blst

• add Zig bindings
• accept zero-length salt in blst_kegen_v5 (spec doesn't formally prohibit it)
• harden some interfaces
• refine carry chains in mulx_mont modules
• align with latest Python, Swig, Node.js
• add support for Node-API

Essential changes:

• lift the limitation for 384-bit modular inversion, which doesn't benefit BLS12-381 applications, but future-proofs blst_t.hpp, a generic interface to assembly modules
• harden ptype##s_mult_wbits
• tolerate infinity points even in ptype##s_precompute_wbits
• smooth some edges in bindings/blst.hpp
• add sub_aggregate method to Rust bindings

Essential changes:

• add support for ARM64 Branch Branch Target Identification extension
• smooth edges in blst_t.hpp, the "private" interface for sppark
• tolerate infinite points in the batch to-affine conversion
• fine-tune MSM for small amounts of inputs

Essential changes:

• make Go binding work with Go 1.24
• harmonize with the new C23 standard
• make bindings/blst.swg work with Python 3.13 and swig 4.3

Essential changes:

• rectify the API omissions in no_std
• add aggregate-with-randomness interface

Essential changes:

• add support for x86_64-fortanix-unknown-sgx Rust target
• add support for Windows on ARM64
• add support for ARM Morello, a CHERI platform
• harden secret-key operations against power-monitoring attacks

Essential changes:

• security bugfix in Go bindings
• run-time switch in portable build
• no-std support [exercised with limited stack size of 56K]
• serde support
• blst_miller_loop_n interface, with parallelized Rust and Go counterparts
• optional blst_fr_pentaroot subroutine
• Emscripten bindings
• hardened security on non-asm platforms

Add draft-irtf-cfrg-bls-signature-05 keygen.
Add C# bindings.

[As for missing v0.3.9 release tag. The v0.3.8 had a Rust packaging error and had to be swiftly yanked from crates.io and replaced with 3b28d0f.]

Add legacy key generation/derivation procedures.
Add fp12 serialization.

Bug fixes for FR inverse mod
Improved performance of group checks
Improved parallelism in pippenger, toaffine, and add