changelog: add entry for #1821 #1903

1. 
   theStack commented at 4:17 PM on July 31, 2026: contributor

   Even though #1821 has the "needs-changelog" label, it doesn't show up in the search: https://github.com/bitcoin-core/secp256k1/pulls?q=is%3Apr+label%3Aneeds-changelog+is%3Aclosed (probably a bug?). Thanks to @real-or-random for finding this candidate by looking at the commit list manually (which is now also suggested in the release process since #1709).

2. theStack added this to the milestone 0.8.0 on Jul 31, 2026
3. theStack added the label user-documentation on Jul 31, 2026
4. in CHANGELOG.md:18 in 0191fca6ab

     13 | @@ -14,6 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     14 |     - Usage example `examples/silentpayments.c`.
     15 |   - The `silentpayments` API currently requires full access to the transaction data (light client scanning is not implemented).
     16 |  
     17 | +#### Fixed
     18 | + - Module `ellswift`: `secp256k1_ellswift_xdh` now treats secret keys greater than or equal to the curve order as invalid and returns 0. Previously, keys greater than the curve order were silently reduced modulo the order and accepted.
   

   ---

   ---

   

   real-or-random commented at 11:22 AM on August 1, 2026:

    - Module `ellswift`: `secp256k1_ellswift_xdh` now treats secret keys greater than or equal to the curve order as invalid and returns 0 as documented. Previously, keys greater than the curve order were silently reduced modulo the order and accepted. The probability that a securely generated key is greater than the curver is negligible, and thus the old behavior does not constitute a security issue.
   

   ---

   

   theStack commented at 10:29 PM on August 1, 2026:

   Thanks, applied.

5. theStack force-pushed on Aug 1, 2026
6. changelog: add entry for #1821

   Co-authored-by: Tim Ruffing <me@real-or-random.org>

   2076b06a42
7. theStack force-pushed on Aug 1, 2026
8. real-or-random approved
9. 
   real-or-random commented at 10:49 AM on August 2, 2026: contributor

   ACK 2076b06a42b096315ead528acc7fe78da64d8d9c

10. theStack merged this on Aug 2, 2026
11. theStack closed this on Aug 2, 2026

    ---

12. theStack deleted the branch on Aug 2, 2026

Contributors

theStackreal-or-random

Milestone
0.8.0