release: 0.23.3

[davidhewitt]

Staging branch for the 0.23.3 patch release.

So far this includes #4733. I have a couple other things I think worth resolving before release:

• We should probably include Towards soundness of PyByteArray::to_vec #4742 - not shipping, seems like upstream doesn't handle bytearray yet on the freethreaded build so not much we can do here.
• I have a segmentation fault in the pydantic-core test suite since updating to 0.23.2. I think this needs investigation asap - fixed in fix PYO3_CONFIG_FILE env var not requesting rebuilds #4758
• We should get support python3-dll-a free-threaded generation #4749 merged
• Another crash report in _PyMem_DebugRawFree under Python 3.13 starting with version 1.0.0 in PYTHONDEVMODE samuelcolvin/watchfiles#313 - fixed in fix PYO3_CONFIG_FILE env var not requesting rebuilds #4758

[davidhewitt]

Maybe also #4738 (reply in thread)

[davidhewitt]

Segmentation fault in pydantic-core seems to have been attributable to use of PyUnicode_DATA in jiter. So the bug is "resolved" at least as far as downstream is concerned, but I think makes me worried about testing more architectures better in CI. I opened #4754, though that doesn't necessarily need to block the patch release.

Link failures on aarch64 windows, will investigate those too. pydantic/pydantic-core#1570 (comment)

I think the link failures are worth resolving in the patch, if it's trivial to do so.

[davidhewitt]

Need to update this to pull #4753 (thanks @Icxolu) and #4749.

[davidhewitt]

As per #4757 I think this just became critically urgent. Will update here now.

[davidhewitt]

Release is now prepared; assuming CI turns fully green I intend to proceed to merge and release immediately after. I will follow up by yanking 0.23.0 through 0.23.2 and file a security advisory, I guess.

[davidhewitt]

Release is now live on crates.io so users should increasingly be pulling it; it's late here so I am going to head to sleep and follow up with the yanking / advisory / GitHub release tomorrow.

[alex]

Thanks for running with this so quickly!

…

On Tue, Dec 3, 2024, 5:37 PM David Hewitt ***@***.***> wrote: Release is now live on crates.io so users should increasingly be pulling it; it's late here so I am going to head to sleep and follow up with the yanking / advisory / GitHub release tomorrow. — Reply to this email directly, view it on GitHub <#4745 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBHYY2FDCNWWHUNU7EL2DYXCBAVCNFSM6AAAAABSXFKETSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJVGY4TGMZRGI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>