[rpms/fapolicy-analyzer] rawhide: Update PyO3 to 0.29: fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195

[rpms/fapolicy-analyzer] rawhide: Update PyO3 to 0.29: fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195

[Benjamin A. Beasley]

A new commit has been pushed.

Repo   : rpms/fapolicy-analyzer
Branch : rawhide
Commit : 5553d3c276a15c989a0e34d845592e4d57d3e0f3
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date   : 2026-07-16T11:14:55+01:00
Stats  : +271/-2 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/fapolicy-analyzer/c/5553d3c276a15c989a0e34d845592e4d57d3e0f3?branch=rawhide

Log:
Update PyO3 to 0.29: fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195

---
diff --git a/1092.patch b/1092.patch
new file mode 100644
index 0000000..4eb49cc
--- /dev/null
+++ b/1092.patch
@@ -0,0 +1,262 @@
+From f14699de23bc3d4264f04990eddac99c55b56f39 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Mon, 6 Jul 2026 06:23:28 +0100
+Subject: [PATCH 1/2] Update PyO3 to 0.29
+
+---
+ crates/pyo3/Cargo.toml    | 3 ++-
+ crates/pyo3/src/daemon.rs | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/crates/pyo3/Cargo.toml b/crates/pyo3/Cargo.toml
+index d78891b27..0746842ba 100644
+--- a/crates/pyo3/Cargo.toml
++++ b/crates/pyo3/Cargo.toml
+@@ -10,12 +10,13 @@ edition = "2021"
+ crate-type = ["cdylib"]
+ 
+ [dependencies]
+-pyo3 = { version = "0.27", features = ["abi3-py39", "auto-initialize", "py-clone"] }
++pyo3 = { version = "0.29", features = ["abi3-py39", "auto-initialize", "py-clone"] }
+ similar = "2.1"
+ chrono = "0.4"
+ tempfile = "3.3"
+ log = "0.4"
+ pyo3-log = "0.13"
++indoc = "2.0"
+ 
+ fapolicy-analyzer = { path = "../analyzer" }
+ fapolicy-auparse = { path = "../auparse" }
+diff --git a/crates/pyo3/src/daemon.rs b/crates/pyo3/src/daemon.rs
+index d3a63f43e..3110f9f4e 100644
+--- a/crates/pyo3/src/daemon.rs
++++ b/crates/pyo3/src/daemon.rs
+@@ -13,9 +13,9 @@ use fapolicy_daemon::stats::{Rec, RecTs};
+ use fapolicy_daemon::svc::State::{Active, Inactive};
+ use fapolicy_daemon::svc::{wait_for_service, Handle};
+ use fapolicy_daemon::{conf, pipe, stats};
++use indoc::indoc;
+ use pyo3::exceptions;
+ use pyo3::exceptions::PyRuntimeError;
+-use pyo3::indoc::indoc;
+ use pyo3::prelude::*;
+ use std::sync::atomic::{AtomicBool, Ordering};
+ use std::sync::Arc;
+
+From d478e56590d872ce46ef85fc5c1e33f1f5016c50 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Mon, 6 Jul 2026 07:11:55 +0100
+Subject: [PATCH 2/2] Explicitly opt in or out of `FromPyObject` blanket impls
+
+https://pyo3.rs/main/migration#deprecation-of-automatic-frompyobject-for-pyclass-types-which-implement-clone
+
+https://pyo3.rs/main/conversions/traits#-phase-out-of-frompyobject-blanket-implementation-for-cloneable-pyclasses-
+---
+ crates/pyo3/src/acl.rs      | 4 ++--
+ crates/pyo3/src/analysis.rs | 8 ++++----
+ crates/pyo3/src/daemon.rs   | 6 +++---
+ crates/pyo3/src/profiler.rs | 4 ++--
+ crates/pyo3/src/rules.rs    | 6 +++---
+ crates/pyo3/src/system.rs   | 2 +-
+ crates/pyo3/src/trust.rs    | 8 ++++----
+ 7 files changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/crates/pyo3/src/acl.rs b/crates/pyo3/src/acl.rs
+index 5052d6434..26c7ee94f 100644
+--- a/crates/pyo3/src/acl.rs
++++ b/crates/pyo3/src/acl.rs
+@@ -11,7 +11,7 @@ use pyo3::prelude::*;
+ use fapolicy_analyzer::users::{Group, User};
+ 
+ /// Represents a host system user parsed from /etc/passwd
+-#[pyclass(module = "acl", name = "User")]
++#[pyclass(module = "acl", name = "User", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyUser {
+     rs: User,
+@@ -49,7 +49,7 @@ impl PyUser {
+ }
+ 
+ /// Represents a host system group parsed from /etc/group
+-#[pyclass(module = "acl", name = "Group")]
++#[pyclass(module = "acl", name = "Group", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyGroup {
+     rs: Group,
+diff --git a/crates/pyo3/src/analysis.rs b/crates/pyo3/src/analysis.rs
+index 7f7adf850..261554077 100644
+--- a/crates/pyo3/src/analysis.rs
++++ b/crates/pyo3/src/analysis.rs
+@@ -16,7 +16,7 @@ use fapolicy_analyzer::events::event::{Event, Perspective};
+ use fapolicy_trust::db::DB as TrustDB;
+ 
+ /// An Event parsed from a fapolicyd log
+-#[pyclass(module = "log", name = "Event")]
++#[pyclass(module = "log", name = "Event", skip_from_py_object)]
+ #[derive(Clone, Debug)]
+ pub struct PyEvent {
+     rs: Analysis,
+@@ -88,7 +88,7 @@ impl PyEvent {
+ }
+ 
+ /// Subject metadata
+-#[pyclass(module = "log", name = "Subject")]
++#[pyclass(module = "log", name = "Subject", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PySubject {
+     rs: SubjAnalysis,
+@@ -133,7 +133,7 @@ impl PySubject {
+ }
+ 
+ /// Object metadata
+-#[pyclass(module = "log", name = "Object")]
++#[pyclass(module = "log", name = "Object", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyObject {
+     rs: ObjAnalysis,
+@@ -183,7 +183,7 @@ impl PyObject {
+     }
+ }
+ 
+-#[pyclass(module = "log", name = "EventLog")]
++#[pyclass(module = "log", name = "EventLog", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyEventLog {
+     pub(crate) rs: EventDB,
+diff --git a/crates/pyo3/src/daemon.rs b/crates/pyo3/src/daemon.rs
+index 3110f9f4e..55011cd3c 100644
+--- a/crates/pyo3/src/daemon.rs
++++ b/crates/pyo3/src/daemon.rs
+@@ -21,7 +21,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
+ use std::sync::Arc;
+ use std::thread;
+ 
+-#[pyclass(module = "svc", name = "Handle")]
++#[pyclass(module = "svc", name = "Handle", skip_from_py_object)]
+ #[derive(Clone, Default)]
+ /// A handle to a systemd service.
+ pub struct PyHandle {
+@@ -152,7 +152,7 @@ pub(crate) fn conf_to_text(db: &conf::DB) -> String {
+         .to_owned()
+ }
+ 
+-#[pyclass(module = "daemon", name = "ConfigInfo")]
++#[pyclass(module = "daemon", name = "ConfigInfo", skip_from_py_object)]
+ #[derive(Clone, Debug, Eq, PartialEq)]
+ pub struct PyConfigInfo {
+     pub category: String,
+@@ -192,7 +192,7 @@ pub(crate) fn conf_info(db: &conf::DB) -> Vec<PyConfigInfo> {
+ }
+ 
+ /// A mutable collection of config changes
+-#[pyclass(module = "daemon", name = "ConfigChangeset")]
++#[pyclass(module = "daemon", name = "ConfigChangeset", from_py_object)]
+ #[derive(Default, Clone)]
+ pub struct PyChangeset {
+     rs: Changeset,
+diff --git a/crates/pyo3/src/profiler.rs b/crates/pyo3/src/profiler.rs
+index c4513c30f..500664323 100644
+--- a/crates/pyo3/src/profiler.rs
++++ b/crates/pyo3/src/profiler.rs
+@@ -312,7 +312,7 @@ fn make_log_path(log_dir: &str, t: i64, suffix: &str) -> Result<LogPath, io::Err
+ 
+ /// Terminable process handle returned to python after starting profiling
+ #[derive(Default, Debug, Clone)]
+-#[pyclass(module = "daemon", name = "ProcHandle")]
++#[pyclass(module = "daemon", name = "ProcHandle", skip_from_py_object)]
+ struct ProcHandle {
+     kill_flag: Arc<AtomicBool>,
+     alive_flag: Arc<AtomicBool>,
+@@ -331,7 +331,7 @@ impl ProcHandle {
+ }
+ 
+ #[derive(Debug, Clone)]
+-#[pyclass(module = "daemon", name = "ExecHandle")]
++#[pyclass(module = "daemon", name = "ExecHandle", skip_from_py_object)]
+ struct ExecHandle {
+     pid: u32,
+     command: String,
+diff --git a/crates/pyo3/src/rules.rs b/crates/pyo3/src/rules.rs
+index 4dd2d0db1..b2cb89b1b 100644
+--- a/crates/pyo3/src/rules.rs
++++ b/crates/pyo3/src/rules.rs
+@@ -16,7 +16,7 @@ use fapolicy_rules::ops::Changeset;
+ use fapolicy_rules::parser::parse::StrTrace;
+ use fapolicy_rules::parser::rule::parse_with_error_message;
+ 
+-#[pyclass(module = "rules", name = "Rule")]
++#[pyclass(module = "rules", name = "Rule", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyRule {
+     pub id: usize,
+@@ -88,7 +88,7 @@ impl PyRule {
+     }
+ }
+ 
+-#[pyclass(module = "rules", name = "Info")]
++#[pyclass(module = "rules", name = "Info", skip_from_py_object)]
+ #[derive(Clone)]
+ pub struct PyRuleInfo {
+     pub category: String,
+@@ -109,7 +109,7 @@ impl PyRuleInfo {
+ }
+ 
+ /// A mutable collection of rule changes
+-#[pyclass(module = "rules", name = "RuleChangeset")]
++#[pyclass(module = "rules", name = "RuleChangeset", from_py_object)]
+ #[derive(Default, Clone)]
+ pub struct PyChangeset {
+     rs: Changeset,
+diff --git a/crates/pyo3/src/system.rs b/crates/pyo3/src/system.rs
+index b36cf779c..663001838 100644
+--- a/crates/pyo3/src/system.rs
++++ b/crates/pyo3/src/system.rs
+@@ -29,7 +29,7 @@ use crate::{daemon, rules};
+ 
+ use super::trust::{PyFilterChangeset, PyFilterInfo, PyTrust};
+ 
+-#[pyclass(module = "app", name = "System")]
++#[pyclass(module = "app", name = "System", from_py_object)]
+ #[derive(Clone)]
+ /// An immutable view of host system state.
+ /// This only a container for state, it has to be applied to the host system.
+diff --git a/crates/pyo3/src/trust.rs b/crates/pyo3/src/trust.rs
+index 0a8ab913f..95116301d 100644
+--- a/crates/pyo3/src/trust.rs
++++ b/crates/pyo3/src/trust.rs
+@@ -21,7 +21,7 @@ use std::collections::HashMap;
+ /// Trust entry
+ ///
+ /// Includes the path, size, and sha256 hash
+-#[pyclass(module = "trust", name = "Trust")]
++#[pyclass(module = "trust", name = "Trust", from_py_object)]
+ #[derive(Clone)]
+ pub struct PyTrust {
+     pub rs_trust: Trust,
+@@ -138,7 +138,7 @@ impl PyActual {
+ }
+ 
+ /// A mutable collection of changes
+-#[pyclass(module = "trust", name = "Changeset")]
++#[pyclass(module = "trust", name = "Changeset", from_py_object)]
+ #[derive(Clone)]
+ pub struct PyChangeset {
+     rs: Changeset,
+@@ -211,7 +211,7 @@ pub(crate) fn filter_to_text(db: &filter::DB) -> String {
+         .to_owned()
+ }
+ 
+-#[pyclass(module = "trust", name = "FilterInfo")]
++#[pyclass(module = "trust", name = "FilterInfo", skip_from_py_object)]
+ #[derive(Clone, Debug, Eq, PartialEq)]
+ pub struct PyFilterInfo {
+     pub category: String,
+@@ -253,7 +253,7 @@ pub(crate) fn filter_info(db: &filter::DB) -> Vec<PyFilterInfo> {
+ }
+ 
+ /// A mutable collection of trust filter changes
+-#[pyclass(module = "trust", name = "TrustFilterChangeset")]
++#[pyclass(module = "trust", name = "TrustFilterChangeset", from_py_object)]
+ #[derive(Default, Clone)]
+ pub struct PyFilterChangeset {
+     rs: FilterChangeset,

