From df44fd1f715e430e4efc1756ed88703d0be76cd5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 02:25:05 +0000 Subject: [PATCH 1/2] build(deps): bump the rust-non-crypto group across 1 directory with 2 updates Updates the requirements on [x25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) and [ed25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) to permit the latest version. Updates `x25519-dalek` to 3.0.0 - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/3.0.0/CHANGELOG.md) - [Commits](https://github.com/dalek-cryptography/curve25519-dalek/compare/2.0.0...3.0.0) Updates `ed25519-dalek` to 2.2.0 - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Commits](https://github.com/dalek-cryptography/curve25519-dalek/compare/2.1.0...ed25519-2.2.0) --- updated-dependencies: - dependency-name: x25519-dalek dependency-version: 3.0.0 dependency-type: direct:production dependency-group: rust-non-crypto - dependency-name: ed25519-dalek dependency-version: 2.2.0 dependency-type: direct:production dependency-group: rust-non-crypto ... Signed-off-by: dependabot[bot] --- impl/rust/pqf-reader/Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/impl/rust/pqf-reader/Cargo.toml b/impl/rust/pqf-reader/Cargo.toml index 33cf366..adc339a 100644 --- a/impl/rust/pqf-reader/Cargo.toml +++ b/impl/rust/pqf-reader/Cargo.toml @@ -16,7 +16,7 @@ path = "src/bin/conformance.rs" [dependencies] # Hybrid KEM -x25519-dalek = { version = "2.0", features = ["static_secrets"] } +x25519-dalek = { version = "3.0", features = ["static_secrets"] } # ml-kem 0.3 moved KemCore to `kem::Kem`, replaced `EncodedSizeUser` with # the (deprecated but interop-required) `ExpandedKeyEncoding` trait, and # moved per-parameter type aliases (Ciphertext, DecapsulationKey) into @@ -28,7 +28,7 @@ x25519-dalek = { version = "2.0", features = ["static_secrets"] } ml-kem = "0.3.0" # Hybrid signatures -ed25519-dalek = { version = "2.1", features = ["std"] } +ed25519-dalek = { version = "3.0", features = ["std"] } # ml-dsa 0.1 routes the `signature::Verifier::verify` trait method to # FIPS 204 Algorithm 8 (no domain separator). BouncyCastle's pure # ML-DSA-87 signs with Algorithm 3 (with the empty-context prefix), so From e39ab94670584241b3cd7cd2114342bb0c092297 Mon Sep 17 00:00:00 2001 From: Paul Clark Date: Thu, 20 Aug 2026 02:32:30 -0400 Subject: [PATCH 2/2] =?UTF-8?q?fix(rust):=20ed25519-dalek=203.0=20removed?= =?UTF-8?q?=20the=20`std`=20feature=20=E2=80=94=20use=20`alloc`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #37 bumps x25519-dalek 2.0 -> 3.0 and ed25519-dalek 2.1 -> 3.0, and cargo could not even resolve the dependency graph: error: failed to select a version for `ed25519-dalek`. package `pqf-reader` depends on `ed25519-dalek` with feature `std` but `ed25519-dalek` does not have that feature. ed25519-dalek 3.0 went no_std-first and dropped `std`, which in 2.1.1 was ["alloc", "ed25519/std", "serde?/std", "sha2/std"]. Its default is now ["fast", "zeroize"], and `alloc` is the surviving equivalent of what this crate needs. x25519-dalek 3.0 still has `static_secrets`, so that line was already correct. Because pqf-writer path-depends on pqf-reader, nothing Rust-side resolved, which is why all 11 Rust-dependent checks failed while every .NET check passed. Verified locally against the real toolchain, not by inspection: cargo build --release (pqf-reader) clean cargo build --release (pqf-writer) clean cargo test --release (pqf-writer) 12 passed, 0 failed cargo run --bin pqf-conformance pass=47 fail=0 skipped=0 cargo build --target wasm32-unknown-unknown (bindings/wasm) clean The conformance run is the one that matters: it includes TV-NEG-011 (refused: SignatureVerificationFailure), so Ed25519 verification still behaves correctly under dalek 3.0 and curve25519-dalek 5.0, and all 47 vectors agree with the .NET implementation. Co-Authored-By: Claude Opus 5 --- impl/rust/pqf-reader/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/impl/rust/pqf-reader/Cargo.toml b/impl/rust/pqf-reader/Cargo.toml index adc339a..c4bf695 100644 --- a/impl/rust/pqf-reader/Cargo.toml +++ b/impl/rust/pqf-reader/Cargo.toml @@ -28,7 +28,7 @@ x25519-dalek = { version = "3.0", features = ["static_secrets"] } ml-kem = "0.3.0" # Hybrid signatures -ed25519-dalek = { version = "3.0", features = ["std"] } +ed25519-dalek = { version = "3.0", features = ["alloc"] } # ml-dsa 0.1 routes the `signature::Verifier::verify` trait method to # FIPS 204 Algorithm 8 (no domain separator). BouncyCastle's pure # ML-DSA-87 signs with Algorithm 3 (with the empty-context prefix), so