[dependabot]

Bumps the minor-and-patch group with 1 update: github.com/emmansun/gmsm.

Updates github.com/emmansun/gmsm from 0.45.0 to 0.45.1

Release notes

Sourced from github.com/emmansun/gmsm's releases.

v0.45.1 (2026-10-23)

This release focuses on correctness fixes, input validation, and security hardening.

Highlights

• Fixed RVV XTS tweak handling for wider vector lengths and a rare ML-DSA AVX2 NTT multiply-accumulate error.
• Hardened SM9 point/key decoding and signature verification, including malformed ASN.1 inputs; improved constant-time behavior in BN256.
• Restricted ML-KEM shared-key slice capacity to prevent callers from reslicing into adjacent secret randomness.
• Made malformed PKCS/CFCA cipher parameters return errors instead of panicking; tightened PKCS#7 BER and ISO 9797-1 Method 2 padding validation.

Testing and Tooling

• Added adversarial semantic vectors for SM2, SM3/KDF, SM4, SM9, ZUC, ML-KEM, ML-DSA, and DER/BER parsing.
• Expanded multi-architecture differential testing and fuzzing. Added gosec scanning and expanded CodeQL coverage.

Documentation and Dependencies

• Added SM2 and SM9 security considerations; made the English README the default and retained the Chinese README.
• Updated golang.org/x/crypto to v0.58.0 and golang.org/x/sys to v0.49.0. The Go baseline remains 1.26.

Compatibility note: SM2 public-key parsing now explicitly requires uncompressed point encoding. Malformed and non-canonical inputs that were previously accepted or could panic are now rejected or return errors.

Commits

• 66403bf Merge pull request #652 from emmansun/develop
• f317715 Merge pull request #651 from emmansun/dependabot/github_actions/develop/step-...
• 251ff9e build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2
• 2e9b13e test(pqc): add ML-DSA and ML-KEM adversarial vectors
• 3f7735f fix(sm9): reject trailing bytes in point keys
• 6431d11 test(zuc): add EEA and EIA semantics vectors
• fe2f89c test(sm9): add key decoding and decryption semantics vectors
• 1810897 test(sm3): add hash and KDF semantics vectors
• f1fb733 fix(sm9): surface the exported ErrDecryption from Decrypt
• 8069d09 fix(sm9): reject empty and identity key encodings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions