Bump paragonie/sodium_compat from 2.1.0 to 2.5.0 in /wcfsetup/install/files/lib/system/api

[dependabot]

Bumps paragonie/sodium_compat from 2.1.0 to 2.5.0.

Release notes

Sourced from paragonie/sodium_compat's releases.

Version 2.5.0

Security Fix

Read: A vulnerability in libsodium

This fixes a congruent issue in the main branch of the PHP implementation.

For older PHP versions, see v1.24.0 instead.

Version 2.4.0

The biggest change (besides unit testing) in this release is the optimization of Curve25519 field arithmetic by using object properties instead of an internal array. This skips some internal overhead in PHP (i.e., hash tables and memory allocation) that we ultimately never needed.

Beyond that, we mostly expanded our unit test coverage. We're running Infection to identify code that can be mutated without the test suite failing, and it's identified a lot of false positives but also some useful information. The end result? We've fixed a few bugs.

What's Changed

• Optimize curve25519 field element by removing array by @​paragonie-security in paragonie/sodium_compat#198
• Remove dead or redundant code of Util::(strlen|substr) by @​takaram in paragonie/sodium_compat#201
• Improve Unit Testing Coverage by @​paragonie-security in paragonie/sodium_compat#200
• Bigfixes and Improved Test Coverage by @​paragonie-security in paragonie/sodium_compat#202

New Contributors

• @​takaram made their first contribution in paragonie/sodium_compat#201

Full Changelog: paragonie/sodium_compat@v2.3.1...v2.4.0

Version 2.3.1

Deletes the erroneous PSR-0 autoloader declaration from composer.json, fixing #196

Full Changelog: paragonie/sodium_compat@v2.3.0...v2.3.1

Version 2.3.0

[!IMPORTANT] The previous version of sodium_compat was overly permissible with sodium_base642bin() when the *_NO_PADDING variants were specified, which was not compatible with ext-sodium. This has been fixed in v2.3.0.

If you need the old behavior in the meantime, you can call ParagonIE_Core_Base64_Original::decode() or ParagonIE_Core_Base64_UrlSafe:decode() to get lax padding enabled.

Aside from this fix, most of the changes were to the unit test suite in order to improve our mutation testing metrics.

What's Changed

• Fix CI for Fuzz/Mutation Tests by @​paragonie-security in paragonie/sodium_compat#190
• Update .gitattributes for psalm files by @​erikn69 in paragonie/sodium_compat#192
• Fix flaky test for PHP 8.1+ by @​paragonie-security in paragonie/sodium_compat#193
• Test enhancements + base64 no-padding fix by @​paragonie-security in paragonie/sodium_compat#194

New Contributors

• @​erikn69 made their first contribution in paragonie/sodium_compat#192

Full Changelog: paragonie/sodium_compat@v2.2.0...v2.3.0

Version 2.2.0 of Sodium_Compat is mostly a maintenance release. Some dev-dependencies were changed in order to facilitate mutation and fuzz testing in CI. No significant changes to the src directory were required as a result of this additional testing.

... (truncated)

Commits

• 4714da6 Ensure public key is on the prime order subgroup
• 547e2dc Merge pull request #202 from paragonie/unit-tests-extra-pedantic
• 9692f5d Set minimum to 70% for now
• ee771c8 Add more to ignore list
• d64bcad Do this instead of disabling
• d5ed935 Disable on PHP 8.5+
• 57d0d0b We can skip this too
• f789c25 Ignore test coverage for memzero
• 8af6b53 Cover more bad inputs
• 79609bb Improve file tests, fix AEGIS state tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.