[rpms/python-libcst] epel10: Update PyO3 to 0.29 (fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177)

[rpms/python-libcst] epel10: Update PyO3 to 0.29 (fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177)

[Benjamin A. Beasley]

A new commit has been pushed.

Repo   : rpms/python-libcst
Branch : epel10
Commit : db088fe57b9585779fd5612c2a1cf6975c6a62fa
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date   : 2026-07-07T11:45:05+01:00
Stats  : +41/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/python-libcst/c/db088fe57b9585779fd5612c2a1cf6975c6a62fa?branch=epel10

Log:
Update PyO3 to 0.29 (fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177)

---
diff --git a/libcst-1.8.6-pyo3-0.28.patch b/libcst-1.8.6-pyo3-0.28.patch
new file mode 100644
index 0000000..ebc1a6c
--- /dev/null
+++ b/libcst-1.8.6-pyo3-0.28.patch
@@ -0,0 +1,26 @@
+diff --git a/native/libcst_derive/src/into_py.rs b/native/libcst_derive/src/into_py.rs
+index f5470aa17..bdd8b02d3 100644
+--- a/native/libcst_derive/src/into_py.rs
++++ b/native/libcst_derive/src/into_py.rs
+@@ -69,8 +69,8 @@ fn impl_into_py_enum(ast: &DeriveInput, e: &DataEnum) -> TokenStream {
+     let gen = quote! {
+         use pyo3::types::IntoPyDict as _;
+         #[automatically_derived]
+-        impl#generics crate::nodes::traits::py::TryIntoPy<pyo3::PyObject> for #ident #generics {
+-            fn try_into_py(self, py: pyo3::Python) -> pyo3::PyResult<pyo3::PyObject> {
++        impl#generics crate::nodes::traits::py::TryIntoPy<pyo3::Py<pyo3::PyAny>> for #ident #generics {
++            fn try_into_py(self, py: pyo3::Python) -> pyo3::PyResult<pyo3::Py<pyo3::PyAny>> {
+                 match self {
+                     #(#toks)*
+                 }
+@@ -87,8 +87,8 @@ fn impl_into_py_struct(ast: &DeriveInput, e: &DataStruct) -> TokenStream {
+     let gen = quote! {
+         use pyo3::types::IntoPyDict as _;
+         #[automatically_derived]
+-        impl#generics crate::nodes::traits::py::TryIntoPy<pyo3::PyObject> for #ident #generics {
+-            fn try_into_py(self, py: pyo3::Python) -> pyo3::PyResult<pyo3::PyObject> {
++        impl#generics crate::nodes::traits::py::TryIntoPy<pyo3::Py<pyo3::PyAny>> for #ident #generics {
++            fn try_into_py(self, py: pyo3::Python) -> pyo3::PyResult<pyo3::Py<pyo3::PyAny>> {
+                 use pyo3::types::PyAnyMethods;
+                 let libcst = pyo3::types::PyModule::import(py, "libcst")?;
+                 let kwargs = #kwargs_toks ;

diff --git a/libcst-fix-metadata.diff b/libcst-fix-metadata.diff
index 5e85e61..3cb45bc 100644
--- a/libcst-fix-metadata.diff
+++ b/libcst-fix-metadata.diff
@@ -1,6 +1,15 @@
 diff -Naur libcst-1.8.6-original/native/libcst/Cargo.toml libcst-1.8.6/native/libcst/Cargo.toml
 --- libcst-1.8.6-original/native/libcst/Cargo.toml	2025-11-03 22:30:33.000000000 +0000
-+++ libcst-1.8.6/native/libcst/Cargo.toml	2026-07-07 11:32:33.767523717 +0100
++++ libcst-1.8.6/native/libcst/Cargo.toml	2026-07-07 11:42:02.016593437 +0100
+@@ -36,7 +36,7 @@
+ 
+ [dependencies]
+ paste = "1.0.15"
+-pyo3 = { version = "0.26", optional = true }
++pyo3 = { version = "0.29", optional = true }
+ thiserror = "2.0.12"
+ peg = "0.8.5"
+ annotate-snippets = "0.11.5"
 @@ -45,9 +45,7 @@
  libcst_derive = { path = "../libcst_derive", version = "1.8.6" }
  

diff --git a/python-libcst.spec b/python-libcst.spec
index 767f056..ed60154 100644
--- a/python-libcst.spec
+++ b/python-libcst.spec
@@ -15,7 +15,12 @@ License:        MIT AND (MIT AND PSF-2.0) AND Apache-2.0
 URL:            https://github.com/Instagram/LibCST
 Source:         %{pypi_source libcst}
 # * drop unused, benchmark-only criterion and rayon dev-dependencies
+# * update PyO3 to 0.29 (requires an accompanying source-code patch):
+#   https://github.com/Instagram/LibCST/pull/1454#issuecomment-4902787314
 Patch:          libcst-fix-metadata.diff
+# Source-code patch from https://github.com/Instagram/LibCST/pull/1454 for
+# updating PyO3 from 0.26 to 0.28
+Patch:          libcst-1.8.6-pyo3-0.28.patch
 
 BuildRequires:  cargo-rpm-macros >= 24
 BuildRequires:  python3-devel