Latest libsodium-1.0.18-stable.tar.gz.

git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@4193 ed5197a5-7fde-0310-b194-c3ffbd925b24
2023-02-19 23:23:53 +00:00 · 2023-02-19 23:23:53 +00:00 · 961109635b
commit 961109635b
parent 86bc46a11e
44 changed files with 2426 additions and 1477 deletions
--- a/deps/libsodium/.github/workflows/ci.yml
+++ b/deps/libsodium/.github/workflows/ci.yml
@ -12,13 +12,14 @@ jobs:
  tcc:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3

      - name: Update packages list
        run: sudo apt-get update

      - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake tcc
+        run: |
+          sudo apt-get install -y build-essential libtool autoconf automake tcc

      - name: Autogen
        run: ./autogen.sh -s
@ -31,10 +32,40 @@ jobs:
          make uninstall
          make distclean

+  zig:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: |
+          curl -sL -o - https://ziglang.org/download/0.10.1/zig-linux-x86_64-0.10.1.tar.xz | tar xJ -f - -C /opt/
+          sudo mv /opt/zig-* /opt/zig
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Compilation with zig
+        run: |
+          export PATH=/opt/zig:$PATH
+          zig build
+          zig build -Dtarget=x86_64-linux
+          zig build -Dtarget=aarch64-linux
+          zig build -Dtarget=x86_64-windows
+          zig build -Dtarget=aarch64-windows
+          zig build -Dtarget=x86_64-macos
+          zig build -Dtarget=aarch64-macos
+          zig build -Dtarget=wasm32-wasi
+          zig build -Drelease-fast
+          rm -fr zig-cache zig-out
+
  regular:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3

      - name: Update packages list
        run: sudo apt-get update
@ -63,7 +94,7 @@ jobs:
  check-globals:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3

      - name: Update packages list
        run: sudo apt-get update
@ -81,7 +112,7 @@ jobs:
  other-comp:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3

      - name: Update packages list
        run: sudo apt-get update
@ -107,7 +138,7 @@ jobs:
  other-arch:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3

      - name: Update packages list
        run: sudo apt-get update
@ -123,3 +154,28 @@ jobs:
          env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking --host=powerpc-linux-gnu
          make -j $(nproc)
          make clean > /dev/null
+
+  android:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install base dependencies
+        run: sudo apt-get install -y libtool autoconf automake unzip
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Install Android NDK
+        run: |
+          mkdir /tmp/android && cd /tmp/android
+          curl -o ndk.zip -L https://dl.google.com/android/repository/android-ndk-r25b-linux.zip
+          unzip ndk.zip && rm -f *.zip && mv android-ndk* ndk
+
+      - name: Android compilation
+        run: |
+          env ANDROID_NDK_HOME=/tmp/android/ndk ./dist-build/android-x86.sh
+          env ANDROID_NDK_HOME=/tmp/android/ndk ./dist-build/android-armv8-a.sh
--- a/deps/libsodium/.github/workflows/codeql-analysis.yml
+++ b/deps/libsodium/.github/workflows/codeql-analysis.yml
@ -12,12 +12,12 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
        with:
          fetch-depth: 2

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
        with:
          languages: cpp

@ -27,4 +27,4 @@ jobs:
          make -j $(nproc) check

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2
--- a/deps/libsodium/.github/workflows/dotnet-core.yml
+++ b/deps/libsodium/.github/workflows/dotnet-core.yml
@ -10,187 +10,182 @@ jobs:
  build-windows:
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
      - name: buildbase.bat
        run: buildbase.bat ..\vs2022\libsodium.sln 17
        working-directory: builds/msvc/build/
        shell: cmd
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: build-win-x64
          path: bin/x64/Release/v143/dynamic/libsodium.dll
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: build-win-x86
          path: bin/Win32/Release/v143/dynamic/libsodium.dll

  build-linux-glibc:
    runs-on: ubuntu-latest
-    container:
-      image: ubuntu:16.04
    steps:
-      - name: Set up build environment
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
        run: |
-          apt-get update && apt-get install -y build-essential
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build
-      - name: make
-        run: make
-      - name: make check
-        run: make check
-      - name: make install
-        run: make install
-      - name: strip
-        run: strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
+          zig build -Drelease-fast -Dtarget=x86_64-linux-gnu.2.17
+      - name: tests
+        run: cd zig-out/bin && ./run.sh
+      - uses: actions/upload-artifact@v3
        with:
          name: build-linux-x64
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so
+
+  build-linux-glibc-arm:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - name: Fix ARM support
+        run: |
+          curl -L https://raw.githubusercontent.com/ziglang/zig/master/lib/libc/glibc/sysdeps/arm/arm-features.h | sudo tee /opt/hostedtoolcache/zig/zig-linux-x86_64-*/x64/lib/libc/glibc/sysdeps/arm/sysdep.h >/dev/null
+      - name: Set up emulation environment
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update
+          sudo apt-get install -y build-essential qemu binfmt-support qemu-user-static qemu-system-arm gcc-arm-linux-gnueabihf libc6-armhf-cross
+          sudo dpkg --add-architecture armhf
+          sudo update-binfmts --enable qemu-arm
+          sudo update-binfmts --display
+          sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.* /lib
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=arm-linux-gnueabihf.2.23
+      - name: tests
+        run: |
+          cd zig-out/bin && env LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib ./run.sh
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-arm
+          path: zig-out/lib/libsodium.so

  build-linux-glibc-arm64:
    runs-on: ubuntu-latest
-    container:
-      image: ubuntu:16.04
    steps:
-      - name: Set up build environment
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - name: Set up emulation environment
        run: |
          export DEBIAN_FRONTEND=noninteractive
-
-          cat <<-EOF | tee /etc/apt/sources.list.d/arm64.list >/dev/null
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial main restricted
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates main restricted
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial universe
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates universe
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial multiverse
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates multiverse
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-backports main restricted universe multiverse
-          EOF
-
-          sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
-
-          dpkg --add-architecture arm64
-
-          apt-get update && apt-get install -y build-essential qemu-user qemu-user-static gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libstdc++6:arm64
-
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build --host=aarch64-linux-gnu
-      - name: make
-        run: make -j $(nproc)
-
-      - name: make check
-        # Disable make check on this platform
-        if: ${{ false }}
+          sudo apt-get update
+          sudo apt-get install -y qemu binfmt-support qemu-user-static qemu-system-arm gcc-aarch64-linux-gnu libc6-arm64-cross
+          sudo dpkg --add-architecture arm64
+          sudo update-binfmts --enable qemu-aarch64
+          sudo update-binfmts --display
+          sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.* /lib
+      - uses: actions/checkout@v3
+      - name: build
        run: |
-          make check
-
-      - name: make install
-        run: make install
-
-      - name: strip
-        run: aarch64-linux-gnu-strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
+          zig build -Drelease-fast -Dtarget=aarch64-linux-gnu.2.23
+      - name: tests
+        run: |
+          cd zig-out/bin && env LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib ./run.sh
+      - uses: actions/upload-artifact@v3
        with:
          name: build-linux-arm64
-          path: .libsodium-build/lib/libsodium.so
-
-  build-linux-glibc-arm:
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Set up build environment
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-
-          cat <<-EOF | sudo tee /etc/apt/sources.list.d/armhf.list >/dev/null
-          deb [arch=armhf] http://ports.ubuntu.com/ focal main restricted
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates main restricted
-          deb [arch=armhf] http://ports.ubuntu.com/ focal universe
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates universe
-          deb [arch=armhf] http://ports.ubuntu.com/ focal multiverse
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates multiverse
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse
-          EOF
-
-          sudo sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
-
-          sudo dpkg --add-architecture armhf
-
-          sudo apt-get update && sudo apt-get install -y build-essential qemu-user qemu-user-static gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf libstdc++6:armhf
-
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build --host=arm-linux-gnueabihf
-      - name: make
-        run: make -j $(nproc)
-
-      - name: make check
-        run: |
-          make check
-
-      - name: make install
-        run: make install
-
-      - name: strip
-        run: arm-linux-gnueabihf-strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
-        with:
-          name: build-linux-arm
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so

  build-linux-musl:
    runs-on: ubuntu-latest
    container:
-      image: alpine:3.15
+      image: alpine:3.13
    steps:
      - name: Set up build environment
        run: |
          apk update
-          apk add alpine-sdk ca-certificates
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build
-      - name: make
-        run: make
-      - name: make check
-        run: make check
-      - name: make install
-        run: make install
-      - name: strip
-        run: strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
+          apk add alpine-sdk ca-certificates xz
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=x86_64-linux-musl
+      - name: tests
+        run: |
+          cd zig-out/bin && ./run.sh
+      - uses: actions/upload-artifact@v3
        with:
          name: build-linux-musl-x64
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so
+
+  build-linux-musl-arm:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=arm-linux-musleabihf
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-musl-arm
+          path: zig-out/lib/libsodium.so
+
+  build-linux-musl-arm64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=aarch64-linux-musl
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-musl-arm64
+          path: zig-out/lib/libsodium.so

  build-macos-x64:
-    runs-on: macos-11
+    runs-on: macos-latest
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
      - name: configure
-        run: env CFLAGS="-O2 -arch x86_64 -mmacosx-version-min=10.10" LDFLAGS="-arch x86_64 -mmacosx-version-min=10.10" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
+        run: env CFLAGS="-Ofast -arch x86_64 -mmacosx-version-min=10.15" LDFLAGS="-arch x86_64 -mmacosx-version-min=10.15" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
      - name: make
        run: make
      - name: make check
        run: make check
      - name: make install
        run: make install
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: build-osx-x64
          path: .libsodium-build/lib/libsodium.dylib

  build-macos-arm64:
-    runs-on: macos-11
+    runs-on: macos-latest
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
      - name: configure
-        run: env CFLAGS="-O2 -arch arm64 -mmacosx-version-min=10.10" LDFLAGS="-arch arm64 -mmacosx-version-min=10.10" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
+        run: env CFLAGS="-Ofast -arch arm64 -mmacosx-version-min=10.15" LDFLAGS="-arch arm64 -mmacosx-version-min=10.15" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
      - name: make
        run: make
      - name: make install
        run: make install
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: build-osx-arm64
          path: .libsodium-build/lib/libsodium.dylib
@ -203,6 +198,8 @@ jobs:
      - build-linux-glibc-arm
      - build-linux-glibc-arm64
      - build-linux-musl
+      - build-linux-musl-arm
+      - build-linux-musl-arm64
      - build-macos-x64
      - build-macos-arm64
    container:
@ -212,36 +209,44 @@ jobs:
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/download-artifact@v2
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
        with:
          name: build-win-x64
          path: .libsodium-pack/runtimes/win-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-win-x86
          path: .libsodium-pack/runtimes/win-x86/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-linux-x64
          path: .libsodium-pack/runtimes/linux-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-linux-arm64
          path: .libsodium-pack/runtimes/linux-arm64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-linux-arm
          path: .libsodium-pack/runtimes/linux-arm/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-linux-musl-x64
          path: .libsodium-pack/runtimes/linux-musl-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-linux-musl-arm
+          path: .libsodium-pack/runtimes/linux-musl-arm/native/
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-linux-musl-arm64
+          path: .libsodium-pack/runtimes/linux-musl-arm64/native/
+      - uses: actions/download-artifact@v3
        with:
          name: build-osx-x64
          path: .libsodium-pack/runtimes/osx-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: build-osx-arm64
          path: .libsodium-pack/runtimes/osx-arm64/native/
@ -249,7 +254,7 @@ jobs:
        run: cp AUTHORS ChangeLog LICENSE packaging/dotnet-core/libsodium.pkgproj .libsodium-pack/
      - name: Create NuGet package
        run: dotnet pack -c Release .libsodium-pack/libsodium.pkgproj
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: nuget-package
          path: .libsodium-pack/bin/Release/*.nupkg
@ -265,8 +270,8 @@ jobs:
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/download-artifact@v2
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
        with:
          name: nuget-package
          path: .libsodium-pack/
@ -291,7 +296,7 @@ jobs:
          mv .libsodium-test/bin/Release/net6.0/linux-arm/publish .libsodium-builds/linux-arm
          mv .libsodium-test/bin/Release/net6.0/linux-arm64/publish .libsodium-builds/linux-arm64
          mv .libsodium-test/bin/Release/net6.0/linux-x64/publish .libsodium-builds/linux-x64
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
        with:
          name: test-builds
          path: .libsodium-builds/*
@ -302,14 +307,14 @@ jobs:
    - build-test-binaries
    strategy:
      matrix:
-        # CentOS 7 and Debian 9 use an older GCC version; make sure we can run on those platforms.
-        arch: [ 'centos:7', 'debian:9' ]
+        # CentOS 7 and Debian 10 use an older GCC version; make sure we can run on those platforms.
+        arch: [ 'centos:7', 'debian:10' ]
    container:
      image: ${{ matrix.arch }}
    env:
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
    steps:
-    - uses: actions/download-artifact@v2
+    - uses: actions/download-artifact@v3
      with:
        name: test-builds
        path: .libsodium-builds/
@ -319,37 +324,42 @@ jobs:
        .libsodium-builds/linux-x64/Tests

  run-test-binaries-cross-plat:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
    needs:
      - build-test-binaries
    env:
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
    strategy:
      matrix:
+        include:
+          - arch: x64
+            libs: /usr/lib
+          - arch: arm
+            libs: /usr/arm-linux-gnueabihf/lib
+          - arch: arm64
+            libs: /usr/aarch64-linux-gnu/lib
        arch: [x64, arm, arm64]
    steps:
      - name: Set up build environment
        run: |
          export DEBIAN_FRONTEND=noninteractive

-          cat <<-EOF | sudo tee /etc/apt/sources.list.d/multiarch.list >/dev/null
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal main restricted
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates main restricted
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal universe
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates universe
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal multiverse
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates multiverse
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse
-          EOF
-
-          sudo sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
+          # On virtualization systems such as the one used by WSL2, the ARM crypto extensions
+          # don't work as expected. As a result, installing on Ubuntu fails during integrity
+          # checks. As a workaround, the following command disables hardware acceleration for
+          # gcrypt, which the apt-get command relies on.
+          sudo mkdir -p /etc/gcrypt && echo all | sudo tee /etc/gcrypt/hwf.deny

+          sudo apt-get update && sudo apt-get install -y qemu binfmt-support qemu-user-static qemu-system-arm gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu libc6-armhf-cross libc6-arm64-cross
          sudo dpkg --add-architecture armhf
          sudo dpkg --add-architecture arm64
+          sudo update-binfmts --enable qemu-aarch64
+          sudo update-binfmts --enable qemu-arm
+          sudo update-binfmts --display
+          sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.* /lib
+          sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.* /lib

-          sudo apt-get update && sudo apt-get install -y qemu-user qemu-user-static libstdc++6:armhf libstdc++6:arm64
-
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
        with:
          name: test-builds
          path: .libsodium-builds/
@ -357,4 +367,4 @@ jobs:
      - name: Run ${{ matrix.arch }}
        run: |
          chmod +x .libsodium-builds/linux-${{ matrix.arch }}/Tests
-          .libsodium-builds/linux-${{ matrix.arch }}/Tests
+          env LD_LIBRARY_PATH=${{ matrix.libs }} .libsodium-builds/linux-${{ matrix.arch }}/Tests
--- a/deps/libsodium/AUTHORS
+++ b/deps/libsodium/AUTHORS
@ -45,8 +45,7 @@ siphash                                Jean-Philippe Aumasson
 Implementors
 ============