diff --git a/fapolicy-analyzer.spec b/fapolicy-analyzer.spec
index 0b4f196..80928b4 100644
--- a/fapolicy-analyzer.spec
+++ b/fapolicy-analyzer.spec
@@ -5,7 +5,7 @@
 Summary:       File Access Policy Analyzer
 Name:          fapolicy-analyzer
 Version:       1.5.1
-Release:       4%{?dist}
+Release:       5%{?dist}
 
 SourceLicense: GPL-3.0-or-later
 # (MIT OR Apache-2.0) AND Unicode-DFS-2016
@@ -44,6 +44,10 @@ Source0:       %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
 # this tarball contains documentation used to generate help docs
 Source1:       %{url}/releases/download/v%{version}/vendor-docs-%{version}.tar.gz
 
+# Update PyO3 to 0.29: fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195.
+# https://github.com/ctc-oss/fapolicy-analyzer/pull/1092
+Patch:         %{url}/pull/1092.patch
+
 # https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval
 ExcludeArch:   %{ix86}
 
@@ -109,7 +113,7 @@ Requires:      webkit2gtk4.1
 GUI Tools to assist with the configuration and management of fapolicyd.
 
 %prep
-%autosetup -n %{name}
+%autosetup -n %{name} -p1
 %cargo_prep
 
 %if %{without cli}
@@ -208,6 +212,9 @@ desktop-file-validate %{buildroot}/%{_datadir}/applications/%{name}.desktop
 %license LICENSE.dependencies
 
 %changelog
+* Thu Jul 16 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 1.5.1-5
+- Update PyO3 to 0.29: fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195
+
 * Wed Jul 15 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.5.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild