[dependabot]

Bumps pycryptodome from 3.24.1 to 4.0.1.

Changelog

Sourced from pycryptodome's changelog.

4.0.1 (17 October 2026) ++++++++++++++++++++++++++

New features

• The Windows wheels for x86-64 are built with clang-cl (compatible with MSVC), so the code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and the other Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big integers of RSA, DSA and the NIST curves. To build from source with clang-cl, set the environment variable PYCRYPTODOME_CLANG_CL (see the installation instructions).

4.0.0 (14 October 2026) ++++++++++++++++++++++++++

Breaking changes

• Remove support for Python 2.7 and 3.8. The minimum supported version is now Python 3.9.
• The pycryptodomex package (Cryptodome namespace) is no longer released (except for important security patches, but still on the 3.x branch). The library is only available as pycryptodome, under the Crypto namespace.
• The self-tests are now run by pytest, which must be installed for python -m Crypto.SelfTest to work. The test command of setup.py is removed: install the package (e.g. with pip install -e .) and run python -m Crypto.SelfTest instead.
• In Crypto.Protocol.KDF.SP800_108_Counter(), the label can no longer contain zero bytes, while the context now can (for instance, a binary nonce). The zero byte between them still separates the two unambiguously, as required by NIST SP 800-108r1 (GH#896).
• The coordinates of EccPoint and EccXPoint (x, y and xy), EccKey.d and the components of ElGamal keys (p, g, y and x) are now Python int objects, not Crypto.Math.Numbers.Integer. The ElGamal components can no longer be assigned.
• The GMP library is no longer used, and the environment variable PYCRYPTODOME_DISABLE_GMP has no effect. Big integers are handled by the new constant-time code (see below). Crypto.Math.Numbers.Integer (an internal class) no longer supports negative values.
• Elliptic curve points are decoded more strictly. Importing a NIST curve public key (SEC1, DER, PEM or OpenSSH) fails if a coordinate of the point is equal to or larger than the modulus p, as required by SEC1 (such coordinates were reduced modulo p before; EccPoint and ECC.construct() still reduce them). Ed25519 and Ed448 points (public keys, and R in signatures) are decoded as in RFC 8032: an encoding with x = 0 and the sign bit of x set, or (for Ed448) with any of the 7 low bits of the last byte set, is now rejected.
• RSA keys are limited to a modulus of 16384 bits: RSA.generate(), RSA.construct() and RSA.import_key() raise ValueError for larger ones. The constant-time arithmetic is slower than GMP, and a large public key from an untrusted source could take minutes to import or use.
• Crypto.Protocol.KDF.bcrypt_check() rejects (with Crypto.KdfIterationLimitError, a ValueError) a bcrypt hash whose cost is above 20, which takes about one minute: a hash from an untrusted source, which states its own cost, could otherwise tie up the CPU for a day. Use the new parameter max_cost

... (truncated)

Commits

• 9a68e38 Update Changelog
• 33ded63 Add a minimal test to verify the compiler works at all
• 93bd489 Merge branch 'windows_avx2_bmi2'
• f99bae2 Add missing header file
• b86255c Fix clang warnings
• 9f4e3de Fix C tests on Windows x64
• 429099b Bump version
• 227ee69 Correct Windows image
• 0f19b51 Always use clang-cl
• e0e2c86 Remove Pycrypto comparison page
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.79%. Comparing base (1d2e61e) to head (c99e992).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3833      +/-   ##
==========================================
- Coverage   93.79%   93.79%   -0.01%     
==========================================
  Files         512      512              
  Lines       46655    46655              
  Branches     6333     6333              
==========================================
- Hits        43759    43758       -1     
- Misses       1870     1871       +1     
  Partials     1026     1026              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.