-crypto_aead/aes256gcm/aesni            Romain Dolbeau
-                                       Frank Denis
+crypto_aead/aes256gcm/aesni            Frank Denis

 crypto_aead/chacha20poly1305           Frank Denis

--- a/deps/libsodium/LICENSE
+++ b/deps/libsodium/LICENSE
@ -1,7 +1,7 @@
 /*
 * ISC License
 *
- * Copyright (c) 2013-2022
+ * Copyright (c) 2013-2023
 * Frank Denis <j at pureftpd dot org>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
--- a/deps/libsodium/azure-pipelines.yml
+++ b/deps/libsodium/azure-pipelines.yml
@ -16,12 +16,13 @@ jobs:
          curl https://get.wasmer.io -sSfL | sh
        displayName: Install wasmer
      - script: |
-          curl -sL -o - https://ziglang.org/download/0.8.1/zig-linux-x86_64-0.8.1.tar.xz | tar xJ -f - -C /opt/
+          curl -sL -o - https://ziglang.org/download/0.10.1/zig-linux-x86_64-0.10.1.tar.xz | tar xJ -f - -C /opt/
          sudo mv /opt/zig-* /opt/zig
-          env PATH=/opt/zig/bin:/opt/zig:$PATH
+          export PATH=/opt/zig/bin:/opt/zig:$PATH
        displayName: Install the Zig SDK
      - script: |
-          env WASMER_DIR=${HOME}/.wasmer PATH=${HOME}/.wasmer/bin:${HOME}/.cargo/bin:$PATH dist-build/wasm32-wasi.sh
+          . ~/.wasmer/wasmer.sh
+          dist-build/wasm32-wasi.sh
        displayName: Compile libsodium
      - task: PublishBuildArtifacts@1
        condition: not(canceled())
@ -67,26 +68,12 @@ jobs:
          pathToPublish: bin
          artifactName: libsodium

-  - job: "windows_old"
-    pool:
-      vmImage: "vs2017-win2016"
-    steps:
-      - powershell: |
-          cd builds\msvc\build
-          & .\buildbase.bat ..\vs2017\libsodium.sln 15
-        displayName: Compile it all
-      - task: PublishBuildArtifacts@1
-        condition: not(canceled())
-        inputs:
-          pathToPublish: bin
-          artifactName: libsodium
-
  - job: mingw64
    pool:
      vmImage: "windows-2019"
    steps:
      - powershell: |
-          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2021-07-25/msys2-base-x86_64-20210725.sfx.exe", "sfx.exe")
+          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2022-12-16/msys2-base-x86_64-20221216.sfx.exe", "sfx.exe")
          .\sfx.exe -y -o\
          del sfx.exe
        displayName: Install MSYS2
--- a/deps/libsodium/build-aux/config.sub
+++ b/deps/libsodium/build-aux/config.sub
@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2022 Free Software Foundation, Inc.
+#   Copyright 1992-2023 Free Software Foundation, Inc.

 # shellcheck disable=SC2006,SC2268 # see below for rationale

-timestamp='2022-01-03'
+timestamp='2023-01-21'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@ -76,7 +76,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)

-Copyright 1992-2022 Free Software Foundation, Inc.
+Copyright 1992-2023 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@ -145,7 +145,7 @@ case $1 in
 			nto-qnx* | linux-* | uclinux-uclibc* \
 			| uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \
 			| netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \
-			| storm-chaos* | os2-emx* | rtmk-nova*)
+			| storm-chaos* | os2-emx* | rtmk-nova* | managarm-*)
 				basic_machine=$field1
 				basic_os=$maybe_os
 				;;
@ -1075,7 +1075,7 @@ case $cpu-$vendor in
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		cpu=i586
 		;;
-	pentiumpro-* | p6-* | 6x86-* | athlon-* | athalon_*-*)
+	pentiumpro-* | p6-* | 6x86-* | athlon-* | athlon_*-*)
 		cpu=i686
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
@ -1207,7 +1207,7 @@ case $cpu-$vendor in
 			| k1om \
 			| le32 | le64 \
 			| lm32 \
-			| loongarch32 | loongarch64 | loongarchx32 \
+			| loongarch32 | loongarch64 \
 			| m32c | m32r | m32rle \
 			| m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | m68k \
 			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
@ -1341,6 +1341,10 @@ EOF
 		kernel=linux
 		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
 		;;
+	managarm*)
+		kernel=managarm
+		os=`echo "$basic_os" | sed -e 's|managarm|mlibc|'`
+		;;
 	*)
 		kernel=
 		os=$basic_os
@ -1754,7 +1758,7 @@ case $os in
 	     | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
 	     | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
 	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
-	     | fiwix* )
+	     | fiwix* | mlibc* )
 		;;
 	# This one is extra strict with allowed versions
 	sco3.2v2 | sco3.2v[4-9]* | sco5v6*)
@ -1762,6 +1766,9 @@ case $os in
 		;;
 	none)
 		;;
+	kernel* )
+		# Restricted further below
+		;;
 	*)
 		echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2
 		exit 1
@ -1772,16 +1779,26 @@ esac
 # (given a valid OS), if there is a kernel.
 case $kernel-$os in
 	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \
-		   | linux-musl* | linux-relibc* | linux-uclibc* )
+		   | linux-musl* | linux-relibc* | linux-uclibc* | linux-mlibc* )
 		;;
 	uclinux-uclibc* )
 		;;
-	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* )
+	managarm-mlibc* | managarm-kernel* )
+		;;
+	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* | -mlibc* )
 		# These are just libc implementations, not actual OSes, and thus
 		# require a kernel.
 		echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2
 		exit 1
 		;;
+	-kernel* )
+		echo "Invalid configuration \`$1': \`$os' needs explicit kernel." 1>&2
+		exit 1
+		;;
+	*-kernel* )
+		echo "Invalid configuration \`$1': \`$kernel' does not support \`$os'." 1>&2
+		exit 1
+		;;
 	kfreebsd*-gnu* | kopensolaris*-gnu*)
 		;;
 	vxworks-simlinux | vxworks-simwindows | vxworks-spe)
--- a/deps/libsodium/build.zig
+++ b/deps/libsodium/build.zig
@ -1,30 +1,38 @@
 const std = @import("std");
-const builtin = @import("builtin");
 const fmt = std.fmt;
 const fs = std.fs;
 const heap = std.heap;
 const mem = std.mem;
 const LibExeObjStep = std.build.LibExeObjStep;
+const Target = std.Target;

 pub fn build(b: *std.build.Builder) !void {
    const src_path = "src/libsodium";
-    const src_dir = try fs.Dir.openDir(fs.cwd(), src_path, .{ .iterate = true, .no_follow = true });
+    const src_dir = try fs.Dir.openIterableDir(fs.cwd(), src_path, .{ .no_follow = true });

-    var target = b.standardTargetOptions(.{});
-    var mode = b.standardReleaseOptions();
+    const target = b.standardTargetOptions(.{});
+    const mode = b.standardReleaseOptions();

+    const enable_benchmarks = b.option(bool, "enable_benchmarks", "Whether tests should be benchmarks.") orelse false;
+    const benchmarks_iterations = b.option(u32, "iterations", "Number of iterations for benchmarks.") orelse 200;
+
+    const shared = b.addSharedLibrary(
+        if (target.isWindows()) "sodium_shared" else "sodium",
+        null,
+        .unversioned,
+    );
    const static = b.addStaticLibrary("sodium", null);
-    const shared = b.addSharedLibrary("sodium", null, .unversioned);
    shared.strip = true;
    static.strip = true;

-    const libs = [_]*LibExeObjStep{ static, shared };
+    const libs_ = [_]*LibExeObjStep{ shared, static };
+    const libs = if (target.getOsTag() == .wasi) libs_[1..] else libs_[0..];

    const prebuilt_version_file_path = "builds/msvc/version.h";
    const version_file_path = "include/sodium/version.h";

