[dependabot]

Updates the requirements on pycryptodome to permit the latest version.

Release notes

Sourced from pycryptodome's releases.

v4.2.0 - Jura

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

Changelog

Sourced from pycryptodome's changelog.

4.2.0 (24 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

4.1.0 (19 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLDSA, for ML-DSA keys (FIPS 204). It is based on the portable C code of mldsa-native <https://github.com/pq-code-package/mldsa-native>_ (v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and BMI2, a version compiled for them and with 4-way SHA-3 is used: compared to the portable version, key generation and verification are 30-45% faster, signing 15-30%.
• New module Crypto.Signature.mldsa, for ML-DSA and HashML-DSA signatures (FIPS 204), hedged (default) or deterministic, with an optional context. The new MLDSAMuHash computes the message representative mu (external mu), to sign or verify a large message in pieces.
• New function digest() in the modules of the SHA-2 and SHA-3 hashes, to hash a whole message with a single call, like Crypto.Hash.KangarooTwelve.digest(). For messages up to 1 KiB, it is 1.5x to 3.4x faster than new() followed by digest().
• Crypto.IO.PKCS8.wrap() has a new parameter public_key, to create a OneAsymmetricKey version 2 (RFC 5958) with the field publicKey. Crypto.IO.PKCS8.unwrap() returns an UnwrappedKey: still a tuple (oid, private_key, params), with the same items as attributes, plus public_key (the field publicKey, if present).
• The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC, TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane at a time, two rounds per iteration, which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.

Resolved issues

• Crypto.PublicKey.ECC.import_key() checks that the field publicKey of a PKCS#8 OneAsymmetricKey version 2 (RFC 5958), if present, matches the private key. Before, it was ignored.

4.0.1 (17 October 2026) ++++++++++++++++++++++++++

... (truncated)

Commits

• fba5867 Update Changelog
• 52a8ff6 Fix PyPy wheels on Windows with setuptools 84.2
• 5a6f047 Bump version
• 9865be1 Don't run portable python with cffi
• 9c642f0 Update Changelog
• c40f64b Merge branch 'mlkem_import_export'
• e9f74ec Bump version
• 83f1406 Fix icons
• 00f2277 Add logo
• c4b4328 Fix docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)