Version bump

[prozacchiwawa]

Note

Medium Risk
PyO3 0.25→0.29 is a breaking FFI/API migration for the Python bindings; behavior should be equivalent but extension wheels need rebuild and regression testing.

Overview
Releases chialisp and clvm_tools_wasm as 0.4.6, with lockfile updates for PyO3 0.29, sha2 0.11, and related transitive crates.

The Python extension is updated for PyO3 0.29: Python::with_gil → Python::attach, py.allow_threads → py.detach, downcast → cast, public APIs now return Py<PyAny> instead of PyObject, and path extraction maps CastError explicitly. Optional rand now enables std, std_rng, and os_rng.

^{Reviewed by Cursor Bugbot for commit 458e456. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​pyo3@​0.25.1 ⏵ 0.29.0	+2	+18

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• cargo/target-lexicon@0.13.5

View full report

[prozacchiwawa]

@SocketSecurity ignore cargo/target-lexicon@0.13.5

[Quexington]

Not a rust expert but seems emminently reasonable