-    if (src_dir.access(version_file_path, .{ .mode = .read_only })) {} else |_| {
-        try fs.cwd().copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{});
+    if (src_dir.dir.access(version_file_path, .{ .mode = .read_only })) {} else |_| {
+        try fs.cwd().copyFile(prebuilt_version_file_path, src_dir.dir, version_file_path, .{});
    }

    for (libs) |lib| {
@ -36,13 +44,95 @@ pub fn build(b: *std.build.Builder) !void {
        }
        lib.linkLibC();

-        lib.addIncludeDir("src/libsodium/include/sodium");
+        lib.addIncludePath("src/libsodium/include/sodium");
+        lib.defineCMacro("_GNU_SOURCE", "1");
        lib.defineCMacro("CONFIGURED", "1");
        lib.defineCMacro("DEV_MODE", "1");
-        lib.defineCMacro("_GNU_SOURCE", "1");
-        lib.defineCMacro("HAVE_INLINE_ASM", "1");
-        lib.defineCMacro("HAVE_TI_MODE", "1");
        lib.defineCMacro("HAVE_ATOMIC_OPS", "1");
+        lib.defineCMacro("HAVE_C11_MEMORY_FENCES", "1");
+        lib.defineCMacro("HAVE_GCC_MEMORY_FENCES", "1");
+        lib.defineCMacro("HAVE_INLINE_ASM", "1");
+        lib.defineCMacro("HAVE_INTTYPES_H", "1");
+        lib.defineCMacro("HAVE_STDINT_H", "1");
+        lib.defineCMacro("HAVE_TI_MODE", "1");
+
+        if (target.cpu_arch) |arch| {
+            switch (arch.endian()) {
+                .Big => lib.defineCMacro("NATIVE_BIG_ENDIAN", "1"),
+                .Little => lib.defineCMacro("NATIVE_LITTLE_ENDIAN", "1"),
+            }
+        }
+
+        switch (target.getOsTag()) {
+            .linux => {
+                lib.defineCMacro("ASM_HIDE_SYMBOL", ".hidden");
+                lib.defineCMacro("TLS", "_Thread_local");
+
+                lib.defineCMacro("HAVE_CATCHABLE_ABRT", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_SEGV", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETPID", "1");
+                lib.defineCMacro("HAVE_INLINE_ASM", "1");
+                lib.defineCMacro("HAVE_MADVISE", "1");
+                lib.defineCMacro("HAVE_MLOCK", "1");
+                lib.defineCMacro("HAVE_MMAP", "1");
+                lib.defineCMacro("HAVE_MPROTECT", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_PTHREAD_PRIO_INHERIT", "1");
+                lib.defineCMacro("HAVE_PTHREAD", "1");
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYSCONF", "1");
+                lib.defineCMacro("HAVE_SYS_AUXV_H", "1");
+                lib.defineCMacro("HAVE_SYS_MMAN_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+                lib.defineCMacro("HAVE_WEAK_SYMBOLS", "1");
+            },
+            .windows => {
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+            },
+            .macos => {
+                lib.defineCMacro("ASM_HIDE_SYMBOL", ".private_extern");
+                lib.defineCMacro("TLS", "_Thread_local");
+
+                lib.defineCMacro("HAVE_ARC4RANDOM", "1");
+                lib.defineCMacro("HAVE_ARC4RANDOM_BUF", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_ABRT", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_SEGV", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETENTROPY", "1");
+                lib.defineCMacro("HAVE_GETPID", "1");
+                lib.defineCMacro("HAVE_MADVISE", "1");
+                lib.defineCMacro("HAVE_MEMSET_S", "1");
+                lib.defineCMacro("HAVE_MLOCK", "1");
+                lib.defineCMacro("HAVE_MMAP", "1");
+                lib.defineCMacro("HAVE_MPROTECT", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_PTHREAD", "1");
+                lib.defineCMacro("HAVE_PTHREAD_PRIO_INHERIT", "1");
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYSCONF", "1");
+                lib.defineCMacro("HAVE_SYS_MMAN_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+                lib.defineCMacro("HAVE_WEAK_SYMBOLS", "1");
+            },
+            .wasi => {
+                lib.defineCMacro("HAVE_ARC4RANDOM", "1");
+                lib.defineCMacro("HAVE_ARC4RANDOM_BUF", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETENTROPY", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_SYS_AUXV_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+            },
+            else => {},
+        }

        switch (target.getCpuArch()) {
            .x86_64 => {
@ -52,9 +142,17 @@ pub fn build(b: *std.build.Builder) !void {
                lib.defineCMacro("HAVE_MMINTRIN_H", "1");
                lib.defineCMacro("HAVE_EMMINTRIN_H", "1");
                lib.defineCMacro("HAVE_PMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_SMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_TMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_WMMINTRIN_H", "1");
            },
            .aarch64, .aarch64_be => {
-                lib.defineCMacro("HAVE_ARMCRYTO", "1");
+                const cpu_features = target.getCpuFeatures();
+                const has_neon = cpu_features.isEnabled(@enumToInt(Target.aarch64.Feature.neon));
+                const has_crypto = cpu_features.isEnabled(@enumToInt(Target.aarch64.Feature.crypto));
+                if (has_neon and has_crypto) {
+                    lib.defineCMacro("HAVE_ARMCRYPTO", "1");
+                }
            },
            .wasm32, .wasm64 => {
                lib.defineCMacro("__wasm__", "1");
@ -69,6 +167,15 @@ pub fn build(b: *std.build.Builder) !void {
            else => {},
        }

+        switch (target.getCpuArch()) {
+            .x86_64 => {
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.sse4_1));
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.aes));
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.pclmul));
+            },
+            else => {},
+        }
+
        var allocator = heap.page_allocator;
        var walker = try src_dir.walk(allocator);
        while (try walker.next()) |entry| {
@ -88,4 +195,43 @@ pub fn build(b: *std.build.Builder) !void {
            }
        }
    }
+
+    const test_path = "test/default";
+    const out_bin_path = "zig-out/bin";
+    const test_dir = try fs.Dir.openIterableDir(fs.cwd(), test_path, .{ .no_follow = true });
+    fs.Dir.makePath(fs.cwd(), out_bin_path) catch {};
+    const out_bin_dir = try fs.Dir.openDir(fs.cwd(), out_bin_path, .{});
+    try test_dir.dir.copyFile("run.sh", out_bin_dir, "run.sh", .{});
+    var allocator = heap.page_allocator;
+    var walker = try test_dir.walk(allocator);
+    while (try walker.next()) |entry| {
+        const name = entry.basename;
+        if (mem.endsWith(u8, name, ".exp")) {
+            try test_dir.dir.copyFile(name, out_bin_dir, name, .{});
+            continue;
+        }
+        if (!mem.endsWith(u8, name, ".c")) {
+            continue;
+        }
+        const exe_name = name[0 .. name.len - 2];
+        var exe = b.addExecutable(exe_name, null);
+        exe.setTarget(target);
+        exe.setBuildMode(mode);
+        exe.linkLibC();
+        exe.want_lto = false;
+        exe.strip = true;
+        exe.linkLibrary(static);
+        exe.addIncludePath("src/libsodium/include");
+        exe.addIncludePath("test/quirks");
+        const full_path = try fmt.allocPrint(allocator, "{s}/{s}", .{ test_path, entry.path });
+        exe.addCSourceFiles(&.{full_path}, &.{});
+
+        if (enable_benchmarks) {
+            exe.defineCMacro("BENCHMARKS", "1");
+            var buf: [16]u8 = undefined;
+            exe.defineCMacro("ITERATIONS", std.fmt.bufPrintIntToSlice(&buf, benchmarks_iterations, 10, .lower, .{}));
+        }
+
+        exe.install();
+    }
 }
--- a/deps/libsodium/builds/msvc/properties/DebugLIB.props
+++ b/deps/libsodium/builds/msvc/properties/DebugLIB.props
@ -12,7 +12,7 @@
  
