Skip to content

chore(deps): bump github.com/cloudflare/circl from v1.6.1 to v1.6.3 [SECURITY]#68

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-github.com-cloudflare-circl-vulnerability
Open

chore(deps): bump github.com/cloudflare/circl from v1.6.1 to v1.6.3 [SECURITY]#68
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-github.com-cloudflare-circl-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 27, 2026

This PR contains the following updates:

Package Change Age Confidence
github.com/cloudflare/circl v1.6.1v1.6.3 age confidence

Warning

Deprecated preset: Kong/public-shared-renovate:backend

Your config references a deprecated preset. To prevent disruption, this file now builds on the org default (Kong/public-shared-renovate) and layers a few backend-specific tweaks so behavior stays close to the historical backend configuration.

What's different from the default

  • Early Monday schedule windows (schedule:earlyMondays)
  • Automerge disabled for all updates (:automergeDisabled)
  • Renovate rate limiting disabled (:disableRateLimiting)
  • Standardized commit messages (semantic type chore and clear bump from → to subjects)

Recommended migration

Prefer switching to the default preset and applying only the bits you still need locally. Example configuration to replicate this preset's behavior on top of the default:

{
  "extends": [
    "Kong/public-shared-renovate",
    "schedule:earlyMondays",
    ":automergeDisabled",
    ":disableRateLimiting",
    ":semanticCommitTypeAll(chore)"
  ],
  "packageRules": [
    {
      "matchPackageNames": ["*"],
      "commitMessageAction": "bump",
      "commitMessageLowerCase": "never",
      "commitMessageTopic": "github.com/cloudflare/circl",
      "commitMessageExtra": "from v1.6.1 to v1.6.3"
    }
  ]
}

Timeline

This compatibility alias will be removed in January 2026. Please migrate to the default preset with local overrides before then.

GitHub Vulnerability Alerts

CVE-2026-1229

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.
ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3.


CIRCL has an incorrect calculation in secp384r1 CombinedMult

CVE-2026-1229 / GHSA-q9hv-hpm4-hj6x / GO-2026-4550

More information

Details

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.
ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3.

Severity

  • CVSS Score: 2.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl

CVE-2026-1229 / GHSA-q9hv-hpm4-hj6x / GO-2026-4550

More information

Details

CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).


Release Notes

cloudflare/circl (github.com/cloudflare/circl)

v1.6.3: CIRCL v1.6.3

Compare Source

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

v1.6.2: CIRCL v1.6.2

Compare Source

CIRCL v1.6.2
  • New SLH-DSA, improvements in ML-DSA for arm64.
  • Tested compilation on WASM.
What's Changed
New Contributors

Full Changelog: cloudflare/circl@v1.6.1...v1.6.2


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…SECURITY]

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants