v0.22.0

[ivokub]

v0.22.0 release preparation

Updates release metadata for v0.22.0 (compare: v0.21.0...v0.22.0):

• README.md — feature list refreshed (Bandersnatch companion curve, MamaBear field + extensions degrees per field, Vortex availability) and citation bumped to v0.22.0.
• CITATION.bib — bumped to v0.22.0 (oct 2026).
• CHANGELOG.md — new v0.22.0 entry covering everything since v0.21.0.
• Go / deps — Go 1.26.8 in go.mod, CI bumped to Go 1.26.x, direct deps bumped (bitset 1.25.0, testify 1.12.1, x/crypto 0.57.0, x/sync 0.23.0, x/sys 0.48.0) and tool deps (x/tools 0.50.0, x/mod 0.41.0, x/telemetry), go mod tidy.
• MamaBear Vortex hardening — carries the malformed-proof rejection from fix: reject malformed Vortex opening proofs #896 (KoalaBear) to the MamaBear Vortex implementation added in Feat: Add MamaBear field support #887: requires the configured codeword length in the Reed–Solomon check and validates proof shape (opening counts, selected-column bounds, opened-column lengths, Merkle path depths) in Verify before any indexing. Regression tests ported from fix: reject malformed Vortex opening proofs #896 (oversized UAlpha false-claim forgery, plus a malformed-opening matrix). Without this, a proof carrying an unchecked UAlpha suffix could make a false evaluation claim verify.

⚠️ Breaking changes

• BLS12-381/Jubjub: twisted-Edwards generator corrected (#821) — regenerate points, keys, and signatures derived from the previous generator.
• BLS12-381/Bandersnatch EdDSA now runs on Bandersnatch instead of Jubjub (#882) — regenerate keys and signatures.
• MamaBear Poseidon2 parameters corrected to R_F = 8, R_P = 32 for 128-bit security (#900) — digests are incompatible with the inherited schedule.
• Go 1.26.8 is now required (go.mod), CI runs Go 1.26.x.

🔒 Security

• ecdsa: reject identity and small-subgroup public keys in SetBytes (#889)
• kzg: restore Vk.G1 from the generator in MpcSetup.ReadFrom — a deserialized setup previously carried Vk.G1 = ∞, letting arbitrary nonzero opening proofs verify (#891)
• vortex: reject malformed opening proofs that could make a false evaluation claim verify (KoalaBear #896; MamaBear in this PR)
• shplonk, fflonk: validate proof shape in BatchVerify to prevent panics (#892)
• fft: validate domain cardinality in ReadFrom to prevent panic/OOM (#893)
• field vectors: bound the vector length read by AsyncReadFrom (#878)

✨ New

• MamaBear field (49-bit, p = 2⁴⁹ − 2³⁴ + 1): base field with AVX-512 IFMA kernels (R = 2⁵² Montgomery), degree-3 extension (~147-bit security), FFT (max NTT size 2³⁴), Poseidon2, SIS, IOP, and the experimental Vortex commitment scheme (#887)
• kzg: Committer interface + OpenWithCommitter / BatchOpenSinglePointWithCommitter for externally accelerated quotient commitments (e.g. WebGPU/wasm MSM) (#879)

⚡ Faster

• MamaBear IFMA vector kernels: mul 22.5×, scalarMul 22.7×, innerProduct 16.5×, sum 15.5× vs pure-Go at 2¹⁴ elements (still 5–9× at 2²⁴); E3 mul −12.5%, square −15.4%, lazy-reduction paths, Poseidon2 −7% (#887)

✅ Test plan

• go build ./...
• go test -short ./... — 210 packages ok
• go test -tags=purego ./... — 210 packages ok
• go generate ./... — no unexpected generated-file drift (the MamaBear Vortex files are hand-written by design, per Feat: Add MamaBear field support #887; their guards mirror fix: reject malformed Vortex opening proofs #896 rather than coming from a template)
• git diff --check — clean

---

Note

High Risk
Release bundles multiple breaking cryptographic changes and security fixes; this PR adds MamaBear Vortex verification hardening where malformed proofs could previously accept false claims.

Overview
Prepares v0.22.0 release metadata: new CHANGELOG.md entry (breaking curve/Poseidon2 changes, security fixes, MamaBear field, KZG Committer, Go 1.26), README feature/citation updates (Bandersnatch, MamaBear, Vortex), and CITATION.bib bumped to v0.22.0.

Build: go.mod requires Go 1.26.8; PR and push workflows use Go 1.26.x; direct and tool dependencies refreshed (bitset, testify, x/crypto, x/sync, x/sys, x/tools, etc.).

Security (in-tree): Hardens MamaBear Vortex Verify to match KoalaBear (#896)—nil proof, exact UAlpha length, selected-column/opening/Merkle shape checks, and claim count bounds before indexing; IsReedSolomonCodewords rejects wrong-length codewords. Adds regression tests for oversized/forged UAlpha and malformed openings.

^{Reviewed by Cursor Bugbot for commit d24bd91. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.54.0 ⏵ v0.57.0	+1
	golang.org/​x/​sys@​v0.47.0 ⏵ v0.48.0	+1
	github.com/​stretchr/​testify@​v1.11.1 ⏵ v1.12.1	-6
	golang.org/​x/​sync@​v0.22.0 ⏵ v0.23.0	+1
	github.com/​bits-and-blooms/​bitset@​v1.24.6 ⏵ v1.25.0	+1

View full report