diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 5c3581a..fe1e234 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -6,7 +6,7 @@
 
 ## Upgrading
 
-<!-- Here goes notes on how to upgrade from previous versions, including deprecations and what they should be replaced with -->
+- Bumped PyO3 to 0.29 to pull in the fix for RUSTSEC out-of-bounds read advisory GHSA-36hh-v3qg-5jq4 (`nth`/`nth_back` on list/tuple iterators).
 
 ## New Features
 
diff --git a/src/graph.rs b/src/graph.rs
index 841093f..6685eb1 100644
--- a/src/graph.rs
+++ b/src/graph.rs
@@ -16,7 +16,7 @@ use pyo3::{
     types::{PyAny, PySet, PyType},
 };
 
-#[pyclass(subclass)]
+#[pyclass(subclass, from_py_object)]
 #[derive(Clone, Default, Debug)]
 pub struct ComponentGraphConfig {
     config: cg::ComponentGraphConfig,
@@ -60,7 +60,7 @@ impl ComponentGraphConfig {
     }
 }
 
-#[pyclass(subclass)]
+#[pyclass(subclass, from_py_object)]
 #[derive(Clone, Default, Debug)]
 pub struct FormulaOverrides {
     overrides: cg::FormulaOverrides,