chore(deps): update module github.com/cloudflare/circl to v1.6.4

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cloudflare/circl	v1.6.3 → v1.6.4

---

Release Notes

cloudflare/circl (github.com/cloudflare/circl)

v1.6.4: CIRCL v1.6.4

Compare Source

What's Changed

• Fix typo: it's to its by @​04cb in #​588
• ci: Bump Go version to 1.26 by @​armfazh in #​591
• tss/rsa: polynomial evaluation using Horner's method by @​armfazh in #​590
• zk/qndleq: Ensure large security parameter by @​armfazh in #​592
• sign/bls: rejects aggregated signatures built with duplicated messages. by @​armfazh in #​595
• Bump golang.org/x/crypto from 0.30.0 to 0.45.0 by @​dependabot[bot] in #​585
• tss/rsa: avoiding overflow in lambda calculation with big.Int by @​armfazh in #​598
• deps: Update CIRCL version in code generators. by @​armfazh in #​599
• ci: add Semgrep OSS scanning workflow by @​hrushikeshdeshpande in #​601
• zk/qndleq: Fixes challenge calculation by @​armfazh in #​596
• sign/bls: Check that signature cannot be the identity point by @​armfazh in #​603
• ml-dsa: Don't use tr pointer by @​bwesterb in #​606
• ecc/bls12381: affinize must handle identity elements. by @​armfazh in #​604
• pki: check pem.Decode returned nil block. by @​z9z in #​607
• abe/cpabe/tkn20: fix AND-gate secret sharing. by @​cjpatton in #​610
• hpke: fix verifyPSKInputs() to match spec. by @​cjpatton in #​612
• hpke: Warn about nonce misuse during marshaling by @​cjpatton in #​613
• hpke: don't panic when parsing on hybrid keys/ciphertexts. by @​cjpatton in #​614
• blindsign/blindrsa: reject non-canonical signatures. by @​cjpatton in #​615
• blindsign/blindrsa: reject message unless co-prime with modulus by @​cjpatton in #​616
• oprf: reject identity element as public key. by @​cjpatton in #​619
• Add AGENTS.md and REVIEW.md for contributor and AI agent guidance by @​dotjs in #​620
• ecc/bls12381: check input length for infinity encoding in SetBytes. by @​bwesterb in #​618
• abe/cpabe/tkn20: bound recursion depth when parsing policies. by @​cjpatton in #​622
• abe/cpabe/tkn20: reject ciphertexts with trailing data. by @​cjpatton in #​621
• abe/cpabe/tkn20: handle short ciphertexts as errors. by @​cjpatton in #​611
• abe/cpabe/tkn20: enforce wire count matches policy. by @​cjpatton in #​624
• abe/cpabe/tkn20: handle malformed ciphertext header. by @​cjpatton in #​623
• abe/cpabe/tkn20: reject circuits with invalid topologies. by @​cjpatton in #​625
• Release CIRCL v1.6.4 by @​cjpatton in #​626

New Contributors

• @​04cb made their first contribution in #​588
• @​z9z made their first contribution in #​607
• @​dotjs made their first contribution in #​620

Full Changelog: cloudflare/circl@v1.6.3...v1.6.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.37%. Comparing base (8859d59) to head (4a7b180).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #360      +/-   ##
==========================================
+ Coverage   72.34%   72.37%   +0.02%     
==========================================
  Files          59       59              
  Lines        7391     7391              
==========================================
+ Hits         5347     5349       +2     
+ Misses       1636     1634       -2     
  Partials      408      408              

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:1:1
    |
  1 | / name: CI
  2 | |
  3 | | on:
  4 | |   push:
...   |
494 | |       - name: Run CLI linter
495 | |         run: make cli-lint
    | |___________________________^ default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/ci.yml:14:3
   |
14 | /   generate:
15 | |     name: Generated Files
16 | |     runs-on: ubuntu-latest
17 | |     container:
...  |
32 | |             exit 1
33 | |           fi
   | |            ^
   | |            |
   | |____________this job
   |              default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/ci.yml:35:3
   |
35 | /   format:
36 | |     name: Format
37 | |     runs-on: ubuntu-latest
38 | |     container:
...  |
51 | |             exit 1
52 | |           fi
   | |            ^
   | |            |
   | |____________this job
   |              default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/ci.yml:54:3
   |
54 | /   lint:
55 | |     name: Lint
56 | |     runs-on: ubuntu-latest
57 | |     container:
...  |
63 | |       - name: Run linter
64 | |         run: make lint
   | |                      ^
   | |                      |
   | |______________________this job
   |                        default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/ci.yml:66:3
   |
66 | /   test-unit:
67 | |     name: Unit Tests
68 | |     runs-on: ubuntu-latest
69 | |     container:
...  |
89 | |           CGO_ENABLED: 1
90 | |         run: make test-unit
   | |                           ^
   | |                           |
   | |___________________________this job
   |                             default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:134:3
    |
134 | /   test-integration:
135 | |     name: Integration Tests
136 | |     runs-on: ubuntu-latest
137 | |     container:
...   |
157 | |           CGO_ENABLED: 1
158 | |         run: make test-integration
    | |                                  ^
    | |                                  |
    | |__________________________________this job
    |                                    default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:330:3
    |
330 | /   security:
331 | |     name: Security
332 | |     runs-on: ubuntu-latest
333 | |     container:
...   |
341 | |           go install golang.org/x/vuln/cmd/govulncheck@latest
342 | |           govulncheck ./...
    | |                           ^
    | |                           |
    | |___________________________this job
    |                             default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:344:3
    |
344 | /   trufflehog:
345 | |     name: Secrets Scan
346 | |     runs-on: ubuntu-latest
347 | |     steps:
...   |
353 | |         with:
354 | |           extra_args: --results=verified,unknown --exclude-globs='protocol/signing/testsigning/**'
    | |                                                                                                  ^
    | |                                                                                                  |
    | |__________________________________________________________________________________________________this job
    |                                                                                                    default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:356:3
    |
356 | /   deps:
357 | |     name: Dependencies
358 | |     runs-on: ubuntu-latest
359 | |     container:
...   |
375 | |           go install github.com/remyoudompheng/go-misc/deadcode@latest
376 | |           deadcode ./... || true
    | |                                ^
    | |                                |
    | |________________________________this job
    |                                  default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:378:3
    |
378 | /   staticcheck:
379 | |     name: Static Analysis
380 | |     runs-on: ubuntu-latest
381 | |     container:
...   |
389 | |           go install honnef.co/go/tools/cmd/staticcheck@latest
390 | |           staticcheck ./...
    | |                           ^
    | |                           |
    | |___________________________this job
    |                             default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:392:3
    |
392 | /   test-clone-perf:
393 | |     name: Clone Performance Tests
394 | |     runs-on: ubuntu-latest
395 | |     container:
...   |
415 | |           cd perf
416 | |           make test-clone-perf
    | |                              ^
    | |                              |
    | |______________________________this job
    |                                default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:418:3
    |
418 | /   test-clone-perf-full:
419 | |     name: Full Clone Performance Test (1 minute limit)
420 | |     runs-on: ubuntu-latest
421 | |     container:
...   |
445 | |           echo "Test will FAIL if clone takes more than 60 seconds"
446 | |           go test -v -timeout 1m -run TestCloneGrafanaGrafanaFullRepository .
    | |                                                                             ^
    | |                                                                             |
    | |_____________________________________________________________________________this job
    |                                                                               default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:448:3
    |
448 | /   cli-build:
449 | |     name: CLI Build
450 | |     runs-on: ubuntu-latest
451 | |     container:
...   |
463 | |           test -f bin/nanogit || (echo "Binary not found" && exit 1)
464 | |           ./bin/nanogit --version
    | |                                 ^
    | |                                 |
    | |_________________________________this job
    |                                   default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:466:3
    |
466 | /   cli-format:
467 | |     name: CLI Format
468 | |     runs-on: ubuntu-latest
469 | |     container:
...   |
482 | |             exit 1
483 | |           fi
    | |            ^
    | |            |
    | |____________this job
    |              default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/ci.yml:485:3
    |
485 | /   cli-lint:
486 | |     name: CLI Lint
487 | |     runs-on: ubuntu-latest
488 | |     container:
...   |
494 | |       - name: Run CLI linter
495 | |         run: make cli-lint
    | |                           ^
    | |                           |
    | |___________________________this job
    |                             default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions