From 392602e4a5731290c26189db9c4283f1b24ded01 Mon Sep 17 00:00:00 2001
From: Paul Clark <systemslibrarian@gmail.com>
Date: Thu, 20 Aug 2026 02:18:50 -0400
Subject: [PATCH] ci: stop Dependabot grouping crypto crates as
 "rust-non-crypto"

The rust-non-crypto group matched "*" and excluded ml-kem, ml-dsa, hkdf, sha2,
sha3, generic-array, rand_core and zeroize -- but not the dalek crates. So
x25519-dalek and ed25519-dalek, which back the hybrid X25519/Ed25519 KEM and
signature paths, fell through into a group named "non-crypto".

That is how PR #37 came to propose x25519-dalek 2.0 -> 3.0 and ed25519-dalek
2.1 -> 3.0 as a single routine update. It broke the build outright: cargo could
not even resolve, because ed25519-dalek 3.0 removed the `std` feature that
pqf-reader requests. Because pqf-writer path-depends on pqf-reader, all 11
Rust-dependent checks failed while every .NET check passed.

Adds *dalek*, aes-gcm, aead, signature and digest to the exclusions, so anything
implementing or underpinning a cryptographic primitive arrives as its own
reviewable PR. A major bump to any of them is never routine.

After this, the group covers only base64, hex, serde, serde_json and typenum --
genuinely non-cryptographic, which is what the name always claimed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2597ae2..7ea9709 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -45,6 +45,12 @@ updates:
         patterns:
           - "*"
         exclude-patterns:
+          # Anything that implements or underpins a cryptographic primitive is
+          # excluded so it arrives as its own reviewable PR. A major bump to one
+          # of these is never a routine update: x25519-dalek 3.0 and
+          # ed25519-dalek 3.0 arrived grouped as "rust-non-crypto" and broke the
+          # build outright, because ed25519-dalek 3.0 removed the `std` feature
+          # that pqf-reader requests.
           - "ml-kem"
           - "ml-dsa"
           - "hkdf"
@@ -53,6 +59,11 @@ updates:
           - "generic-array"
           - "rand_core"
           - "zeroize"
+          - "*dalek*"
+          - "aes-gcm"
+          - "aead"
+          - "signature"
+          - "digest"
 
   # GitHub Actions. Safe to group everything.
   - package-ecosystem: "github-actions"