  <ItemDefinitionGroup>
    <ClCompile>
-      <DebugInformationFormat>OldStyle</DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
      <LinkIncremental>true</LinkIncremental>
    </ClCompile>
--- a/deps/libsodium/builds/msvc/properties/Release.props
+++ b/deps/libsodium/builds/msvc/properties/Release.props
@ -14,7 +14,7 @@
  <ItemDefinitionGroup>
    <ClCompile>
      <AdditionalOptions>/Oy- %(AdditionalOptions)</AdditionalOptions>
-      <!--<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>-->
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>true</IntrinsicFunctions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
--- a/deps/libsodium/configure
+++ b/deps/libsodium/configure
@ -1596,7 +1596,7 @@ Some influential environment variables:
  CPP         C preprocessor
  SAFECODE_HOME
              set to the safecode base directory
-  CWFLAGS     define to compilation flags for generating extra warnings
+  CWFLAGS     compilation flags for generating extra warnings
  LT_SYS_LIBRARY_PATH
              User-defined run-time library search path.
  AR          path to the ar utility
@ -3753,6 +3753,9 @@ then :

 fi

+sodium_CFLAGS=${CFLAGS+set}
+: ${CFLAGS=""}
+



@ -5289,6 +5292,206 @@ fi



+if test "$sodium_CFLAGS" != "set" ; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Ofast" >&5
+printf %s "checking whether C compiler accepts -Ofast... " >&6; }
+if test ${ax_cv_check_cflags___Ofast+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -Ofast"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___Ofast=yes
+else $as_nop
+  ax_cv_check_cflags___Ofast=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___Ofast" >&5
+printf "%s\n" "$ax_cv_check_cflags___Ofast" >&6; }
+if test "x$ax_cv_check_cflags___Ofast" = xyes
+then :
+  CFLAGS="$CFLAGS -Ofast"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O3" >&5
+printf %s "checking whether C compiler accepts -O3... " >&6; }
+if test ${ax_cv_check_cflags___O3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O3"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O3=yes
+else $as_nop
+  ax_cv_check_cflags___O3=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O3" >&5
+printf "%s\n" "$ax_cv_check_cflags___O3" >&6; }
+if test "x$ax_cv_check_cflags___O3" = xyes
+then :
+  CFLAGS="$CFLAGS -O3"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O2" >&5
+printf %s "checking whether C compiler accepts -O2... " >&6; }
+if test ${ax_cv_check_cflags___O2+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O2"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O2=yes
+else $as_nop
+  ax_cv_check_cflags___O2=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O2" >&5
+printf "%s\n" "$ax_cv_check_cflags___O2" >&6; }
+if test "x$ax_cv_check_cflags___O2" = xyes
+then :
+  CFLAGS="$CFLAGS -O2"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O1" >&5
+printf %s "checking whether C compiler accepts -O1... " >&6; }
+if test ${ax_cv_check_cflags___O1+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O1"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O1=yes
+else $as_nop
+  ax_cv_check_cflags___O1=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O1" >&5
+printf "%s\n" "$ax_cv_check_cflags___O1" >&6; }
+if test "x$ax_cv_check_cflags___O1" = xyes
+then :
+  CFLAGS="$CFLAGS -O1"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O" >&5
+printf %s "checking whether C compiler accepts -O... " >&6; }
+if test ${ax_cv_check_cflags___O+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O=yes
+else $as_nop
+  ax_cv_check_cflags___O=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O" >&5
+printf "%s\n" "$ax_cv_check_cflags___O" >&6; }
+if test "x$ax_cv_check_cflags___O" = xyes
+then :
+  CFLAGS="$CFLAGS -O"
+else $as_nop
+  :
+fi
+
+fi
+
+fi
+
+fi
+
+fi
+
+fi
+
+
 # Check whether --enable-ssp was given.
 if test ${enable_ssp+y}
 then :
@ -6869,46 +7072,6 @@ then :
  if test "x$enableval" = "xyes"
 then :

-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Ofast" >&5
-printf %s "checking whether C compiler accepts -Ofast... " >&6; }
-if test ${ax_cv_check_cflags___Ofast+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-
-  ax_check_save_flags=$CFLAGS
-  CFLAGS="$CFLAGS  -Ofast"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <time.h>
-int
-main (void)
-{
-time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  ax_cv_check_cflags___Ofast=yes
-else $as_nop
-  ax_cv_check_cflags___Ofast=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  CFLAGS=$ax_check_save_flags
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___Ofast" >&5
-printf "%s\n" "$ax_cv_check_cflags___Ofast" >&6; }
-if test "x$ax_cv_check_cflags___Ofast" = xyes
-then :
-  CFLAGS="$CFLAGS -Ofast"
-else $as_nop
-  :
-fi
-
    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -ftree-vectorize" >&5
 printf %s "checking whether C compiler accepts -ftree-vectorize... " >&6; }
 if test ${ax_cv_check_cflags___ftree_vectorize+y}
@ -7069,6 +7232,46 @@ else $as_nop
  :
 fi

+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -mtune=native" >&5
+printf %s "checking whether C compiler accepts -mtune=native... " >&6; }
+if test ${ax_cv_check_cflags___mtune_native+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -mtune=native"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___mtune_native=yes
+else $as_nop
+  ax_cv_check_cflags___mtune_native=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___mtune_native" >&5
+printf "%s\n" "$ax_cv_check_cflags___mtune_native" >&6; }
+if test "x$ax_cv_check_cflags___mtune_native" = xyes
+then :
+  CFLAGS="$CFLAGS -mtune=native"
+else $as_nop
+  :
+fi
+

 fi

@ -8458,8 +8661,6 @@ esac

 fi

-
-
 as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wall" | $as_tr_sh`
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wall" >&5
 printf %s "checking whether C compiler accepts $CFLAGS -Wall... " >&6; }
@ -8502,16 +8703,16 @@ else $as_nop
  :
 fi

-as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wextra" | $as_tr_sh`
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wextra" >&5
-printf %s "checking whether C compiler accepts $CFLAGS -Wextra... " >&6; }
+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wno-unknown-pragmas" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wno-unknown-pragmas" >&5
+printf %s "checking whether C compiler accepts $CFLAGS -Wno-unknown-pragmas... " >&6; }
 if eval test \${$as_CACHEVAR+y}
 then :
  printf %s "(cached) " >&6
 else $as_nop

  ax_check_save_flags=$CFLAGS
-  CFLAGS="$CFLAGS  $CFLAGS -Wextra"
+  CFLAGS="$CFLAGS  $CFLAGS -Wno-unknown-pragmas"
  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <time.h>
@ -8539,12 +8740,14 @@ eval ac_res=\$$as_CACHEVAR
 printf "%s\n" "$ac_res" >&6; }
 if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
 then :
-  CWFLAGS="$CFLAGS -Wextra"
+  CFLAGS="$CFLAGS -Wno-unknown-pragmas"
 else $as_nop
  :
 fi


+
+
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for clang" >&5
 printf %s "checking for clang... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@ -8555,7 +8758,7 @@ main (void)
 {

 #ifndef __clang__
-#error Not clang
+#error Not clang nor zig cc
 #endif

  ;
@ -8616,6 +8819,90 @@ printf "%s\n" "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext

