[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cloudflare/circl	v1.6.3 → v1.6.5

---

Release Notes

cloudflare/circl (github.com/cloudflare/circl)

v1.6.5: CIRCL v1.6.5

Compare Source

What's Changed

• ascon: don't output plaintext if authentication fails by @​bwesterb in #​631
• Dilithium: don't accept signatures with trailing data by @​bwesterb in #​632
• Fix HPKE/KEM exact-length key unmarshaling by @​drmikecrypto in #​627
• Bump x/crypto and golangci-lint by @​bwesterb in #​637
• ecc/bls12381: reject trailing data in G1/G2 SetBytes by @​bwesterb in #​636
• eddilithium: fail verification if signature is wrong length by @​bwesterb in #​633
• tss/rsa: fix length check to prevent runtime out-of-bounds panic by @​bwesterb in #​640
• dleq: verify: return false instead of panic()ing on nil parameters by @​bwesterb in #​641
• ed448: document verification behaviour by @​bwesterb in #​642
• ed448: reject non-canonical point encodings by @​bwesterb in #​635
• slhdsa: ensure full reads when rand source is provided by @​bwesterb in #​634
• ed{25519,448}: don't accept trailing data for keys by @​bwesterb in #​643
• frodo: pack: fix accidental zero buffer assumption by @​bwesterb in #​645
• secretsharing: check that share ID is not zero. by @​bwesterb in #​644
• kyber: document pk isn't checked like ML-KEM by @​bwesterb in #​648
• zk/dleq: Don't accept trailing data on proof by @​bwesterb in #​649
• slhdsa: don't panic if prehash-hash is out of range by @​bwesterb in #​647
• goldilocks: don't panic when unmarshalling invalid point by @​bwesterb in #​646
• hpke: don't panic when unmarshalling opener/sealer from empty buffer by @​bwesterb in #​656
• ot/simot: don't panic on mismatched ciphertext lengths by @​bwesterb in #​655
• fourq: document point decoding is lenient by @​bwesterb in #​654
• oprf: add note on multiple Point encodings by @​bwesterb in #​653
• tss/rsa: don't panic when combining empty list of shares by @​bwesterb in #​652
• ecc/p384: document that package is not fully constant time by @​bwesterb in #​651
• ristretto: reject non-canonical scalars by @​bwesterb in #​650
• Add more explicit constant time warnings by @​bwesterb in #​638
• mlsbset: make Encode() constant time by @​bwesterb in #​639
• mlsbset: fix stray index in Encode comment by @​lukevalenta in #​658
• removeLen32Prefixed: check for possible data overflow by @​mdosch in #​629
• expander: panic if requested output length overflows DST. by @​cjpatton in #​664
• zk/dleq: add base point a to challenge derivation. by @​cjpatton in #​663
• dh/sidh: document Import() side-effect for kem/sike. by @​cjpatton in #​662
• ecc/fourq: improve constant-timeness of fpSgn, fqSqrt. by @​cjpatton in #​666
• blinsign/blindrsa/partiallyblindrsa: reject malformed moduli. by @​cjpatton in #​665
• blindsign/blindrsa: align PSSZERO behavior with RFC 9474. by @​cjpatton in #​660
• ecc/fourq: fix fqSqr arithmetic error on amd64 by @​cjpatton in #​659
• README: warn that not all packages are constant time by @​frangelbarrera in #​668
• internal/test: unify ACVP test vector parsing by @​ihopenre-eng in #​667
• blindrsa: fix interface documentation by @​bwesterb in #​672
• ecc/fourq: fix legacy (non-BMI2) GF(p^2) multiplication on amd64 by @​bwesterb in #​669
• p384: document assumed reductions by @​bwesterb in #​670
• ed25519: document another divergence with crypto/ed25519 by @​bwesterb in #​671
• prio3/histogram: don't panic on measurement equal to the bucket count by @​bwesterb in #​673
• zk/qndleq: document Qn membership precondition by @​bwesterb in #​675
• vdaf/prio3: require all prep shares by @​bwesterb in #​676
• vdaf/prio3: document prep sequencing requirement by @​bwesterb in #​677
• zk/dl: reject identity proof inputs by @​bwesterb in #​678
• tss/rsa: document trusted modulus requirement by @​bwesterb in #​680
• dh/csidh: harden key imports by @​bwesterb in #​689
• zk/dleq: validate batch shape by @​bwesterb in #​684
• ot/simot: make sender sessions one-shot by @​bwesterb in #​679
• vdaf/prio3/sum: reject unsafe measurement bounds by @​bwesterb in #​682
• tss/rsa: validate sign share protocol parameters by @​bwesterb in #​674
• vdaf/prio3/sum: reject aggregate field overflow by @​bwesterb in #​681
• vdaf/prio3: validate preparation inputs by @​bwesterb in #​683
• oprf: reject invalid deterministic blinds by @​bwesterb in #​688
• vdaf/prio3: reject degenerate parameters by @​bwesterb in #​685
• oprf: validate finalize state by @​bwesterb in #​687

New Contributors

• @​drmikecrypto made their first contribution in #​627
• @​lukevalenta made their first contribution in #​658
• @​mdosch made their first contribution in #​629
• @​frangelbarrera made their first contribution in #​668
• @​ihopenre-eng made their first contribution in #​667

Full Changelog: cloudflare/circl@v1.6.4...v1.6.5

v1.6.4: CIRCL v1.6.4

Compare Source

What's Changed

• Fix typo: it's to its by @​04cb in #​588
• ci: Bump Go version to 1.26 by @​armfazh in #​591
• tss/rsa: polynomial evaluation using Horner's method by @​armfazh in #​590
• zk/qndleq: Ensure large security parameter by @​armfazh in #​592
• sign/bls: rejects aggregated signatures built with duplicated messages. by @​armfazh in #​595
• Bump golang.org/x/crypto from 0.30.0 to 0.45.0 by @​dependabot[bot] in #​585
• tss/rsa: avoiding overflow in lambda calculation with big.Int by @​armfazh in #​598
• deps: Update CIRCL version in code generators. by @​armfazh in #​599
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​601
• zk/qndleq: Fixes challenge calculation by @​armfazh in #​596
• sign/bls: Check that signature cannot be the identity point by @​armfazh in #​603
• ml-dsa: Don't use tr pointer by @​bwesterb in #​606
• ecc/bls12381: affinize must handle identity elements. by @​armfazh in #​604
• pki: check pem.Decode returned nil block. by @​z9z in #​607
• abe/cpabe/tkn20: fix AND-gate secret sharing. by @​cjpatton in #​610
• hpke: fix verifyPSKInputs() to match spec. by @​cjpatton in #​612
• hpke: Warn about nonce misuse during marshaling by @​cjpatton in #​613
• hpke: don't panic when parsing on hybrid keys/ciphertexts. by @​cjpatton in #​614
• blindsign/blindrsa: reject non-canonical signatures. by @​cjpatton in #​615
• blindsign/blindrsa: reject message unless co-prime with modulus by @​cjpatton in #​616
• oprf: reject identity element as public key. by @​cjpatton in #​619
• Add AGENTS.md and REVIEW.md for contributor and AI agent guidance by @​dotjs in #​620
• ecc/bls12381: check input length for infinity encoding in SetBytes. by @​bwesterb in #​618
• abe/cpabe/tkn20: bound recursion depth when parsing policies. by @​cjpatton in #​622
• abe/cpabe/tkn20: reject ciphertexts with trailing data. by @​cjpatton in #​621
• abe/cpabe/tkn20: handle short ciphertexts as errors. by @​cjpatton in #​611
• abe/cpabe/tkn20: enforce wire count matches policy. by @​cjpatton in #​624
• abe/cpabe/tkn20: handle malformed ciphertext header. by @​cjpatton in #​623
• abe/cpabe/tkn20: reject circuits with invalid topologies. by @​cjpatton in #​625
• Release CIRCL v1.6.4 by @​cjpatton in #​626

New Contributors

• @​04cb made their first contribution in #​588
• @​z9z made their first contribution in #​607
• @​dotjs made their first contribution in #​620

Full Changelog: cloudflare/circl@v1.6.3...v1.6.4

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.