fix(deps): bump pyo3 + numpy 0.27 → 0.29 (security)

[Fieldnote-Echo]

Security: PyO3 0.27 → 0.29

Resolves two GitHub/RustSec advisories on the Python binding manifests (ordvec-python, ordvec-manifest-python, Cargo.lock):

Advisory	Severity	Issue
GHSA-36hh-v3qg-5jq4	high	OOB read in nth/nth_back for PyList/PyTuple iterators (< 0.29.0)
GHSA-chgr-c6px-7xpp	medium	Missing Sync bound on PyCFunction::new_closure closures (< 0.29.0)

numpy (rust-numpy) moves to 0.29.0 in lockstep — it tracks pyo3's minor line and requires pyo3 ^0.29.

Why this is a clean bump

• No binding code changes. The bindings already use the modern Bound<> API; the deprecated into_py/IntoPy calls still compile warning-free under 0.29.
• Core crate unaffected — pyo3 is binding-only (the deps no-system-deps gate is -p ordvec-scoped).
• MSRV preserved — pyo3 0.29 floors at Rust 1.83, well under our 1.89 AVX-512 floor.

Validation (local, mirrors the binding gate)

• cargo clippy -p ordvec-python --all-targets -- -D warnings ✅
• cargo clippy -p ordvec-manifest-python --all-targets -- -D warnings ✅
• cargo fmt -p ordvec-python -p ordvec-manifest-python --check ✅
• cargo build --locked -p ordvec (core, new lock) ✅
• maturin develop → builds ordvec-0.5.0-cp310-abi3-linux_x86_64.whl ✅
• pytest ordvec-python/tests → 510 passed ✅

Scope: dependency bump only; no public API or core changes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[qodo-code-review]

PR Summary by Qodo

Bump PyO3 + rust-numpy to 0.29.0 for Python bindings (security)
🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

Walkthroughs

Description

• Bump PyO3 to 0.29.0 in both Python binding crates to address advisories.
• Bump rust-numpy to 0.29.0 to stay aligned with PyO3’s minor line.
• Keep abi3-py310 extension-module configuration unchanged; no binding code changes.

Diagram

graph TD
  A["ordvec-python (binding)"] --> B{{"PyO3 0.29"}} --> E{{"Python abi3"}}
  A --> C{{"rust-numpy 0.29"}}
  D["ordvec-manifest-python (binding)"] --> B

Loading

High-Level Assessment

The chosen approach (bumping PyO3/rust-numpy minor line in binding manifests) is the most direct and maintainable way to resolve security advisories. Alternatives like pinning only Cargo.lock or attempting a backport/fork would be fragile for fresh builds and increase long-term maintenance cost.

File Changes

Other (2)

Cargo.toml Bump PyO3 to 0.29.0 for manifest Python bindings +1/-1

Bump PyO3 to 0.29.0 for manifest Python bindings

• Updates the PyO3 dependency from 0.27.0 to 0.29.0 while keeping the extension-module and abi3-py310 features unchanged.

ordvec-manifest-python/Cargo.toml

---

Cargo.toml Bump PyO3 and rust-numpy to 0.29.0 for Python bindings +2/-2

Bump PyO3 and rust-numpy to 0.29.0 for Python bindings

• Updates the PyO3 dependency from 0.27.0 to 0.29.0 and bumps rust-numpy from 0.27.0 to 0.29.0 to stay compatible with the PyO3 minor line.

ordvec-python/Cargo.toml

---

[gemini-code-assist]

Code Review

This pull request upgrades the pyo3 and numpy dependencies to version 0.29.0 across the workspace packages, including ordvec-manifest-python and ordvec-python. Consequently, unused dependencies such as indoc, memoffset, and unindent have been removed from Cargo.lock. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!