Bumps [nh3](https://github.com/messense/nh3) from 0.2.20 to 0.2.21.
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.2.20...v0.2.21)

---
updated-dependencies:
- dependency-name: nh3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Bumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 8 to 9.
- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)
- [Commits](dawidd6/action-download-artifact@20319c5...07ab29f)

---
updated-dependencies:
- dependency-name: dawidd6/action-download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c907a7...d4323d4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.9.7 to 0.9.9.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.9.7...0.9.9)

---
updated-dependencies:
- dependency-name: ruff
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cc](https://github.com/rust-lang/cc-rs) from 1.2.15 to 1.2.16.
- [Release notes](https://github.com/rust-lang/cc-rs/releases)
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/cc-rs@cc-v1.2.15...cc-v1.2.16)

---
updated-dependencies:
- dependency-name: cc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This is now supported in beta dependabot/dependabot-core#10478 (comment)

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

this allows us to see what tests exercised what lines of code

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Move `CertBag` into a `Box` because it is significantly larger than the other enum variants

Bumps [quote](https://github.com/dtolnay/quote) from 1.0.38 to 1.0.39.
- [Release notes](https://github.com/dtolnay/quote/releases)
- [Commits](dtolnay/quote@1.0.38...1.0.39)

---
updated-dependencies:
- dependency-name: quote
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [proc-macro2](https://github.com/dtolnay/proc-macro2) from 1.0.93 to 1.0.94.
- [Release notes](https://github.com/dtolnay/proc-macro2/releases)
- [Commits](dtolnay/proc-macro2@1.0.93...1.0.94)

---
updated-dependencies:
- dependency-name: proc-macro2
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [syn](https://github.com/dtolnay/syn) from 2.0.98 to 2.0.99.
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@2.0.98...2.0.99)

---
updated-dependencies:
- dependency-name: syn
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pkg-config](https://github.com/rust-lang/pkg-config-rs) from 0.3.31 to 0.3.32.
- [Changelog](https://github.com/rust-lang/pkg-config-rs/blob/master/CHANGELOG.md)
- [Commits](rust-lang/pkg-config-rs@0.3.31...0.3.32)

---
updated-dependencies:
- dependency-name: pkg-config
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [bitflags](https://github.com/bitflags/bitflags) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/bitflags/bitflags/releases)
- [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md)
- [Commits](bitflags/bitflags@2.8.0...2.9.0)

---
updated-dependencies:
- dependency-name: bitflags
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

…#12551)

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.7 to 7.0.8.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@dd2324f...271a8d0)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Bumps [indoc](https://github.com/dtolnay/indoc) from 2.0.5 to 2.0.6.
- [Release notes](https://github.com/dtolnay/indoc/releases)
- [Commits](dtolnay/indoc@2.0.5...2.0.6)

---
updated-dependencies:
- dependency-name: indoc
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [unicode-ident](https://github.com/dtolnay/unicode-ident) from 1.0.17 to 1.0.18.
- [Release notes](https://github.com/dtolnay/unicode-ident/releases)
- [Commits](dtolnay/unicode-ident@1.0.17...1.0.18)

---
updated-dependencies:
- dependency-name: unicode-ident
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cc](https://github.com/rust-lang/cc-rs) from 1.2.20 to 1.2.21.
- [Release notes](https://github.com/rust-lang/cc-rs/releases)
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/cc-rs@cc-v1.2.20...cc-v1.2.21)

---
updated-dependencies:
- dependency-name: cc
  dependency-version: 1.2.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Bumps [nox](https://github.com/wntrblm/nox) from 2025.2.9 to 2025.5.1.
- [Release notes](https://github.com/wntrblm/nox/releases)
- [Changelog](https://github.com/wntrblm/nox/blob/main/CHANGELOG.md)
- [Commits](wntrblm/nox@2025.02.09...2025.05.01)

---
updated-dependencies:
- dependency-name: nox
  dependency-version: 2025.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [setuptools](https://github.com/pypa/setuptools) from 80.0.0 to 80.1.0.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v80.0.0...v80.1.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 80.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…12834)

Bumps [uv](https://github.com/astral-sh/uv) from 0.6.17 to 0.7.2.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.6.17...0.7.2)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [openssl-sys](https://github.com/sfackler/rust-openssl) from 0.9.107 to 0.9.108.
- [Release notes](https://github.com/sfackler/rust-openssl/releases)
- [Commits](sfackler/rust-openssl@openssl-sys-v0.9.107...openssl-sys-v0.9.108)

---
updated-dependencies:
- dependency-name: openssl-sys
  dependency-version: 0.9.108
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [uv](https://github.com/astral-sh/uv) from 0.6.17 to 0.7.2.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.6.17...0.7.2)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

its no longer used by any supported version of openbsd

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.11.7 to 0.11.8.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.11.7...0.11.8)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [charset-normalizer](https://github.com/jawah/charset_normalizer) from 3.4.1 to 3.4.2.
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.1...3.4.2)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-version: 3.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This is part 1 of...possibly more than 1.

Bumps [asn1](https://github.com/alex/rust-asn1) from 0.21.0 to 0.21.1.
- [Commits](alex/rust-asn1@0.21.0...0.21.1)

---
updated-dependencies:
- dependency-name: asn1
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Bumps [setuptools](https://github.com/pypa/setuptools) from 80.1.0 to 80.3.1.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v80.1.0...v80.3.1)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 80.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

…performance gains (#12857)

* Add `py311` wheels with faster `PyBuffer` API for significant buffer performance gains

This pull request introduces support for optimized buffer handling using `pyo3::buffer::PyBuffer` on Python 3.11, along with related build system improvements.

