v2026.10.2

• mult_pub_key, ecies.derive_keys, dsa.assert_as_valid,
  dsa.assert_as_valid_ and dsa.sign_'s pub_key refuse a hybrid public
  key (prefix 0x06 or 0x07) as not a public key (closes #75). With
  btclib-secp256k1 installed they accepted it, and without it they refused
  it.

  Act on it if you pass such a key: convert it first, with
  point_from_octets(key, hybrid=True), and pass the point.

• pedersen.verify raises BTClibEccValueError for a generator off the
  curve, at infinity or, on a cofactor curve, outside the subgroup generated
  by G (closes #76). Before, it answered False for an off-curve generator
  and True for an opening under INF, which opens to every value.
  On a cofactor curve second_generator returns a different H where its old
  H was outside the subgroup, as at sha256 on secp112r2 and secp128r2.

  Act on it if you pass a generator of your own: pass one from
  second_generator or generator_from_seed, or catch BTClibEccValueError.
  Commitments made under that old H no longer verify.

• Verifying a release's attestation names a new signer and the tag.
  gh attestation verify takes
  --signer-workflow btclib-org/.github/.github/workflows/reusable-build.yml@refs/heads/main
  and --source-ref refs/tags/v<version>; SECURITY.md has the command.
  Earlier releases keep reusable-attest.yml and take the same
  --source-ref.

• ssa signs with a different nonce on a curve whose order is longer than
  the hash's output, such as sha256 on secp384r1 or secp521r1
  (GHSA-m38m-987v-j55h). Every other pair, secp256k1 with sha256 included,
  signs as before, and old signatures still verify.

  Act on it if you signed with ssa on such a pair: rotate the key, and
  re-pin any deterministic signature you stored.

• On a curve of cofactor above 1 (secp112r2, secp128r2), ssa refuses a
  public key outside the subgroup generated by G, and batch verification
  refuses an r whose point is outside it (GHSA-r5pw-9wrg-m3mj). Before, a
  forged signature verified under such a key, which nobody holds. secp256k1 is
  unchanged.

  Act on it if you verified ssa signatures on one of these curves with an
  earlier release: verify them again. One under a key outside the subgroup now
  fails. This entry was added after the release; RELEASE_NOTES.md records it
  under v2026.11.

• musig2.partial_sig_verify raises BTClibEccValueError for a signer
  index outside 0..len(pub_keys)-1 (closes #78). A negative index used to
  select a signer from the end.

  Act on it if you pass one: pass the index counted from the front.

• FROST takes only an int where it takes an integer (closes #77, closes
  #79). n, t, an id and the signer index raise BTClibEccTypeError for
  anything else, a bool, a float or a str included, where int() converted
  n, t and the ids. partial_sig_verify_ raises for an id not in ids.

  Act on it if you pass such a value: pass an int.