+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Wextra" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Wextra" >&5
+printf %s "checking whether C compiler accepts $CWFLAGS -Wextra... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  $CWFLAGS -Wextra"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  eval "$as_CACHEVAR=yes"
+else $as_nop
+  eval "$as_CACHEVAR=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+eval ac_res=\$$as_CACHEVAR
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
+  CWFLAGS="$WCFLAGS -Wextra"
+else $as_nop
+  :
+fi
+
+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Warray-bounds" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Warray-bounds" >&5
+printf %s "checking whether C compiler accepts $CWFLAGS -Warray-bounds... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  $CWFLAGS -Warray-bounds"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  eval "$as_CACHEVAR=yes"
+else $as_nop
+  eval "$as_CACHEVAR=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+eval ac_res=\$$as_CACHEVAR
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
+  CWFLAGS="$CWFLAGS -Warray-bounds"
+else $as_nop
+  :
+fi
+
 as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Wbad-function-cast" | $as_tr_sh`
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Wbad-function-cast" >&5
 printf %s "checking whether C compiler accepts $CWFLAGS -Wbad-function-cast... " >&6; }
@ -9905,6 +10192,8 @@ size_t i;
 signal(SIGSEGV, sig);
 signal(SIGBUS, sig);
 #if !defined(__SANITIZE_ADDRESS__) && !defined(__EMSCRIPTEN__)
+*((volatile unsigned char *) -1) = 0xd0;
+*((volatile unsigned char *) 1) = 0xd0;
 for (i = 0; i < 10000000; i += 1024) { x[-i] = x[i] = (unsigned char) i; }
 #endif
 free((void *) x);
@ -20630,6 +20919,12 @@ then :
  printf "%s\n" "#define HAVE_NANOSLEEP 1" >>confdefs.h

 fi
+ac_fn_c_check_func "$LINENO" "clock_gettime" "ac_cv_func_clock_gettime"
+if test "x$ac_cv_func_clock_gettime" = xyes
+then :
+  printf "%s\n" "#define HAVE_CLOCK_GETTIME 1" >>confdefs.h
+
+fi


 if test "x$WASI" = "x"
@ -20646,6 +20941,12 @@ if test "x$ac_cv_func_explicit_bzero" = xyes
 then :
  printf "%s\n" "#define HAVE_EXPLICIT_BZERO 1" >>confdefs.h

+fi
+ac_fn_c_check_func "$LINENO" "memset_explicit" "ac_cv_func_memset_explicit"
+if test "x$ac_cv_func_memset_explicit" = xyes
+then :
+  printf "%s\n" "#define HAVE_MEMSET_EXPLICIT 1" >>confdefs.h
+
 fi
 ac_fn_c_check_func "$LINENO" "explicit_memset" "ac_cv_func_explicit_memset"
 if test "x$ac_cv_func_explicit_memset" = xyes
--- a/deps/libsodium/configure.ac
+++ b/deps/libsodium/configure.ac
@ -42,10 +42,23 @@ AS_IF([pwd | fgrep ' ' > /dev/null 2>&1],
  [AC_MSG_ERROR([The build directory contains whitespaces - This can cause tests/installation to fail due to limitations of some libtool versions])]
 )

+sodium_CFLAGS=${CFLAGS+set}
+: ${CFLAGS=""}
+
 AC_PROG_CC
 AM_PROG_AS
 AC_USE_SYSTEM_EXTENSIONS

+dnl Default optimization flags
+
+if test "$sodium_CFLAGS" != "set" ; then
+  AX_CHECK_COMPILE_FLAG([-Ofast], [CFLAGS="$CFLAGS -Ofast"],
+    [AX_CHECK_COMPILE_FLAG([-O3], [CFLAGS="$CFLAGS -O3"],
+      [AX_CHECK_COMPILE_FLAG([-O2], [CFLAGS="$CFLAGS -O2"],
+        [AX_CHECK_COMPILE_FLAG([-O1], [CFLAGS="$CFLAGS -O1"],
+          [AX_CHECK_COMPILE_FLAG([-O], [CFLAGS="$CFLAGS -O"])])])])])
+fi
+
 dnl Switches

 AC_ARG_ENABLE(ssp,
@ -197,11 +210,11 @@ AC_ARG_ENABLE(opt,
 [AS_HELP_STRING(--enable-opt,Optimize for the native CPU - The resulting library will be faster but not portable)],
 [
  AS_IF([test "x$enableval" = "xyes"], [
-    AX_CHECK_COMPILE_FLAG([-Ofast], [CFLAGS="$CFLAGS -Ofast"])
    AX_CHECK_COMPILE_FLAG([-ftree-vectorize], [CFLAGS="$CFLAGS -ftree-vectorize"])
    AX_CHECK_COMPILE_FLAG([-ftree-slp-vectorize], [CFLAGS="$CFLAGS -ftree-slp-vectorize"])
    AX_CHECK_COMPILE_FLAG([-fomit-frame-pointer], [CFLAGS="$CFLAGS -fomit-frame-pointer"])
    AX_CHECK_COMPILE_FLAG([-march=native], [CFLAGS="$CFLAGS -march=native"])
+    AX_CHECK_COMPILE_FLAG([-mtune=native], [CFLAGS="$CFLAGS -mtune=native"])
  ])
 ])

@ -310,15 +323,15 @@ AS_CASE([$host_os],
  ])
 ])

-AC_ARG_VAR([CWFLAGS], [define to compilation flags for generating extra warnings])
-
 AX_CHECK_COMPILE_FLAG([$CFLAGS -Wall], [CWFLAGS="$CFLAGS -Wall"])
-AX_CHECK_COMPILE_FLAG([$CFLAGS -Wextra], [CWFLAGS="$CFLAGS -Wextra"])
+AX_CHECK_COMPILE_FLAG([$CFLAGS -Wno-unknown-pragmas], [CFLAGS="$CFLAGS -Wno-unknown-pragmas"])
+
+AC_ARG_VAR([CWFLAGS], [compilation flags for generating extra warnings])

 AC_MSG_CHECKING(for clang)
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
 #ifndef __clang__
-#error Not clang
+#error Not clang nor zig cc
 #endif
 ]])],
  [AC_MSG_RESULT(yes)
@ -328,6 +341,8 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
  [AC_MSG_RESULT(no)
 ])

+AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wextra], [CWFLAGS="$WCFLAGS -Wextra"])
+AX_CHECK_COMPILE_FLAG([$CWFLAGS -Warray-bounds], [CWFLAGS="$CWFLAGS -Warray-bounds"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wbad-function-cast], [CWFLAGS="$CWFLAGS -Wbad-function-cast"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wcast-qual], [CWFLAGS="$CWFLAGS -Wcast-qual"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wdiv-by-zero], [CWFLAGS="$CWFLAGS -Wdiv-by-zero"])
@ -866,10 +881,10 @@ AS_IF([test "x$WASI" = "x"],[
  AC_CHECK_FUNCS([getauxva elf_aux_info])
 ])

-AC_CHECK_FUNCS([posix_memalign nanosleep])
+AC_CHECK_FUNCS([posix_memalign nanosleep clock_gettime])

 AS_IF([test "x$WASI" = "x"],[
-  AC_CHECK_FUNCS([memset_s explicit_bzero explicit_memset])
+  AC_CHECK_FUNCS([memset_s explicit_bzero memset_explicit explicit_memset])
 ])

 AC_SUBST([LIBTOOL_EXTRA_FLAGS])
--- a/deps/libsodium/dist-build/android-aar.sh
+++ b/deps/libsodium/dist-build/android-aar.sh
@ -0,0 +1,144 @@
+#! /bin/sh
+
+# Create an AAR with libsodium in all combinations of static | shared | minimal | full.
+#
+# The x86 static library will not work due to text relocation rules, so static x86 versions are limited to shared libraries.
+# To simplify linking, library variants have distinct names: sodium, sodium-static, sodium-minimal and sodium-minimal-static.
+
+SODIUM_VERSION="1.0.18.0"
+NDK_VERSION=$(grep "Pkg.Revision = " <"${ANDROID_NDK_HOME}/source.properties" | cut -f 2 -d '=' | cut -f 2 -d' ' | cut -f 1 -d'.')
+DEST_PATH=$(mktemp -d)
+
+cd "$(dirname "$0")/../" || exit
+
+make_abi_json() {
+  echo "{\"abi\":\"${NDK_ARCH}\",\"api\":${SDK_VERSION},\"ndk\":${NDK_VERSION},\"stl\":\"none\"}" >"$1/abi.json"
+}
+
+make_prefab_json() {
+  echo "{\"name\":\"sodium\",\"schema_version\":1,\"dependencies\":[],\"version\":\"$SODIUM_VERSION\"}" >"$1/prefab.json"
+}
+
+make_manifest() {
+  echo "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.android.ndk.thirdparty.sodium\" android:versionCode=\"1\" android:versionName=\"1.0\">
+        <uses-sdk android:minSdkVersion=\"19\" android:targetSdkVersion=\"21\"/>
+</manifest>" >"${1}/AndroidManifest.xml"
+}
+
+make_prefab_structure() {
+  mkdir "$DEST_PATH"
+
+  for variant_dirs in "prefab" "prefab/modules" "META-INF"; do
+    mkdir "${DEST_PATH}/${variant_dirs}"
+  done
+
+  make_prefab_json "${DEST_PATH}/prefab"
+  make_manifest "${DEST_PATH}"
+  cp "LICENSE" "${DEST_PATH}/META-INF"
+
+  for variant in \
+    "prefab/modules/sodium" "prefab/modules/sodium-static" \
+    "prefab/modules/sodium-minimal" "prefab/modules/sodium-minimal-static"; do
+    mkdir "${DEST_PATH}/${variant}"
+
+    if [ "$variant" = "prefab/modules/sodium-minimal" ]; then
+      echo "{\"library_name\":\"libsodium\"}" >"${DEST_PATH}/${variant}/module.json"
+    else
+      echo "{}" >"${DEST_PATH}/${variant}/module.json"
+    fi
+
+    mkdir "${DEST_PATH}/${variant}/libs"
+
+    for arch in "arm64-v8a" "armeabi-v7a" "x86" "x86_64"; do
+      mkdir "$DEST_PATH/${variant}/libs/android.${arch}"
+      mkdir "$DEST_PATH/${variant}/libs/android.${arch}/include"
+      NDK_ARCH="$arch"
+      if [ $arch = "arm64-v8a" ] || [ $arch = "x86_64" ]; then
+        SDK_VERSION="21"
+      else
+        SDK_VERSION="19"
+      fi
+
+      make_abi_json "$DEST_PATH/${variant}/libs/android.${arch}"
+    done
+  done
+}
+
+copy_libs() {
+  SRC_DIR="libsodium-android-${1}"
+
+  SHARED_DEST_DIR="${DEST_PATH}/prefab/modules/sodium${3}/libs/android.${2}"
+  STATIC_DEST_DIR="${DEST_PATH}/prefab/modules/sodium${3}-static/libs/android.${2}"
+
+  cp -r "${SRC_DIR}/include" "$SHARED_DEST_DIR"
+  cp -r "${SRC_DIR}/include" "$STATIC_DEST_DIR"
+  cp "${SRC_DIR}/lib/libsodium.so" "${SHARED_DEST_DIR}/libsodium.so"
+  cp "${SRC_DIR}/lib/libsodium.a" "${STATIC_DEST_DIR}/libsodium${3}-static.a"
+
+  rm -r "$SRC_DIR"
+}
+
+build_all() {
+  dist-build/android-armv7-a.sh
+  dist-build/android-armv8-a.sh
+  dist-build/android-x86_64.sh
+  dist-build/android-x86.sh
+}
+
+make_prefab_structure
+
+build_all
+
+copy_libs "armv7-a" "armeabi-v7a" "-minimal"
+copy_libs "armv8-a+crypto" "arm64-v8a" "-minimal"
+copy_libs "i686" "x86" "-minimal"
+copy_libs "westmere" "x86_64" "-minimal"
+
+LIBSODIUM_FULL_BUILD="Y"
+export LIBSODIUM_FULL_BUILD
+
+build_all
+
+copy_libs "armv7-a" "armeabi-v7a"
+copy_libs "armv8-a+crypto" "arm64-v8a"
+copy_libs "i686" "x86"
+copy_libs "westmere" "x86_64"
+
+AAR_PATH="$(pwd)/libsodium-${SODIUM_VERSION}.aar"
+cd "$DEST_PATH" || exit
+rm "$AAR_PATH"
+zip -9 -r "$AAR_PATH" META-INF prefab AndroidManifest.xml
+cd .. || exit
+rm -r "$DEST_PATH"
+
+echo
+echo "Congrats you have built an AAR containing libsodium! To use it with
+gradle or cmake (as set by default for Android Studio projects):
+
+- Edit the app/build.gradle file to add:
+
+    android {
+        buildFeatures {
+            prefab true
+        }
+    }
+
+  and
+
+    dependencies {
+        implementation fileTree(dir:'path/to/aar/',include:['libsodium-$SODIUM_VERSION.aar'])
+    }
+
+  Optionally, store multiple AAR files in the same folder and include '*.aar'
+
+- Edit your module's CMakeLists.txt file to add:
+
+    find_package(sodium REQUIRED CONFIG)
+
+- Then, specify 'sodium::x' as an item in the relevant 'target_link_libraries' statement.
+    The first part is the AAR name and should be 'sodium'.
+    The second part ('x', to be replaced) should be set to:
+      - 'sodium' for the full shared library,
+      - 'sodium-static' for the full static library
+      - 'sodium-minimal' for the minimal shared library, or
+      - 'sodium-minimal-static' for the minimal static library."
--- a/deps/libsodium/dist-build/android-armv7-a.sh
+++ b/deps/libsodium/dist-build/android-armv7-a.sh
@ -1,4 +1,4 @@
 #!/bin/sh
 export TARGET_ARCH=armv7-a
 export CFLAGS="-Os -mfloat-abi=softfp -mfpu=vfpv3-d16 -mthumb -marm -march=${TARGET_ARCH}"
-ARCH=arm HOST_COMPILER=arm-linux-androideabi "$(dirname "$0")/android-build.sh"
+ARCH=arm HOST_COMPILER=armv7a-linux-androideabi "$(dirname "$0")/android-build.sh"
--- a/deps/libsodium/dist-build/android-armv8-a.sh
+++ b/deps/libsodium/dist-build/android-armv8-a.sh
@ -1,4 +1,4 @@
 #!/bin/sh
-export TARGET_ARCH=armv8-a
+export TARGET_ARCH=armv8-a+crypto
 export CFLAGS="-Os -march=${TARGET_ARCH}"
 NDK_PLATFORM=android-21 ARCH=arm64 HOST_COMPILER=aarch64-linux-android "$(dirname "$0")/android-build.sh"
--- a/deps/libsodium/dist-build/android-build.sh
+++ b/deps/libsodium/dist-build/android-build.sh
@ -1,11 +1,11 @@
 #! /bin/sh

 if [ -z "$NDK_PLATFORM" ]; then
-  export NDK_PLATFORM="android-16"
+  export NDK_PLATFORM="android-19"
 fi
 export NDK_PLATFORM_COMPAT="${NDK_PLATFORM_COMPAT:-${NDK_PLATFORM}}"
-export NDK_API_VERSION=$(echo "$NDK_PLATFORM" | sed 's/^android-//')
-export NDK_API_VERSION_COMPAT=$(echo "$NDK_PLATFORM_COMPAT" | sed 's/^android-//')
+export NDK_API_VERSION="$(echo "$NDK_PLATFORM" | sed 's/^android-//')"
+export NDK_API_VERSION_COMPAT="$(echo "$NDK_PLATFORM_COMPAT" | sed 's/^android-//')"

 if [ -z "$ANDROID_NDK_HOME" ]; then
  echo "You should probably set ANDROID_NDK_HOME to the directory containing"
@ -18,20 +18,19 @@ if [ ! -f ./configure ]; then
  exit 1
 fi