- **Optimized buffer access**: On Python 3.11, the `CffiBuf` type now uses `pyo3::buffer::PyBuffer` to significantly speed up operations on small buffers.
- **New wheel builds**: Added publishing of `py311` wheels targeting `abi3-py311` using `pyo3::buffer`.

- **Removed the default `abi3` feature** from the `pyo3` dependency to allow per-build customization. This change ensures that users building locally will receive a wheel compatible with their target system, rather than being restricted to a `py37`-specific wheel. Users can still build a limited wheel with `pip wheel --config-settings="build-args=--features=pyo3/abi3-py37"`.
  **Rationale**: This adjustment ensures that downstream projects, like `piwheels` or Home Assistant, which build their own wheels, won't be unknowingly limited to an `abi3-py37` wheel and missing out on the performance improvements.
- **Added `pyo3-build-config`** as a build dependency to handle feature configuration cleanly.
- **Extended `noxfile.py`** to forward `--features=` args via `build-args` to `pip install`, enabling feature-specific builds in CI.
- **Updated `build.rs`** to print relevant PyO3 build script outputs.
- **Added `Py_3_11` cfg check** in Rust lint configuration to ensure feature-gated code is validated.

- Extended `.github/workflows/ci.yml` to test `rust,tests` jobs under different ABI3 feature flags to match the limited API used in the wheels.
  - `pyo3/abi3-py37`
  - `pyo3/abi3-py39`
  - `pyo3/abi3-py311`
- Extended `.github/workflows/wheel-builder.yml` to include `py311` ABI wheels for CPython 3.11.

- Documented the addition of `py311` wheels with improved buffer performance.

- Updated the documentation with instruction on how to build a wheel with the limited api.

| Benchmark | Base | PR | Delta |
| --------- | ---- | -- | ----- |
| `tests/bench/test_aead.py::test_aesccm_decrypt` | 2675.0 ns | 1480.25 ns | 45% faster |
| `tests/bench/test_aead.py::test_aesccm_encrypt` | 2665.0 ns | 1633.0 ns | 39% faster |
| `tests/bench/test_aead.py::test_aesgcm_decrypt` | 2895.0 ns | 1683.0 ns | 42% faster |
| `tests/bench/test_aead.py::test_aesgcm_encrypt` | 2785.0 ns | 1683.0 ns | 40% faster |
| `tests/bench/test_aead.py::test_aesocb3_decrypt` | 1867.0 ns | 1008.0 ns | 46% faster |
| `tests/bench/test_aead.py::test_aesocb3_encrypt` | 1964.0 ns | 1132.0 ns | 42% faster |
| `tests/bench/test_aead.py::test_aessiv_decrypt` | 1943.5 ns | 1440.25 ns | 26% faster |
| `tests/bench/test_aead.py::test_aessiv_encrypt` | 2034.0 ns | 1533.0 ns | 25% faster |
| `tests/bench/test_aead.py::test_chacha20poly1305_decrypt` | 3357.0 ns | 1893.0 ns | 44% faster |
| `tests/bench/test_aead.py::test_chacha20poly1305_encrypt` | 3346.0 ns | 1884.0 ns | 44% faster |
| `tests/bench/test_ec_load.py::test_load_ec_private_numbers` | 26379.0 ns | 26249.0 ns | 0% faster |
| `tests/bench/test_ec_load.py::test_load_ec_public_numbers` | 15629.0 ns | 15518.0 ns | 1% faster |
| `tests/bench/test_fernet.py::test_fernet_encrypt` | 20197.0 ns | 16811.0 ns | 17% faster |
| `tests/bench/test_hashes.py::test_sha256` | 2495.0 ns | 1994.0 ns | 20% faster |
| `tests/bench/test_hmac.py::test_hmac_sha256` | 3627.0 ns | 2605.0 ns | 28% faster |
| `tests/bench/test_x509.py::test_aki_public_bytes` | 631.0 ns | 641.0 ns | 2% slower |
| `tests/bench/test_x509.py::test_load_der_certificate` | 2985.0 ns | 2925.0 ns | 2% faster |
| `tests/bench/test_x509.py::test_load_pem_certificate` | 14557.0 ns | 14357.0 ns | 1% faster |
| `tests/bench/test_x509.py::test_object_identifier_constructor` | 325.1 ns | 314.6 ns | 3% faster |
| `tests/bench/test_x509.py::test_verify_docs_python_org` | 193217.5 ns | 183409.0 ns | 5% faster |

* Switch len to use bufobj.len_bytes

* Drop py39 wheel builds

* Update src/rust/build.rs

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

* remove unneeded unexpected_cfgs for Py_3_11

* Implement CffiMutBuf with PyBuffer

* Reduce duplicate code

* Additional code de-duplication pass

* Implement Option suggestion

* Implement build backend, revert abi3 feature change

* Revert pyproject.toml, ci.yml, pep517 backend

* Restore noxfile change

* Revert "Restore noxfile change"

This reverts commit 94ff8b3.

* split tests into run_tests so it can be reused

* ruff format

* Revert "ruff format"

This reverts commit 3218106.

* Revert "split tests into run_tests so it can be reused"

This reverts commit d7c364e.

* reimplement as branching

---------

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.30.0 to 20.31.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.30.0...20.31.1)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 20.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Basically: for now we allow them, but when we drop them they'll be dropped everywhere.

Closes #12771
Closes #12748

…12862)

* fixes #12094 -- added support for argon2id phc format

* added secret, use PHC test vector

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>