15's new APIs. There have been many missing APIs from older Python versions added. There have also been a number of fixes to incorrect definitions (these are breaking changes, but also necessary for correctness); we hope there will be far fewer such cases in the future due to more comprehensive checking added to PyO3's CI. Finally, many private CPython APIs (those with _Py underscore-named prefix) have been removed from pyo3-ffi's public API.

In closing

There are also many other incremental improvements, bug fixes and smaller features; full detail can be found in the CHANGELOG.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​Alc-Alc @​alex @​anuraaga @​BD103 @​bschoenmaeckers @​Cheukting @​chirizxc @​ChristopherRabotin @​clin1234 @​codeguru42 @​davidhewitt

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.29.0] - 2026-06-11

Packaging

• Support the new PEP 803 abi3t ABI with new abi3t and abi3t-py315 features. #5807
• pyo3-macros-backend no longer depends on pyo3-build-config. #5809
• Drop support for Python 3.13t (3.14t and above continue to be supported; CPython declared free-threading supported starting with Python 3.14). #5865
• Drop support for Python 3.7. #5912
• Extend range of supported versions of hashbrown optional dependency to include version 0.17. #5973
• Support Python 3.15.0b1. #6014
• pyo3-ffi is now no_std. #6022

Added

• Add PyErr::set_traceback to set the traceback of an exception object. #5349
• Add PyUnicodeDecodeError::new_err_from_utf8 to create a PyErr from a str::Utf8Error. #5668
• experimental-inspect: implement INPUT_TYPE and OUTPUT_TYPE on optional third-party crate conversions. #5770
• experimental-inspect: include doc comments in generated stubs. #5782
• Add pyo3_build_config::PythonAbi, pyo3_build_config::PythonAbiKind, pyo3_build_config::PythonAbiBuilder, pyo3_build_config::InterpreterConfig::target_abi, and pyo3_build_config::InterpreterConfigBuilder::target_abi. #5807
• Add Borrowed::get as an equivalent to Bound::get and Py::get. #5849
• Add PyFrame::new, PyTraceBack::new, and PyFrameMethods::line_number. #5857
• Add PyUntypedBuffer::obj to retrieve the Python object owning the buffer. #5870
• Add PyCapsule::new_with_value and PyCapsule::new_with_value_and_destructor. #5881
• Add PyErr::set_context and PyErr::context. #5887
• Add a small CLI to pyo3-introspection to generate stubs. #5904
• Add Python::version_str. #5921
• Add TryFrom<&Bound<T>> for PyRef<T>, PyRefMut<T>, PyClassGuard<T> and PyClassGuardMut<T>. #5922
• Add From<&Bound<T>> for Bound<T> and Py<T> #5922
• Add PyDictMethods::set_default and PyDictMethods::set_default_ref to allow atomically setting default values in a PyDict. #5955
• add PyFrameMethods::outer|code|var|builtins|globals|locals. #5967
• Add From conversions for PyErr from std::time::TryFromFloatSecsError, std::time::SystemTimeError, std::path::StripPrefixError, std::env::JoinPathsError, std::char::ParseCharError, and std::char::CharTryFromError. #6001
• Add pyo3_build_config::InterpreterConfigBuilder. #6034
• Add PyCapsule::import_pointer #6066
• Add PyClassGuardMapMut. #6073
• Expose PyListMethods::get_item_unchecked, PyTupleMethods::get_item_unchecked, and PyTupleMethods::get_borrowed_item_unchecked on abi3. #6075
• Add PyClassGuardMapSuper. #6104
• Add PyClassGuard and PyClassGuardMut to pyo3::prelude. #6112
• Add Debug impls for PyClassGuard and PyClassGuardMut. #6112
• Enable extending PyDateTime, PyDate, PyTime, PyDelta and PyTzInfo on abi3 with python 3.12+. #6115
• Expose PyFunction available on abi3. #6117
• FFI definitions:
  • Added FFI definitions PyUnstable_Object_IsUniquelyReferenced, PyUnstable_Object_IsUniquelyReferencedTemporary, PyUnstable_EnableTryIncref, and PyUnstable_TryIncref. #5828
  • Add FFI definitions ffi::PyErr_GetHandledException and ffi::PyErr_SetHandledException. #5887
  • Add FFI definition Py_HASH_SIPHASH13. #5891
  • Add FFI definition PyStructSequence_UnnamedField constant on Python 3.9 and up (or 3.11 with abi3 features). #5892
  • Add FFI definitions PyUnstable_InterpreterFrame_GetCode, PyUnstable_InterpreterFrame_GetLasti, PyUnstable_InterpreterFrame_GetLine, and PyUnstable_ExecutableKinds. #5932
  • Add FFI definitions PyMarshal_WriteLongToFile, PyMarshal_WriteObjectToFile, PyMarshal_ReadLongFromFile, PyMarshal_ReadShortFromFile, PyMarshal_ReadObjectFromFile, and PyMarshal_ReadLastObjectFromFile. #5934
  • Add FFI definitions PyObject_GetAIter, PyAIter_Check, PyMapping_HasKeyWithError, PyMapping_HasKeyStringWithError, PyMapping_GetOptionalItem, PyMapping_GetOptionalItemString, PySequence_ITEM, PySequence_Fast_GET_SIZE, PySequence_Fast_GET_ITEM, and PySequence_Fast_ITEMS. #5942
  • Add FFI definition compat::PyObject_HasAttrWithError. #5944
  • Add FFI definitions PyDict_SetDefault, PyDict_SetDefaultRef, PyDict_ContainsString, PyDict_Pop, PyDict_PopString, PyDict_ClearWatcher, PyDict_Watch, PyDict_Unwatch, and PyFrozenDict_New. #5947

... (truncated)

Commits

• 0f90242 release: 0.29.0 (#6107)
• cd128ed doc: mention abi3t, python3t.dll, and abi3t_compat folder in FAQ (#6124)
• 7e2ef18 Avoid type checks in methods where CPython already guarantees the received ty...
• f930199 docs: additional detail in migration guide for 0.29 (#6123)
• 91ab0d1 Enable Windows abi3t tests (#6106)
• fe0fdd5 add PyLong* API (3.14+) (#6016)
• f41b1df Hang when reattaching after detach during shutdown (#6085)
• 5ae66a8 Fix double import on RustPython (#6122)
• ad4a510 PyFunction: enable some extra tests with abi3 (#6118)
• c79ac0e ci: Add test for minimum supported debug build of Python (#5852)
• Additional commits viewable in compare view

Updates geohash from 0.13.1 to 0.13.2

Commits

• 3ebc8aa chore: bump version 0.13.2 (#61)
• 35569ae ci: update ci branch (#60)
• 5071969 ci: improve ci to cover no_std (#59)
• bb35ea7 Add no_std support (#58)
• d983f12 Fix typo in direction enum comment for East (#57)
• 7c538a2 fix: typos in src/core.rs comments (#56)
• 5211415 test: include an edge case (#55)
• 9f141fb Fix error in the comment (#51)
• See full diff in compare view

Updates serde_json from 1.0.145 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

v1.0.149

• Align arbitrary_precision number strings with zmij's formatting (#1306, thanks @​b41sh)

v1.0.148

• Update zmij dependency to 1.0

v1.0.147

• Switch float-to-string algorithm from Ryū to Żmij for better f32 and f64 serialization performance (#1304)

v1.0.146

• Set fast_arithmetic=64 for riscv64 (#1305, thanks @​Xeonacid)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Updates tempfile from 3.23.0 to 3.27.0

Changelog

Sourced from tempfile's changelog.

3.27.0

This release adds TempPath::try_from_path and deprecates TempPath::from_path.

Prior to this release, TempPath::from_path made no attempts to convert relative paths into absolute paths. The following code would have deleted the wrong file:

let tmp_path = TempPath::from_path("foo")
std::env::set_current_dir("/some/other/path").unwrap();
drop(tmp_path);

Now:

1. TempPath::from_path will attempt to convert relative paths into absolute paths. However, this isn't always possible as we need to call std::env::current_dir, which can fail. If we fail to convert the relative path to an absolute path, we simply keep the relative path.
2. The TempPath::try_from_path behaves exactly like TempPath::from_path, except that it returns an error if we fail to convert a relative path into an absolute path (or if the passed path is empty).

Neither function attempt to verify the existence of the file in question.

Thanks to @​meng-xu-cs for reporting this issue.

3.26.0

• Support NamedTempFile::persist on RedoxOS (#393) (thanks to @​Andy-Python-Programmer).

3.25.0

• Allow getrandom 0.4.x while retaining support for getrandom 0.3.x.

3.24.0

• Actually support WASIp2 without the nightly feature. This library is now feature complete on WASIp2 without any additional feature flags.
• Exclude CI scripts from the published crate.

Commits

• 5c8fa12 chore: release 3.27.0
• e34e574 test: disable uds conflict test on redox
• 772c795 test: add CWD guards
• 2632fb9 fix: resolve relative paths when constructing TempPath
• 929a112 chore: release 3.26.0
• 29d6ac5 Add Redox OS CI (#394)
• 375067f doc(README): document supported platforms
• d353717 feat(redox): implement persist() (#393)
• 64114d7 Fix typos in documentation (#392)
• 9a38b8d chore: release 3.25.0
• Additional commits viewable in compare view

Updates thiserror from 1.0.69 to 2.0.17

Release notes

Sourced from thiserror's releases.

2.0.17

• Use differently named __private module per patch release (#434)

2.0.16

• Add to "no-std" crates.io category (#429)

2.0.15

• Prevent Error::provide API becoming unavailable from a future new compiler lint (#427)

2.0.14

• Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#426)

2.0.13

• Documentation improvements

2.0.12

• Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

• Add feature gate to tests that use std (#409, #410, thanks @​Maytha8)

2.0.10

• Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

• Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

• Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

• Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @​zertosh)

2.0.6

• Suppress deprecation warning on generated From impls (#396)

2.0.5

• Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

• Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @​matt-phylum)

2.0.3

• Support the same Path field being repeated in both Debug and Display representation in error message (#383)
• Improve error message when a format trait used in error message is not implemented by some field (#384)

2.0.2

• Fix hang on invalid input inside #[error(...)] attribute (#382)

2.0.1

... (truncated)

Commits

• 72ae716 Release 2.0.17
• 599fdce Merge pull request #434 from dtolnay/private
• 9ec05f6 Use differently named __private module per patch release
• d2c492b Raise minimum tested compiler to rust 1.76
• fc3ab95 Opt in to generate-macro-expansion when building on docs.rs
• 819fe29 Update ui test suite to nightly-2025-09-12
• 259f48c Enforce trybuild >= 1.0.108
• 470e6a6 Update ui test suite to nightly-2025-08-24
• 544e191 Update actions/checkout@v4 -> v5
• cbc1eba Delete duplicate cap-lints flag from build script
• Additional commits viewable in compare view

Updates wkb from 0.9.1 to 0.9.2

Release notes

Sourced from wkb's releases.

v0.9.2

• Set up trusted publishing for crates.io (#89)
• Expose APIs for accessing the underlying WKB buffer. (#85, #88)
• Making structs for individual geometry types public. (#85)

Full Changelog: georust/wkb@v0.9.1...v0.9.2

Changelog

Sourced from wkb's changelog.

0.9.2 - 2025-11-21

• Set up trusted publishing for crates.io (#89)
• Expose APIs for accessing the underlying WKB buffer. (#85, #88)
• Making structs for individual geometry types public. (#85)
• Make hyperlinks in README clickable (#92)

Commits

• 2014885 chore: Prepare 0.9.2 (#90)
• f612014 chore: Set up crates.io trusted publishing (#89)
• 3158e62 fix: Making Wkb::buf() return slices containing only the WKB and trim the t...
• 130eb0c Expose APIs for accessing the underlying WKB buffer to implement various func...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions