[dependabot]

Bumps the python group with 3 updates: typer, pycryptodome and ruff.

Updates typer from 0.27.3 to 0.28.0

Release notes

Sourced from typer's releases.

0.28.0

Fixes

• 🐛 Ensure that the default option name is not changed by setting a metavar. PR #1957 by @​svlandeg.

Docs

• 🎨 Enable Ruff formatting for Python in Markdown. PR #1978 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2025.11.12 to 2026.10.18. PR #1990 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 6 updates. PR #1994 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 6 updates. PR #1993 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1995 by @​pr-submit[bot].

Changelog

Sourced from typer's changelog.

0.28.0 (2026-11-06)

Fixes

• 🐛 Ensure that the default option name is not changed by setting a metavar. PR #1957 by @​svlandeg.

Docs

• 🎨 Enable Ruff formatting for Python in Markdown. PR #1978 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2025.11.12 to 2026.10.18. PR #1990 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 6 updates. PR #1994 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 6 updates. PR #1993 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1995 by @​pr-submit[bot].

Commits

• bf5cfc1 🔖 Release version 0.28.0 (#2002)
• 8ff8b0e 📝 Update release notes
• de1b20d 🐛 Ensure that the default option name is not changed by setting a metavar (#1...
• f2183bf 📝 Update release notes
• 8c73520 ⬆ Bump certifi from 2025.11.12 to 2026.10.18 (#1990)
• b6176ca 📝 Update release notes
• af96bcf ⬆ Bump the python-packages group with 6 updates (#1994)
• cffcbc1 📝 Update release notes
• b9e694b ⬆ Bump the github-actions group with 6 updates (#1993)
• c0eb87b 📝 Update release notes
• Additional commits viewable in compare view

Updates pycryptodome from 4.2.0 to 4.3.0

Release notes

Sourced from pycryptodome's releases.

v4.3.0 - Kourou

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).
• On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available. On a Graviton3, SHA-256 is about 3.8x faster, and SHA-512 2x.
• On 64-bit ARM CPUs, KangarooTwelve, ML-KEM and ML-DSA compute 4 Keccak states at once (2 with scalar code and 2 with NEON). On a Graviton3, KangarooTwelve is 1.9x faster, ML-DSA 7-20% and ML-KEM 7-8%.
• PKCS#1 v1.5 decryption (Crypto.Cipher.PKCS1_v1_5) performs implicit rejection, as defined in section 7.2 of draft-irtf-cfrg-rsa-guidance, when decrypt() is called without a sentinel (which is now optional): when the padding of a ciphertext is not correct, it returns a pseudo-random message, which only depends on the private key and on the ciphertext. With a sentinel, decrypt() behaves as before.

Other changes

• Updated the Wycheproof test vectors (new Ed25519 tests and the new chacha20_counter_test.json). XChaCha20 keeps the construction of draft-irtf-cfrg-xchacha (HChaCha20 and the ChaCha20 of RFC 8439), with a 32-bit block counter: the key stream ends after 256 GiB, whereas libsodium and Wycheproof use a 64-bit counter.

Resolved issues

• GH#481: PKCS#1 v1.5 decryption could be used as a Bleichenbacher oracle, through the sentinel returned for ciphertexts with incorrect padding. Calling decrypt() without sentinel (implicit rejection) is now

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

4.3.0 (2 November 2026) ++++++++++++++++++++++++++

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).
• On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available. On a Graviton3, SHA-256 is about 3.8x faster, and SHA-512 2x.
• On 64-bit ARM CPUs, KangarooTwelve, ML-KEM and ML-DSA compute 4 Keccak states at once (2 with scalar code and 2 with NEON). On a Graviton3, KangarooTwelve is 1.9x faster, ML-DSA 7-20% and ML-KEM 7-8%.
• PKCS#1 v1.5 decryption (Crypto.Cipher.PKCS1_v1_5) performs implicit rejection, as defined in section 7.2 of draft-irtf-cfrg-rsa-guidance, when decrypt() is called without a sentinel (which is now optional): when the padding of a ciphertext is not correct, it returns a pseudo-random message, which only depends on the private key and on the ciphertext. With a sentinel, decrypt() behaves as before.

Other changes

• Updated the Wycheproof test vectors (new Ed25519 tests and the new chacha20_counter_test.json). XChaCha20 keeps the construction of draft-irtf-cfrg-xchacha (HChaCha20 and the ChaCha20 of RFC 8439), with a 32-bit block counter: the key stream ends after 256 GiB, whereas libsodium and Wycheproof use a 64-bit counter.

Resolved issues

• GH#481: PKCS#1 v1.5 decryption could be used as a Bleichenbacher oracle,

... (truncated)

Commits

• 7c0fd09 Docs: add task-oriented guides
• 26d2257 Docs: document cipher objects of each mode of operation
• eec12bb Fix docs build: use python3, mock AESNI functions
• 565db25 Bump version
• 0515613 Merge branch 'pkcs1_implicit_rejection'
• ddcc44f Bump test vector version
• bc80919 Fix test_pkcs1_ct on ARM64: no comparison of secret positions with error values
• 4047081 Add the test vectors of draft-irtf-cfrg-rsa-guidance for implicit rejection
• 4751dfe Constant-time check of the PKCS#1 v1.5 and OAEP decoding
• f69dd13 Use implicit rejection for PKCS#1 v1.5 decryption
• Additional commits viewable in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f4abcf99-344a-4ee6-98e5-b59e61f09ba2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn