chore(deps): bump ecdsa from 0.19.1 to 0.19.2

[dependabot]

Bumps ecdsa from 0.19.1 to 0.19.2.

Release notes

Sourced from ecdsa's releases.

0.19.2

Bug fixes:

• Fix CVE-2026-33936, a DER parsing issue in remove_octet_string(), remove_constructed(), and remove_implitic() where a truncated buffer wasn't detected. This can lead to high level functions, like SigningKey.from_der() to raise unexpected exceptions. (Mohamed Abdelaal (0xmrma))

Maintenance:

• Update CI to use newer version of Ubuntu.

Changelog

Sourced from ecdsa's changelog.

• Release 0.19.2 (26 Mar 2026)

Bug fixes:

• Fix CVE-2026-33936, a DER parsing issue in remove_octet_string(), remove_constructed(), and remove_implitic() where a truncated buffer wasn't detected. This can lead to high level functions, like SigningKey.from_der() to raise unexpected exceptions. (Mohamed Abdelaal (0xmrma))

Maintenance:

• Update CI to use newer version of Ubuntu.

• Release 0.19.1 (13 Mar 2025)

New API:

• der.remove_implitic and der.encode_implicit for decoding and encoding DER IMPLICIT values with custom tag values and arbitrary classes

Bug fixes:

• Minor fixes around arithmetic with curves that have non-prime order (useful for experimentation, not practical deployments)
• Fix arithmetic to work with curves that have (0, 0) on the curve
• Fix canonicalization of signatures when s is just slightly above half of curve order

Maintenance:

• Dropped official support for Python 3.5 (again, issues with CI, support for Python 2.6 and Python 2.7 is unchanged)

• Officialy support Python 3.12 and 3.13 (add them to CI)

• Removal of few more unnecessary six.b literals (Alexandre Detiste)

• Fix typos in warning messages

• Release 0.19.0 (08 Apr 2024)

New API:

• to_ssh in VerifyingKey and SigningKey, supports Ed25519 keys only (Pablo Mazzini)

New features:

• Support for twisted Brainpool curves

Doc fix:

• Fix curve equation in glossary
• Documentation for signature encoding and signature decoding functions

Maintenance:

• Dropped official support for 3.3 and 3.4 (because of problems running them in CI, not because it's actually incompatible; support for 2.6 and 2.7 is

... (truncated)

Commits

• bd66899 Merge commit from fork
• 9c046ee tests: reject truncated DER lengths
• acc40fd der: reject truncated lengths in octet/implicit/constructed
• 55aca78 Merge pull request #363 from gstarovo/ubuntu20-deprecation
• c4f0df1 chore: change to ubuntu-22 since u-20 is deprecated
• See full diff in compare view