chore: bump pyo3 from 0.27.2 to 0.28.3

[dependabot]

Bumps pyo3 from 0.27.2 to 0.28.3.

Release notes

Sourced from pyo3's releases.

PyO3 0.28.3

This patch contains several fixes for stability of the PyO3 0.28.x series:

• Python::attach and Python::try_attach will no longer return before the thread initializing the interpreter has finished runnning site.py when using the auto-initialize feature.
• Fix unsoundness in PyBytesWriter::write_vectored when targeting the Python 3.15 prerelease interpreter.
• Fix possible deadlock in .into_pyobject() implementation for C-like #[pyclass] enums.

A couple of edge cases causing compile failures were also fixed.

Thank you to the following contributors for the improvements:

@​alex @​bschoenmaeckers @​chirizxc @​davidhewitt @​Embers-of-the-Fire @​Icxolu @​maurosilber @​ngoldbaum

PyO3 0.28.2

This patch release contains a soundness fix for subclassing native types such as PyList with the abi3 feature enabled when targeting a minimum version of Python 3.12 or higher. (Support for doing such subclassing was newly added in PyO3 0.28.0.)

PyO3 0.28.0 and 0.28.1 will be yanked.

This release also contains a correction to the FFI definition PyType_GetTypeDataSize and incorrectly-generated __qualname__ on #[pyclass] enum variant types when using #[pyo3(name = "...")] option to rename the enum and/or variant.

Thank you to the following contributors for the improvements:

@​davidhewitt @​Icxolu @​ngoldbaum

PyO3 0.28.1

This patch contains a number of minor compile-time fixes for PyO3 0.28.0.

Thank you to the following contributors for the improvements:

@​davidhewitt @​funsafemath @​ngoldbaum @​rara64 @​tdyas

PyO3 0.28.0

This release contains many improvements across PyO3's feature set:

• Proper support for __init__ methods for #[pyclass] types
• Support for #[deleter]s to complement the existing #[getter] and #[setter] attributes when implementing class "properties".
• Support for subclassing many Python types with the abi3 feature (requires Python 3.12+).
• A new #[pyclass(new = "from_fields")] option to automatically define the constructor from the class fields.
• Many corrections to FFI definitions (including removal of many private CPython methods)

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.28.3] - 2026-04-02

Fixed

• Fix compile error with #[pyclass(get_all)] on a type named Probe. #5837
• Fix compile error in debug builds related to _Py_NegativeRefcount with Python < 3.12. #5847
• Fix a race condition where Python::attach or try_attach could return before site.py had finished running. #5903
• Fix unsoundness in PyBytesWriter::write_vectored with Python 3.15 prerelease versions. #5907
• Fix deadlock in .into_pyobject() implementation for C-like #[pyclass] enums. #5928

[0.28.2] - 2026-02-18

Fixed

• Fix complex enum __qualname__ not using python name #5815
• Fix FFI definition PyType_GetTypeDataSize (was incorrectly named PyObject_GetTypeDataSize). #5819
• Fix memory corruption when subclassing native types with abi3 feature on Python 3.12+ (newly enabled in PyO3 0.28.0). #5823

[0.28.1] - 2026-02-14

Fixed

• Fix *args / **kwargs support in experimental-async feature (regressed in 0.28.0). #5771
• Fix clippy::declare_interior_mutable_const warning inside #[pyclass] generated code on enums. #5772
• Fix ambiguous_associated_items compilation error when deriving FromPyObject or using #[pyclass(from_py_object)] macro on enums with Error variant. #5784
• Fix __qualname__ for complex #[pyclass] enum variants to include the enum name. #5796
• Fix missing std::sync::atomic::Ordering import for targets without atomic64. #5808

[0.28.0] - 2026-02-01

Packaging

• Bump MSRV to Rust 1.83. #5531
• Bump minimum supported quote version to 1.0.37. #5531
• Bump supported GraalPy version to 25.0. #5542
• Drop memoffset dependency. #5545
• Support for free-threaded Python is now opt-out rather than opt-in. #5564
• Bump target-lexicon dependency to 0.13.3. #5571
• Drop indoc and unindent dependencies. #5608

