Update dependency pynacl to v1.6.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pynacl	1.5.0 → 1.6.2

---

libsodium has Incomplete List of Disallowed Inputs

CVE-2025-69277 / GHSA-mrfv-m5wm-5w6w

More information

Details

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's supported ecosystems that are affected by this vulnerability due to a vulnerable dependency.

Severity

• CVSS Score: 4.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-69277
• https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
• https://00f.net/2025/12/30/libsodium-vulnerability
• https://ianix.com/pub/ed25519-deployment.html
• https://news.ycombinator.com/item?id=46435614
• https://github.com/paragonie/sodium_compat/commit/2cb48f26130919f92f30650bdcc30e6f4ebe45ac
• https://github.com/paragonie/sodium_compat/commit/4714da6efdc782c06690bc72ce34fae7941c2d9f
• https://github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/sodium_compat/2025-12-30.yaml
• https://github.com/pyca/pynacl/issues/920
• https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
• https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
• https://github.com/hdwallet-io/python-hdwallet/pull/124
• https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html
• https://github.com/advisories/GHSA-mrfv-m5wm-5w6w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pyca/pynacl (pynacl)

v1.6.2

Compare Source

• Updated libsodium to 1.0.20-stable (2025-12-31 build) to resolve
  CVE-2025-69277.

v1.6.1

Compare Source

• The MAKE environment variable can now be used to specify the make
  binary that should be used in the build process.

v1.6.0

Compare Source

• BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and 3.7.
• Added support for the low level AEAD AES bindings.
• Added support for crypto_core_ed25519_from_uniform.
• Update libsodium to 1.0.20-stable (2025-08-27 build).
• Added support for free-threaded Python 3.14.
• Added support for Windows on ARM wheels.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.