Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

This update for libsodium fixes the following issues: Update to 1.0.22 (jsc#PED-16890): * Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the crypto_kem_mlkem768_*() functions. * X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection against both classical and quantum adversaries, is available through the crypto_kem_*() functions. X-Wing is the recommended KEM for most applications. * SHA-3 hash functions are now available as crypto_hash_sha3256_*() and crypto_hash_sha3512_*(), with both one-shot and streaming APIs. * Performance: NEON optimizations for Argon2 on ARM platforms. * Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when available on ARM platforms. * Performance: WebAssembly SIMD implementations of Argon2 have been added. * XOF state alignment has been relaxed. * crypto_core_keccak1600_state has been added. * Export missing crypto_ipcrypt_nd_keygen() helper function. * crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now accept NULL key pointers (with a zero key length), for consistency with other _init functions. * Fixed compilation with GCC on aarch64 and gcc 4.x. * On aarch64, aes256-gcm is now enabled even when not using clang, including MSVC. * Libsodium can be directly used as a dependency in a Zig project. Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277): * The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses. * The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings. * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are * standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more. * Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers * Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options. * Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero * A cross-compilation issue with old clang versions has been fixed * crypto_aead_aes256gcm_is_available is exported to JavaScript * Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete * Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation. Update to 1.0.20: * build system updates and portability fixes Includes changes from 1.0.19: * New AEADs: AEGIS-128L and AEGIS-256 * The HKDF key derivation mechanism, required by many standard protocols - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been - Emscripten: UTF8ToString() is now exported since - New target: WebAssembly/WASI - New functions to map a hash to an edwards25519 point or get a random point: - crypto_core_ed25519_scalar_mul() has been implemented for - Support for the Ristretto group has been implemented for - Bug fix: sodium_pad() didn't properly support block sizes - JS/WebAssembly: some old iOS versions can't instantiate the crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike - Added a workaround for Visual Studio 2010 bug causing CPU - New low-level APIs for arithmetic mod the order of the prime - crypto_core_ed25519_scalar_random(), - crypto_core_ed25519_scalar_invert(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). * AVX2 detection is more reliable. Intel platforms. crypto_generichash() is now faster than MD5 and * In addition to sodium_bin2hex(), sodium_hex2bin() is now a * crypto_generichash_statebytes(), crypto_auth_*_statebytes() and crypto_hash_*_statebytes() have been added in order to retrieve the size of structures keeping states from foreign * The JavaScript target doesn't require /dev/urandom or an external randombytes() implementation any more. Other minor Emscripten-related improvements have been made in order to * Custom randombytes implementations do not need to provide their own implementation of randombytes_uniform() any more. randombytes_stir() and randombytes_close() can also be NULL * On Linux, getrandom(2) is being used instead of directly accessing /dev/urandom, if the kernel supports this system Also libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.

Where it's fixed