Update module github.com/cloudflare/circl to v1.6.3 (main)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/cloudflare/circl	indirect	patch	v1.6.2 -> v1.6.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cloudflare/circl (github.com/cloudflare/circl)

v1.6.3: CIRCL v1.6.3

Compare Source

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

• sign/mldsa: Check opts for nil value by @​armfazh in https://github.com/cloudflare/circl/pull/582
• ecc/p384: Point addition must handle point doubling case. by @​armfazh in https://github.com/cloudflare/circl/pull/583
• Release CIRCL v1.6.3 by @​armfazh in https://github.com/cloudflare/circl/pull/584

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

---

Configuration

📅 Schedule: Branch creation - "after 1am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[amirbenun]

LGTM, CI passed.

[ebeahan]

Is it possible to backport this bump to the active release branches?

When trying to release Elastic Agent for GKE, I'm seeing the following vulnerability reported on 8.19, 9.2, and 9.3:

{
  "taskReports": [
    {
      "taskType": "CHECK_PACKAGE_VULNERABILITIES",
      "createTime": "2026-03-06T16:12:57.620Z",
      "taskExecutionStatus": "ISSUES_FOUND",
      "digest": "Entity has one or more images with vulnerabilities.",
      "errorMessage": "Packages below are known to contain vulnerabilities. Please update the affected packages and resubmit the solution\n\nImage: https://gcr.io/cloud-launcher-images-prd/prod-elastic-cloud-billing/elastic-agent@sha256:5dc5d1b2d41a4dcc587aac2a13b41b324387ad79da060b24271a1861705f5978\n  Note: CVE-2026-1229\n  Package: github.com/cloudflare/circl\n  Package Type: GO\n  Affected Version: 1.6.1\n  Fixed Version: 1.6.3"
    },
    {
      "taskType": "CHECK_PACKAGE_VULNERABILITIES",
      "createTime": "2026-03-06T16:12:55.002Z",
      "taskExecutionStatus": "ISSUES_FOUND",
      "digest": "Entity has one or more images with vulnerabilities.",
      "errorMessage": "Packages below are known to contain vulnerabilities. Please update the affected packages and resubmit the solution\n\nImage: https://gcr.io/cloud-launcher-images-prd/prod-elastic-cloud-billing/elastic-agent@sha256:11afe740f99fb565b19236692e4072de7b7dac9e991e35c26b693333b47fa565\n  Note: CVE-2026-1229\n  Package: github.com/cloudflare/circl\n  Package Type: GO\n  Affected Version: 1.6.1\n  Fixed Version: 1.6.3"
    },
    {
      "taskType": "CHECK_PACKAGE_VULNERABILITIES",
      "createTime": "2026-03-06T16:12:57.820Z",
      "taskExecutionStatus": "ISSUES_FOUND",
      "digest": "Entity has one or more images with vulnerabilities.",
      "errorMessage": "Packages below are known to contain vulnerabilities. Please update the affected packages and resubmit the solution\n\nImage: https://gcr.io/cloud-launcher-images-prd/prod-elastic-cloud-billing/elastic-agent@sha256:345c4b7bba480532ff4e488b0ff11165962735f02cb601ca3a360205e63b86d1\n  Note: CVE-2026-1229\n  Package: github.com/cloudflare/circl\n  Package Type: GO\n  Affected Version: 1.6.1\n  Fixed Version: 1.6.3"
    }
  ]
}