[dependabot]

Bumps the python-minor-patch group with 1 update in the / directory: pycryptodome.

Updates pycryptodome from 4.0.0 to 4.2.0

Release notes

Sourced from pycryptodome's releases.

v4.2.0 - Jura

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

v4.1.0 - Issy-les-Moulineaux

New features

• New module Crypto.PublicKey.MLDSA, for ML-DSA keys (FIPS 204). It is based on the portable C code of mldsa-native <https://github.com/pq-code-package/mldsa-native>_ (v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and BMI2, a version compiled for them and with 4-way SHA-3 is used: compared to the portable version, key generation and verification are 30-45% faster, signing 15-30%.
• New module Crypto.Signature.mldsa, for ML-DSA and HashML-DSA signatures (FIPS 204), hedged (default) or deterministic, with an optional context. The new MLDSAMuHash computes the message representative mu (external mu), to sign or verify a large message in pieces.
• New function digest() in the modules of the SHA-2 and SHA-3 hashes, to hash a whole message with a single call, like Crypto.Hash.KangarooTwelve.digest(). For messages up to 1 KiB, it is 1.5x to 3.4x faster than new() followed by digest().
• Crypto.IO.PKCS8.wrap() has a new parameter public_key, to create a OneAsymmetricKey version 2 (RFC 5958) with the field publicKey. Crypto.IO.PKCS8.unwrap() returns an UnwrappedKey: still a tuple (oid, private_key, params), with the same items as attributes, plus public_key (the field publicKey, if present).
• The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC, TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane at a time, two rounds per iteration, which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.

Resolved issues

• Crypto.PublicKey.ECC.import_key() checks that the field publicKey of a PKCS#8 OneAsymmetricKey version 2 (RFC 5958), if present, matches the private key. Before, it was ignored.

v4.0.1 - Le Havre

New features

• The Windows wheels for x86-64 are built with clang-cl (compatible with MSVC), so the code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and the other Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big integers of RSA, DSA and the NIST curves. To build from source with clang-cl, set the environment variable PYCRYPTODOME_CLANG_CL (see the installation instructions).

Changelog

Sourced from pycryptodome's changelog.

4.2.0 (24 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

4.1.0 (19 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLDSA, for ML-DSA keys (FIPS 204). It is based on the portable C code of mldsa-native <https://github.com/pq-code-package/mldsa-native>_ (v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and BMI2, a version compiled for them and with 4-way SHA-3 is used: compared to the portable version, key generation and verification are 30-45% faster, signing 15-30%.
• New module Crypto.Signature.mldsa, for ML-DSA and HashML-DSA signatures (FIPS 204), hedged (default) or deterministic, with an optional context. The new MLDSAMuHash computes the message representative mu (external mu), to sign or verify a large message in pieces.
• New function digest() in the modules of the SHA-2 and SHA-3 hashes, to hash a whole message with a single call, like Crypto.Hash.KangarooTwelve.digest(). For messages up to 1 KiB, it is 1.5x to 3.4x faster than new() followed by digest().
• Crypto.IO.PKCS8.wrap() has a new parameter public_key, to create a OneAsymmetricKey version 2 (RFC 5958) with the field publicKey. Crypto.IO.PKCS8.unwrap() returns an UnwrappedKey: still a tuple (oid, private_key, params), with the same items as attributes, plus public_key (the field publicKey, if present).
• The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC, TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane at a time, two rounds per iteration, which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.

Resolved issues

• Crypto.PublicKey.ECC.import_key() checks that the field publicKey of a PKCS#8 OneAsymmetricKey version 2 (RFC 5958), if present, matches the private key. Before, it was ignored.

4.0.1 (17 October 2026) ++++++++++++++++++++++++++

... (truncated)

Commits

• fba5867 Update Changelog
• 52a8ff6 Fix PyPy wheels on Windows with setuptools 84.2
• 5a6f047 Bump version
• 9865be1 Don't run portable python with cffi
• 9c642f0 Update Changelog
• c40f64b Merge branch 'mlkem_import_export'
• e9f74ec Bump version
• 83f1406 Fix icons
• 00f2277 Add logo
• c4b4328 Fix docs
• Additional commits viewable in compare view

[yaping-pro]

Superseded by batch update in main (ad2aba5)

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml