[rpms/python-orjson] f44: Update PyO3 to 0.29

[Benjamin A. Beasley <code@musicinmybrain.net>]

A new commit has been pushed.

Repo   : rpms/python-orjson
Branch : f44
Commit : efb58f5d98754f999f8653b384e892274e8e4ed9
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date   : 2026-07-10T13:03:03+01:00
Stats  : +37/-25 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/python-orjson/c/efb58f5d98754f999f8653b384e892274e8e4ed9?branch=f44

Log:
Update PyO3 to 0.29

---
diff --git a/orjson-3.11.9-pyo3-0.27.patch b/orjson-3.11.9-pyo3-0.27.patch
deleted file mode 100644
index b0eeb87..0000000
--- a/orjson-3.11.9-pyo3-0.27.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Naur orjson-3.11.9-original/Cargo.toml orjson-3.11.9/Cargo.toml
---- orjson-3.11.9-original/Cargo.toml	2026-05-06 15:12:18.000000000 +0100
-+++ orjson-3.11.9/Cargo.toml	2026-05-08 21:29:32.324384832 +0100
-@@ -48,7 +48,7 @@
- itoap = { version = "1", default-features = false, features = ["std", "simd"] }
- jiff = { version = "^0.2", default-features = false, features = ["perf-inline"] }
- once_cell = { version = "1", default-features = false, features = ["alloc", "race"] }
--pyo3-ffi = { version = "0.28", default-features = false }
-+pyo3-ffi = { version = ">=0.27,<0.29", default-features = false }
- serde = { version = "1", default-features = false }
- serde_json = { version = "1", default-features = false, features = ["std"] }
- simdutf8 = { version = "0.1", default-features = false, features = ["std", "public_imp", "aarch64_neon"] }
-@@ -58,7 +58,7 @@
- 
- [build-dependencies]
- cc = { version = "1" }
--pyo3-build-config = { version = "0.28" }
-+pyo3-build-config = { version = ">=0.27,<0.29" }
- 
- [profile.dev]
- codegen-units = 1

diff --git a/orjson-3.11.9-pyo3-0.29.patch b/orjson-3.11.9-pyo3-0.29.patch
new file mode 100644
index 0000000..92453a2
--- /dev/null
+++ b/orjson-3.11.9-pyo3-0.29.patch
@@ -0,0 +1,34 @@
+diff -Naur orjson-3.11.9-original/Cargo.toml orjson-3.11.9/Cargo.toml
+--- orjson-3.11.9-original/Cargo.toml	2026-05-06 15:12:18.000000000 +0100
++++ orjson-3.11.9/Cargo.toml	2026-07-10 13:02:39.462239484 +0100
+@@ -48,7 +48,7 @@
+ itoap = { version = "1", default-features = false, features = ["std", "simd"] }
+ jiff = { version = "^0.2", default-features = false, features = ["perf-inline"] }
+ once_cell = { version = "1", default-features = false, features = ["alloc", "race"] }
+-pyo3-ffi = { version = "0.28", default-features = false }
++pyo3-ffi = { version = "0.29", default-features = false }
+ serde = { version = "1", default-features = false }
+ serde_json = { version = "1", default-features = false, features = ["std"] }
+ simdutf8 = { version = "0.1", default-features = false, features = ["std", "public_imp", "aarch64_neon"] }
+@@ -58,7 +58,7 @@
+ 
+ [build-dependencies]
+ cc = { version = "1" }
+-pyo3-build-config = { version = "0.28" }
++pyo3-build-config = { version = "0.29" }
+ 
+ [profile.dev]
+ codegen-units = 1
+diff -Naur orjson-3.11.9-original/src/ffi/pystrref/pyunicode_new.rs orjson-3.11.9/src/ffi/pystrref/pyunicode_new.rs
+--- orjson-3.11.9-original/src/ffi/pystrref/pyunicode_new.rs	2026-05-06 15:12:18.000000000 +0100
++++ orjson-3.11.9/src/ffi/pystrref/pyunicode_new.rs	2026-07-10 13:01:41.060310147 +0100
+@@ -6,6 +6,9 @@
+ 
+ macro_rules! validate_str {
+     ($ptr:expr) => {
++        // Downstream patch: this private FFI definition was removed in PyO3 0.29, and we build
++        // exclusively in release mode anyway.
++        #[cfg(false)]
+         #[cfg(all(CPython, not(Py_LIMITED_ABI)))]
+         debug_assert!(pyo3_ffi::_PyUnicode_CheckConsistency($ptr.cast::<PyObject>(), 1) == 1)
+     };

diff --git a/python-orjson.spec b/python-orjson.spec
index 7e81996..c3bb09d 100644
--- a/python-orjson.spec
+++ b/python-orjson.spec
@@ -40,9 +40,9 @@ Source0:        orjson-%{version}-filtered.tar.xz
 # ./get_source ${COMMIT} (or ${TAG})
 Source1:        get_source
 
-# Still allow PyO3 0.27 for now (upstream wants 0.28):
-# https://bugzilla.redhat.com/show_bug.cgi?id=2435852
-Patch:          orjson-3.11.9-pyo3-0.27.patch
+# Update to PyO3 0.29; fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195.
+# Downstream-only because upstream no longer accepts issues or pull requests.
+Patch:          orjson-3.11.9-pyo3-0.29.patch
 
 BuildRequires:  tomcli
 BuildRequires:  python3-devel
@@ -61,7 +61,6 @@ BuildRequires:  %{py3_dist pandas}
 BuildRequires:  %{py3_dist psutil}
 BuildRequires:  cargo-rpm-macros >= 24
 
-
 %global _description %{expand:
 orjson is a fast, correct Python JSON library supporting dataclasses,
 datetimes, and numpy}