[dependabot]

Bumps the pip group in /terraform/src with 2 updates: boto3 and pycryptodome.

Updates boto3 from 1.43.104 to 1.43.122

Commits

• f89caef Merge branch 'release-1.43.122'
• 5af8c5f Bumping version to 1.43.122
• 1af5d47 Add changelog entries from botocore
• cc2e975 Merge branch 'release-1.43.121'
• 807ecf8 Merge branch 'release-1.43.121' into develop
• 21a159b Bumping version to 1.43.121
• 426304c Add changelog entries from botocore
• bb4b50f Bump the github-actions group with 5 updates (#4867)
• 912163e Bump https://github.com/astral-sh/ruff-pre-commit (#4866)
• 431a8a1 Merge branch 'release-1.43.120'
• Additional commits viewable in compare view

Updates pycryptodome from 3.23.0 to 4.2.0

Release notes

Sourced from pycryptodome's releases.

v4.2.0 - Jura

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

v4.1.0 - Issy-les-Moulineaux

New features

• New module Crypto.PublicKey.MLDSA, for ML-DSA keys (FIPS 204). It is based on the portable C code of mldsa-native <https://github.com/pq-code-package/mldsa-native>_ (v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and BMI2, a version compiled for them and with 4-way SHA-3 is used: compared to the portable version, key generation and verification are 30-45% faster, signing 15-30%.
• New module Crypto.Signature.mldsa, for ML-DSA and HashML-DSA signatures (FIPS 204), hedged (default) or deterministic, with an optional context. The new MLDSAMuHash computes the message representative mu (external mu), to sign or verify a large message in pieces.
• New function digest() in the modules of the SHA-2 and SHA-3 hashes, to hash a whole message with a single call, like Crypto.Hash.KangarooTwelve.digest(). For messages up to 1 KiB, it is 1.5x to 3.4x faster than new() followed by digest().
• Crypto.IO.PKCS8.wrap() has a new parameter public_key, to create a OneAsymmetricKey version 2 (RFC 5958) with the field publicKey. Crypto.IO.PKCS8.unwrap() returns an UnwrappedKey: still a tuple (oid, private_key, params), with the same items as attributes, plus public_key (the field publicKey, if present).
• The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC, TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane at a time, two rounds per iteration, which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.

Resolved issues

• Crypto.PublicKey.ECC.import_key() checks that the field publicKey of a PKCS#8 OneAsymmetricKey version 2 (RFC 5958), if present, matches the private key. Before, it was ignored.

v4.0.1 - Le Havre

New features

• The Windows wheels for x86-64 are built with clang-cl (compatible with MSVC), so the code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and the other Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big integers of RSA, DSA and the NIST curves. To build from source with clang-cl, set the environment variable PYCRYPTODOME_CLANG_CL (see the installation instructions).

v4.0.0 - Grenoble

Major release, with some breaking changes. See Changelog.

v3.24.1 - Frejus

Resolved issues

• Security: the time to create an ECDSA, EdDSA or DSA signature depended on the secret nonce, enough to recover the private key with a lattice attack. DSA signing is now about 40% slower with GMP. Thanks to Daniel Bleichenbacher.

v3.24.0 - Evreux

New features

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

4.2.0 (24 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLKEM, for ML-KEM keys (FIPS 203). It is based on the portable C code of mlkem-native <https://github.com/pq-code-package/mlkem-native>_ (v2.0.0), with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3). The keys can be exported and imported as PKCS#8 DER or PEM files.
• New module Crypto.PublicKey.Hybrid, to model hybrid keys (post-quantum + traditional). It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519. For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
• Crypto.Protocol.HPKE accepts ML-KEM keys and X-Wing keys, for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.

4.1.0 (19 October 2026) ++++++++++++++++++++++++++

New features

• New module Crypto.PublicKey.MLDSA, for ML-DSA keys (FIPS 204). It is based on the portable C code of mldsa-native <https://github.com/pq-code-package/mldsa-native>_ (v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and BMI2, a version compiled for them and with 4-way SHA-3 is used: compared to the portable version, key generation and verification are 30-45% faster, signing 15-30%.
• New module Crypto.Signature.mldsa, for ML-DSA and HashML-DSA signatures (FIPS 204), hedged (default) or deterministic, with an optional context. The new MLDSAMuHash computes the message representative mu (external mu), to sign or verify a large message in pieces.
• New function digest() in the modules of the SHA-2 and SHA-3 hashes, to hash a whole message with a single call, like Crypto.Hash.KangarooTwelve.digest(). For messages up to 1 KiB, it is 1.5x to 3.4x faster than new() followed by digest().
• Crypto.IO.PKCS8.wrap() has a new parameter public_key, to create a OneAsymmetricKey version 2 (RFC 5958) with the field publicKey. Crypto.IO.PKCS8.unwrap() returns an UnwrappedKey: still a tuple (oid, private_key, params), with the same items as attributes, plus public_key (the field publicKey, if present).
• The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC, TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane at a time, two rounds per iteration, which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.

Resolved issues

• Crypto.PublicKey.ECC.import_key() checks that the field publicKey of a PKCS#8 OneAsymmetricKey version 2 (RFC 5958), if present, matches the private key. Before, it was ignored.

4.0.1 (17 October 2026) ++++++++++++++++++++++++++

... (truncated)

Commits

• fba5867 Update Changelog
• 52a8ff6 Fix PyPy wheels on Windows with setuptools 84.2
• 5a6f047 Bump version
• 9865be1 Don't run portable python with cffi
• 9c642f0 Update Changelog
• c40f64b Merge branch 'mlkem_import_export'
• e9f74ec Bump version
• 83f1406 Fix icons
• 00f2277 Add logo
• c4b4328 Fix docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions