Update dusk-bls12_381 to 0.16 and dusk-jubjub to 0.16

[HDauven]

Resolves #1011

• Update the registry dependencies on dusk-bls12_381 and dusk-jubjub to the published 0.16 releases.
• BlsScalar limbs are crate-private in 0.16: build the -1 constant in Composer with BlsScalar::one().neg(), which evaluates at compile time to the same limbs, and read limbs in the ECC test through internal_repr(). A test pins MINUS_ONE to its previous limbs.
• bls 0.16's msm_variable_base panics on fewer bases than scalars, and the degree check in CommitKey::commit skips leading zero coefficients. commit now calls try_msm_variable_base and returns Error::PolynomialDegreeTooLarge when a polynomial has more coefficients than the key has powers. The verifier builds its points and scalars in pairs.
• Since dusk-jubjub 0.16, is_on_curve rejects Z = 0 without projecting; the comments that said otherwise are corrected.

make test (37 groups), make clippy and make no-std pass locally.

[Copilot]

🟢 Approval recommended

The compatibility changes are focused, correctly preserve prior behavior, and are covered by the reported validation suites.

0 open findings

What changed in this PR

Updates core cryptographic dependencies to their published 0.16 releases and adapts private scalar-limb access.

Changes:

• Upgrades dusk-bls12_381 and dusk-jubjub.
• Replaces direct scalar limb access with supported APIs.
• Documents the dependency update.

File	Description
Cargo.toml	Updates dependency versions.
src/​composer.rs	Constructs negative one through const arithmetic.
tests/​ecc.rs	Uses internal_repr() for scalar limbs.
CHANGELOG.md	Records the upgrade and issue reference.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.27%. Comparing base (9570302) to head (a634f1f).
⚠️ Report is 5 commits behind head on master.

Files with missing lines	Patch %	Lines
src/fft/polynomial.rs	0.00%	3 Missing ⚠️
src/commitment_scheme/kzg10/key.rs	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1012      +/-   ##
==========================================
- Coverage   92.31%   92.27%   -0.04%     
==========================================
  Files          80       81       +1     
  Lines        8924     8886      -38     
==========================================
- Hits         8238     8200      -38     
  Misses        686      686              

Files with missing lines	Coverage Δ
src/composer.rs	91.30% <ø> (-0.08%)	⬇️
src/composer/fixed_base.rs	91.56% <ø> (-1.21%)	⬇️
src/composer/point.rs	100.00% <ø> (ø)
src/composer/tests.rs	100.00% <100.00%> (ø)
tests/ecc.rs	96.33% <100.00%> (-0.08%)	⬇️
src/commitment_scheme/kzg10/key.rs	93.79% <88.88%> (-0.12%)	⬇️
src/fft/polynomial.rs	80.00% <0.00%> (-1.19%)	⬇️

... and 12 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9570302...a634f1f. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[moCello]

APPROVE — The bump is complete and the new -1 constant has the same limbs as the old literal, so nothing gates the merge.

• Agreed with herr-seppia's request for a comparison test. The new constant equals the old literal limb for limb, and a test can pin that: compare *BlsScalar::one().neg().internal_repr() with the old limb array. It does not gate the merge, because MINUS_ONE only selects a fast path.
• Optional: CommitKey::commit checks polynomial.degree(), but since bls 0.15 msm_variable_base panics on slice length. A polynomial with trailing zeros and len() > powers_of_g.len() passes the guard and panics. Today only the trimming in src/fft/polynomial.rs prevents that, not the degree check. Calling try_msm_variable_base and mapping InsufficientBases to Error::PolynomialDegreeTooLarge makes the guard cover the slice the MSM consumes.
• Optional: since dusk-jubjub 0.16, JubJubExtended::is_on_curve returns false on Z = 0 without projecting. Two comments now give a false reason for the Z check, because they describe the internals of a dependency. Reduce the doc on reject_degenerate_z (src/composer/point.rs) to what this code needs: Z = 0 is no point, so reject it before projecting to affine. In component_mul_generator (src/composer/fixed_base.rs), delete the "Check Z first" comment.

[HDauven]

Force-pushed 8fc1c006 with the review notes folded in:

• MINUS_ONE is pinned to its previous limbs by a test (see the thread on src/composer.rs).
• CommitKey::commit calls try_msm_variable_base and maps InsufficientBases to Error::PolynomialDegreeTooLarge. The new test_commit_rejects_polynomial_longer_than_key commits a degree-0 polynomial with one coefficient more than the key has powers; it panicked before the change.
• The reject_degenerate_z doc now only says that Z = 0 is no point and is rejected before projecting, and the stale "Check Z first" comment is gone.

[moCello]

APPROVE — The new test pins the old limbs of MINUS_ONE, commit now guards the slice the MSM consumes, and the two named comments no longer describe dusk-jubjub internals.

• Point 3 of my review: two test comments in tests/ecc.rs still say that is_on_curve projects and would panic on Z = 0. In the doc on zero_z_point, keep only what the test needs: the point has Z = 0 and the honest generator's numerators, so only the Z guard separates it from a valid point. In append_constant_point_separates_its_rejection_branches, reduce the comment to "Degenerate representation: refused before the membership check."
• The pull request description is stale. It says the stricter msm_variable_base "cannot trigger" because commits are degree-checked. Update it to name the length guard in CommitKey::commit.

[HDauven]

Force-pushed a634f1fd: the zero_z_point doc and the comment in append_constant_point_separates_its_rejection_branches no longer describe dusk-jubjub internals, and the description now names the length guard in CommitKey::commit.