[dependabot]

Bumps the rust group with 1 update in the / directory: pyo3.
Bumps the rust group with 2 updates in the /rust directory: serde_yaml and rand.

Updates pyo3 from 0.29.3 to 0.30.1

Release notes

Sourced from pyo3's releases.

PyO3 0.30.1 is a re-release of PyO3 0.30.0 after investments in CI security unfortunately led to a failed crates.io publish. Rather than delete the failed tag, this new tag comes after the CI issues have (hopefully) been corrected.

Thanks to @​davidhewitt @​Tpt and @​viicos for the investigation and fixes.

PyO3 0.30.0

This release brings confirmed testing against Python 3.15.0 final. Support for Python 3.8 has been dropped. The minimum supported Rust version has also been increased to 1.85.

The largest sets of improvements come to PyO3 0.29.0's experimental-inspect feature, which has received substantial feedback since 0.29.0 and subsequently has seen many refinements to improve the quality and coverage to the generated stubs. Thank you to everyone who has helped to continue to drive this feature towards completion.

New safe wrappers for PyFrozenDict (3.15+) and PyContext have been added.

PyO3 now contains meson build files, which should make it possible for projects using meson-python to more straightforwardly use Rust and PyO3 for additional components.

Additionally, a number of small optimizations have landed, including:

• simplifications to core implementations of PyAnyMethods,
• reduced overhead from PyO3's internal "reference pool" used to dispose of Py<T> values dropped when not attached to the interpreter,
• optimizations to num-bigint conversions, and
• better generated code from IntoPyObject and IntoPyObjectRef derives.

There are also many other incremental improvements, bug fixes and smaller features; full detail can be found in the CHANGELOG.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​adamgerhant-ai @​alex @​bschoenmaeckers @​charliermarsh @​chirizxc @​clin1234 @​davidhewitt @​dependabot[bot] @​dylanpulver @​elbaro @​exg @​florentinl @​FranciscoTGouveia @​Icxolu @​imfeh2 @​IvanIsCoding @​JMak-Security @​jonasdedden @​jorenham @​konstin @​latent-9 @​MatthieuDartiailh @​mattip @​mejrs @​msimacek

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.30.1] - 2026-10-14

Packaging

• Support PyPy 3.12. #6448

[0.30.0] - 2026-10-13

NB PyO3 0.30.0 failed to push to crates.io due to a CI issue, so 0.30.1 was prepared and pushed with minimal other changes other than confirming support for PyPy 3.12.

Packaging

• Drop support for Python 3.8. #6128
• Bump MSRV to 1.85. #6459
• Support meson-python as a build backend. #6483
• Bump minimum supported GraalPy version to 25.4. #6491
• Support Python 3.15.0 final. #6517

Added

• Add support for PyFrozenDict on 3.15+ #6174
• Add PyContext type. #6227
• experimental-inspect: classes which extend their base's instance layout are now decorated with disjoint_base in the generated stubs, as per PEP 800. #6362
• Add methods PyBuffer::as_slice_ptr and PyBuffer::as_fortran_slice_ptr. #6382
• Implement Copy for PyVisit. #6412
• Add non-poisoning variant of PyMutex #6437
• Add PyStringMethods::code_point_len. #6455
• FFI Definitions:
  • Add FFI definition PyThread_get_thread_ident. #6056
  • Add FFI definitions for PEP 731 (PyInitConfig). #6152
  • Add FFI definitions PyContext_AddWatcher and PyContext_ClearWatcher on Python 3.14+. #6204
  • Add FFI definitions for PEP 539 ("Thread-Specific Storage" API). #6262
  • Enable FFI definitions PyObject_GC_Track and PyObject_GC_UnTrack on PyPy. #6299
  • Add FFI definitions PyUnicode_DecodeMBCS, PyUnicode_DecodeMBCSStateful, PyUnicode_DecodeCodePagetateful, PyUnicode_AsMBCSString, PyUnicode_EncodeCodePage, and PyUnicode_Equal. #6349
  • Add FFI definitions PyFloat_Pack{2,4,8} and PyFloat_Unpack{2,4,8}. #6350
  • Add FFI definitions PyFunction_GET_CODE, PyFunction_GET_GLOBALS, PyFunction_GET_MODULE, PyFunction_GET_DEFAULTS, PyFunction_GET_KW_DEFAULTS, PyFunction_GET_CLOSURE, PyFunction_GET_ANNOTATIONS, PyClassMethod_Type, PyStaticMethod_Type, PyClassMethod_New, and PyStaticMethod_New. #6351

