Bump pyo3 from 0.16.5 to 0.16.6

[dependabot]

Bumps pyo3 from 0.16.5 to 0.16.6.

Release notes

Sourced from pyo3's releases.

PyO3 0.16.6

This release is a tactical set of soundness fixes identified for the PyCapsule bindings released in PyO3 0.16. To avoid breaking API changes capsules created with PyCapsule::new and PyCapsule::new_with_destructor will now leak their contents (and not call the destructor) if released on a thread other than the one they were created.

PyO3 0.17 will be released shortly with breaking API changes which resolve the PyCapsule issues with better design (e.g. the destructor has a Send bound added). Users are encouraged to upgrade at their earliest convenience.

Thanks to @​saethlin for reporting the issue, and to @​adamreichold and @​davidhewitt for implementing the resolution.

Changelog

Sourced from pyo3's changelog.

[0.16.6] - 2022-08-23

### Changed

• Fix soundness issues with PyCapsule type with select workarounds. Users are encourage to upgrade to PyO3 0.17 at their earliest convenience which contains API breakages which fix the issues in a long-term fashion. #2522
  • PyCapsule::new and PyCapsule::new_with_destructor now take ownership of a copy of the name to resolve a possible use-after-free.
  • PyCapsule::name now returns an empty CStr instead of dereferencing a null pointer if the capsule has no name.
  • The destructor F in PyCapsule::new_with_destructor will never be called if the capsule is deleted from a thread other than the one which the capsule was created in (a warning will be emitted).
• Panics during drop of panic payload caught by PyO3 will now abort. #2544

Commits

• 4fdebfc release: 0.16.6
• dde98a0 pin bumpalo
• 30211a6 ui test fixes
• 5c74ddf clippy fixes
• 7426aea safety: abort on uncaught panics
• 916abf6 Merge pull request #2522 from davidhewitt/capsule-soundness-backport
• c267ace ci: fix nightly UI tests
• 86740f9 ci: fix nightly ui tests
• 96427ee Use proper method for pinning MSRV minimal package versions
• 1e8f6d9 Try fix hashbrown version on msrv
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)