Added

• Add __init__ support in #[pymethods]. #4951
• Expose PySuper on PyPy, GraalPy and ABI3 #4951
• Add PyString::from_fmt and py_format! macro. #5199
• Add #[pyclass(new = "from_fields")] option. #5421
• Add pyo3::buffer::PyUntypedBuffer, a type-erased form of PyBuffer<T>. #5458
• Add PyBytes::new_with_writer #5517
• Add PyClass::NAME. #5579
• Add pyo3_build_config::add_libpython_rpath_link_args. #5624

... (truncated)

Commits

• 743af64 release: 0.28.3
• 2042b4c fix deadlock when initializing enum via into_pyobject() (#5928)
• 0157247 ci: update UI tests for Rust 1.94 (#5859)
• e234f8a Update getting-started.md (#5899)
• c06848d fix ffi-check in 3.15.0a7 (#5873)
• 83f4283 remove unused try_trait_v2 feature when enabling the nightly feature (#5868)
• 0de57ed Fix unsoundness in PyBytesWriter::write_vectored (#5907)
• 49cd13f fixes #5900 -- address race condition with initialization and site.py loading...
• c90d163 [fix] Fix std::ffi import for _Py_NegativeRefcount (#5847)
• b79d725 fix(pyo3-macros): allow pyclass named Probe (#5837)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[prql-bot]

The bump itself resolves correctly, but pyo3 0.28 deprecates the automatic FromPyObject impl for #[pyclass] types that derive Clone, and CompileOptions in prqlc/bindings/prqlc-python/src/lib.rs is exactly that. The 📎 Clippy step in test-rust.yaml runs with -D warnings, so this turns the deprecation into a hard error and test-rust will fail once the queued matrix gets a runner:

error: use of deprecated associated constant `pyo3::impl_::deprecated::HasAutomaticFromPyObject::<true>::MSG`
   --> prqlc/bindings/prqlc-python/src/lib.rs:102:1
    |
102 | #[pyclass]

Reproduced locally with cargo clippy -p prqlc-python --all-targets -- -D warnings (exit 101). from_py_object is the migration to take rather than skip_from_py_object — compile and rq_to_sql both take Option<CompileOptions> as a #[pyfunction] parameter, and test_all.py passes prqlc.CompileOptions(...) into both, so dropping the derive would break the public API at runtime. Since nobody is here to act on the suggestion, I've pushed it:

// prqlc/bindings/prqlc-python/src/lib.rs, on `pub struct CompileOptions`
#[pyclass(from_py_object)]
#[derive(Clone, Debug)]

Two other things worth a maintainer's eye, neither blocking this PR:

pyo3-build-config is left at 0.27.1 (Cargo.toml line 58), so the lock now carries two copies of it. The effect is cosmetic today — build.rs only calls add_extension_module_link_args() — but #6258 proposes moving it to 0.29.2, which would leave the build-config crate a major ahead of pyo3 itself. 0.28.3 is the version that matches; #6258 is worth redirecting there (or closing in favour of a bump alongside this one).

abi3-py37 is why this stops at 0.28.3. pyo3 0.29 removed that feature (its lowest is abi3-py38, and it added abi3-py315), which is why Dependabot capped the bump here rather than going to 0.29.2. pyproject.toml already declares requires-python = ">=3.10", so moving the feature to abi3-py310 would both match what the package claims to support and unblock the next pyo3 major — but it narrows the ABI floor of a published wheel, so that's a call for a maintainer rather than something to fold into a dependency bump.

Other 0.28 migration items, checked against this codebase

From pyo3's 0.28 migration guide:

• Free-threaded Python is now opt-out. #[pymodule] no longer needs gil_used = false; the prqlc module will now declare that it doesn't require the GIL. Checked the compiler's process-global state for this: prqlc uses OnceLock (sql/operators.rs, sql/keywords.rs, codegen/ast.rs, utils/mod.rs, lib.rs) and one RwLock<Option<DebugLog>> (debug/log.rs) — all Sync, no static mut or non-Sync statics — and the bindings expose no way to start the debug log, so this looks safe.
• Multi-phase module initialization — upstream states no migration needed.
• Py::from_owned_ptr deprecations, PyClassInitializer From impl removal, PyBuffer → PyUntypedBuffer — none of these APIs are used here.
• Removed transitive deps (indoc, memoffset, unindent) have no direct dependents in this workspace.
• MSRV: pyo3 0.28 requires Rust 1.83; the workspace is on 1.85.0.
• cargo test -p prqlc-python passes (5 tests) with the fix applied.