[hoangchunghien]

Closes: #16561

stubtest failed on the stubsabot bump with one error: paramiko.kex_mlkem failed to find stubs. paramiko 5.1 adds that module for the mlkem768x25519-sha256 hybrid key exchange (ML-KEM-768 with X25519), and Transport prefers it when it is available.

The new kex_mlkem.pyi follows kex_curve25519.pyi: the two message constants, and KexMLKEM768X25519 with name, hash_algo, transport, the two private keys, is_available, start_kex and parse_next.

mlkem_key holds a cryptography.hazmat.primitives.asymmetric.mlkem.MLKEM768PrivateKey, which only exists from cryptography 48, while these stubs require cryptography>=37.0.0. Rather than raise that floor, I typed it as Incomplete | None with a comment. Happy to switch to the real type and bump the dependency if you prefer.

stubtest for paramiko 5.1, mypy_test.py stubs/paramiko, pyright_test.py stubs/paramiko (with cryptography installed), black, ruff and flake8 pass locally.

[srittau]

Suggested change

	c_MSG_KEX_HYBRID_INIT: bytes
	c_MSG_KEX_HYBRID_REPLY: bytes
	c_MSG_KEX_HYBRID_INIT: Final = b"\x1e"
	c_MSG_KEX_HYBRID_REPLY: Final = b"\x1f"

[srittau]

Suggested change

	name: str
	name: Final = "mlkem768x25519-sha256"

[srittau]

Suggested change

	hash_algo: Callable[[ReadableBuffer], _Hash]
	hash_algo: ClassVar[Callable[[ReadableBuffer], _Hash]]

[srittau]

Suggested change

	mlkem_key: Incomplete | None
	mlkem_key: MLKEM768PrivateKey | None

This needs import from from cryptography.hazmat.primitives.asymmetric. This also requires cryptography >= 47.0.0. I think it's fine to bump the dependency in METADATA.toml.

[hoangchunghien]

Thanks, all four applied. I checked the versions: cryptography.hazmat.primitives.asymmetric.mlkem first ships in 47.0.0 (it is missing in 46.0.0), so the comment I had saying 48 was wrong. METADATA.toml now requires cryptography>=47.0.0.

[github-actions]

According to mypy_primer, this change has no effect on the checked open source code. 🤖🎉