Changed

• Optimized num-bigint conversions on Python 3.14 and newer. #6144
• Change #[pyclass] to not emit FromPyObject implementation by default (this was previously deprecated). #6188
• Deprecate #[pyclass(skip_from_py_object)] option (as it is now the default). #6188
• Deprecate pyo3_build_config::PythonAbi::from_build_env in favor of pyo3_build_config::PythonAbi::from_stable_abi. #6192
• Change pyo3_build_config::InterpreterConfig::from_sysconfigdata to no longer select a target ABI based on the content of abi3 or abi3t cargo features (it will now always select a version-specific ABI). #6192
• Optimize PyO3's internal reference pool used for disposal of Py<T> values dropped when not attached to the Python interpreter. #6200
• experimental-inspect: Emit __all__ for complete modules in the type stubs. #6242
• Change PyBytes::new_with_writer to take &mut PyBytesWriter instead of &mut dyn Write. #6251
• Change #[pymodule_init] to allow functions which do not take a module argument (for experimental-inspect, such modules are not marked Incomplete). #6271
• Change #[pymodule_init] to optionally allow functions to take a Python<'_> marker. #6271

... (truncated)

Commits

• f168538 release: 0.30.1
• b3c7361 pyo3-introspection sdist: skip maturin license lookup (#6528)
• b564d8c ci: require Cargo.lock to be up to date during testing (#6522)
• bbd862c support PyPy 3.12 (#6448)
• 196ca35 release: 0.30.0 (#6493)
• d3befaa remove all functionality deprecated in PyO3 0.28 (#6519)
• 3ee4e56 experimental-inspect: emit __all__ in the generated stubs (#6242)
• 071edec test against 3.15 final (#6517)
• 4c68d9c internal: remove no longer needed non_local_definitions allows (#6508)
• 65c8c7d Add example building with meson-python (#6483)
• Additional commits viewable in compare view

Updates serde_yaml from 0.8.26 to 0.9.34+deprecated

Release notes

Sourced from serde_yaml's releases.

0.9.34

As of this release, I am not planning to publish further versions of serde_yaml as none of my projects have been using YAML for a long time, so I have archived the GitHub repo and marked the crate deprecated in the version number. An official replacement isn't designated for those who still need to work with YAML, but https://crates.io/search?q=yaml&sort=relevance and https://crates.io/keywords/yaml has a number of reasonable-looking options available.

0.9.33

• Fix quadratic parse time for YAML containing deeply nested flow collections (dtolnay/unsafe-libyaml#26)

0.9.32

• Fix unused_imports warnings when compiled by rustc 1.78

0.9.31

• Add swap_remove and shift_remove methods on Mapping (#408)

0.9.30

• Update proc-macro2 to fix caching issue when using a rustc-wrapper such as sccache

0.9.29

• Turn on deny(unsafe_op_in_unsafe_fn) lint

0.9.28

• Update unsafe-libyaml dependency to pull in unaligned write fix

0.9.27

• Always serialize serde_yaml::Number containing NaN as a positive NaN (#394)

0.9.26

• Guarantee that .nan is deserialized as a positive NaN (#392, #393)

0.9.25

• Serialize using quoted style around scalar that has digits with leading zero (#347)

0.9.24

• Implement FromStr for serde_yaml::Number (#381)

0.9.23

• Documentation improvements

0.9.22

• Update indexmap dependency to version 2

0.9.21

• Make Tag::new panic if given empty string, since YAML has no syntax for an empty tag

0.9.20

• Allow an empty YAML document to deserialize to None or Value::Null, in addition to the previously supported empty vector, empty map, and struct with no required fields

0.9.19

• Fix message duplication between serde_yaml::Error's Display and source() (#359, #360)

0.9.18

• Add support for emitting Unicode characters over codepoint U+FFFF (#356)

... (truncated)

Commits

• 2009506 Release 0.9.34
• 3ba8462 Add unmaintained note
• 77236b0 Ignore dead code lint in tests
• f4c9ed9 Release 0.9.33
• b4edaee Pull in yaml_parser_fetch_more_tokens fix from libyaml
• 8a5542c Resolve non_local_definitions warning in test
• ea57d8c Release 0.9.32
• a52b7ac Resolve prelude redundant import warnings
• 9e0b8d3 Replace curly quotes with ascii straight quotes
• 2a77483 Release 0.9.31
• Additional commits viewable in compare view

Updates rand from 0.9.5 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)

... (truncated)

Commits

• 9e7d328 Prepare rand 0.10.3 (#1840)
• f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
• ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
• c994eb1 docs: fix angle unit in quick start example (#1839)
• 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
• 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
• bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
• 521fab6 Stop pinning dependencies (#1820)
• 3f7c433 Stop pinning dependencies
• cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Files with missing lines	Coverage Δ
lerna/tests/test_rust_integration.py	100.00% <100.00%> (ø)

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Test Results

3 323 tests  +12   3 111 ✅ +12   8m 32s ⏱️ + 3m 53s
    2 suites ± 0     212 💤 ± 0 
    2 files   ± 0       0 ❌ ± 0 

Results for commit 8e24936. ± Comparison against base commit a0af05b.