Trylle

⚠️ Breaking changes

BLS12-381/Jubjub: twisted-Edwards generator corrected (#821) — regenerate points, keys, and signatures derived from the previous generator.
BLS12-381/Bandersnatch EdDSA now runs on Bandersnatch instead of Jubjub (#882) — regenerate keys and signatures.
MamaBear Poseidon2 parameters corrected to R_F = 8, R_P = 32 for 128-bit security (#900) — digests are incompatible with the inherited schedule.
Go 1.26.8 is now required (go.mod), CI runs Go 1.26.x.

ecdsa: reject identity and small-subgroup public keys in SetBytes (#889)
kzg: restore Vk.G1 from the generator in MpcSetup.ReadFrom — a deserialized setup previously carried Vk.G1 = ∞, letting arbitrary nonzero opening proofs verify (#891)
vortex: reject malformed opening proofs that could make a false evaluation claim verify (KoalaBear #896; MamaBear in this PR)
shplonk, fflonk: validate proof shape in BatchVerify to prevent panics (#892)
fft: validate domain cardinality in ReadFrom to prevent panic/OOM (#893)
field vectors: bound the vector length read by AsyncReadFrom (#878)

MamaBear field (49-bit, p = 2⁴⁹ − 2³⁴ + 1): base field with AVX-512 IFMA kernels (R = 2⁵² Montgomery), degree-3 extension (~147-bit security), FFT (max NTT size 2³⁴), Poseidon2, SIS, IOP, and the experimental Vortex commitment scheme (#887)
kzg: Committer interface + OpenWithCommitter / BatchOpenSinglePointWithCommitter for externally accelerated quotient commitments (e.g. WebGPU/wasm MSM) (#879)

MamaBear IFMA vector kernels: mul 22.5×, scalarMul 22.7×, innerProduct 16.5×, sum 15.5× vs pure-Go at 2¹⁴ elements (still 5–9× at 2²⁴); E3 mul −12.5%, square −15.4%, lazy-reduction paths, Poseidon2 −7% (#887)

Full Changelog: https://github.com/Consensys-Incorporated/gnark-crypto/compare/v0.21.0...v0.22.0