-if [ "x$TARGET_ARCH" = 'x' ] || [ "x$ARCH" = 'x' ] || [ "x$HOST_COMPILER" = 'x' ]; then
+if [ -z "$TARGET_ARCH" ] || [ -z "$ARCH" ] || [ -z "$HOST_COMPILER" ]; then
  echo "You shouldn't use android-build.sh directly, use android-[arch].sh instead" >&2
  exit 1
 fi

-export MAKE_TOOLCHAIN="${ANDROID_NDK_HOME}/build/tools/make_standalone_toolchain.py"
-
 export PREFIX="$(pwd)/libsodium-android-${TARGET_ARCH}"
-export TOOLCHAIN_DIR="$(pwd)/android-toolchain-${TARGET_ARCH}"
+export TOOLCHAIN_OS_DIR="$(uname | tr '[:upper:]' '[:lower:]')-x86_64/"
+export TOOLCHAIN_DIR="$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/${TOOLCHAIN_OS_DIR}"
+echo "$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/${TOOLCHAIN_OS_DIR}/${HOST_COMPILER}"
+
 export PATH="${PATH}:${TOOLCHAIN_DIR}/bin"
-
-export CC=${CC:-"${HOST_COMPILER}-clang"}
-
-rm -rf "${TOOLCHAIN_DIR}" "${PREFIX}"
+SDK_VERSION_NUM=$(echo $NDK_PLATFORM | cut -d'-' -f2)
+export CC=${CC:-"${HOST_COMPILER}${SDK_VERSION_NUM}-clang"}

 echo
 echo "Warnings related to headers being present but not usable are due to functions"
@ -47,9 +46,6 @@ else
 fi
 echo

-env - PATH="$PATH" \
-    "$MAKE_TOOLCHAIN" --force --api="$NDK_API_VERSION_COMPAT" \
-    --arch="$ARCH" --install-dir="$TOOLCHAIN_DIR" || exit 1

 if [ -z "$LIBSODIUM_FULL_BUILD" ]; then
  export LIBSODIUM_ENABLE_MINIMAL_FLAG="--enable-minimal"
@ -59,28 +55,27 @@ fi

 ./configure \
  --disable-soname-versions \
+  --disable-pie \
  ${LIBSODIUM_ENABLE_MINIMAL_FLAG} \
  --host="${HOST_COMPILER}" \
  --prefix="${PREFIX}" \
  --with-sysroot="${TOOLCHAIN_DIR}/sysroot" || exit 1

 if [ "$NDK_PLATFORM" != "$NDK_PLATFORM_COMPAT" ]; then
-  egrep '^#define ' config.log | sort -u > config-def-compat.log
+  egrep '^#define ' config.log | sort -u >config-def-compat.log
  echo
  echo "Configuring again for platform [${NDK_PLATFORM}]"
  echo
-  env - PATH="$PATH" \
-      "$MAKE_TOOLCHAIN" --force --api="$NDK_API_VERSION" \
-      --arch="$ARCH" --install-dir="$TOOLCHAIN_DIR" || exit 1

  ./configure \
    --disable-soname-versions \
+    --disable-pie \
    ${LIBSODIUM_ENABLE_MINIMAL_FLAG} \
    --host="${HOST_COMPILER}" \
    --prefix="${PREFIX}" \
    --with-sysroot="${TOOLCHAIN_DIR}/sysroot" || exit 1

-  egrep '^#define ' config.log | sort -u > config-def.log
+  grep -E '^#define ' config.log | sort -u >config-def.log
  if ! cmp config-def.log config-def-compat.log; then
    echo "Platform [${NDK_PLATFORM}] is not backwards-compatible with [${NDK_PLATFORM_COMPAT}]" >&2
    diff -u config-def.log config-def-compat.log >&2
@ -89,10 +84,9 @@ if [ "$NDK_PLATFORM" != "$NDK_PLATFORM_COMPAT" ]; then
  rm -f config-def.log config-def-compat.log
 fi

-
 NPROCESSORS=$(getconf NPROCESSORS_ONLN 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null)
 PROCESSORS=${NPROCESSORS:-3}

-make clean && \
-make -j${PROCESSORS} install && \
-echo "libsodium has been installed into ${PREFIX}"
+make clean &&
+  make -j${PROCESSORS} install &&
+  echo "libsodium has been installed into ${PREFIX}"
--- a/deps/libsodium/dist-build/apple-xcframework.sh
+++ b/deps/libsodium/dist-build/apple-xcframework.sh
@ -11,6 +11,7 @@ export IOS_SIMULATOR_I386_PREFIX="${PREFIX}/tmp/ios-simulator-i386"
 export IOS_SIMULATOR_X86_64_PREFIX="${PREFIX}/tmp/ios-simulator-x86_64"
 export WATCHOS32_PREFIX="${PREFIX}/tmp/watchos32"
 export WATCHOS64_32_PREFIX="${PREFIX}/tmp/watchos64_32"
+export WATCHOS64_PREFIX="${PREFIX}/tmp/watchos64"
 export WATCHOS_SIMULATOR_ARM64_PREFIX="${PREFIX}/tmp/watchos-simulator-arm64"
 export WATCHOS_SIMULATOR_I386_PREFIX="${PREFIX}/tmp/watchos-simulator-i386"
 export WATCHOS_SIMULATOR_X86_64_PREFIX="${PREFIX}/tmp/watchos-simulator-x86_64"
@ -35,6 +36,12 @@ echo "Warnings related to headers being present but not usable are due to functi
 echo "that didn't exist in the specified minimum iOS version level."
 echo "They can be safely ignored."
 echo
+echo "Define the LIBSODIUM_FULL_BUILD environment variable to build the full"
+echo "library (including all deprecated/undocumented/low-level functions)."
+echo
+echo "Define the LIBSODIUM_SKIP_SIMULATORS environment variable to skip building"
+echo "the simulators libraries (iOS, watchOS, tvOS simulators)."
+echo

 if [ -z "$LIBSODIUM_FULL_BUILD" ]; then
  export LIBSODIUM_ENABLE_MINIMAL_FLAG="--enable-minimal"
@ -87,8 +94,8 @@ build_ios() {
  export SDK="${BASEDIR}/SDKs/iPhoneOS.sdk"

  ## 32-bit iOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$IOS32_PREFIX" \
@ -96,8 +103,8 @@ build_ios() {
  make -j${PROCESSORS} install || exit 1

  ## 32-bit armv7s iOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$IOS32s_PREFIX" \
@ -105,8 +112,8 @@ build_ios() {
  make -j${PROCESSORS} install || exit 1

  ## 64-bit iOS
-  export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$IOS64_PREFIX" \
@ -121,8 +128,8 @@ build_ios_simulator() {

  ## arm64 simulator
  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"

    make distclean >/dev/null 2>&1
    ./configure --host=arm-apple-darwin20 --prefix="$IOS_SIMULATOR_ARM64_PREFIX" \
@ -131,8 +138,8 @@ build_ios_simulator() {
  fi

  ## i386 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=i686-apple-darwin10 --prefix="$IOS_SIMULATOR_I386_PREFIX" \
@ -140,8 +147,8 @@ build_ios_simulator() {
  make -j${PROCESSORS} install || exit 1

  ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=x86_64-apple-darwin10 --prefix="$IOS_SIMULATOR_X86_64_PREFIX" \
@ -155,8 +162,8 @@ build_watchos() {
  export SDK="${BASEDIR}/SDKs/WatchOS.sdk"

  # 32-bit watchOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS32_PREFIX" \
@ -164,13 +171,22 @@ build_watchos() {
  make -j${PROCESSORS} install || exit 1

  ## 64-bit arm64_32 watchOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS64_32_PREFIX" \
    ${LIBSODIUM_ENABLE_MINIMAL_FLAG} || exit 1
  make -j${PROCESSORS} install || exit 1
+
+  ## 64-bit arm64 watchOS
+  export CFLAGS="-O2 -mthumb -arch arm64 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch arm64 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+
+  make distclean >/dev/null 2>&1
+  ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS64_PREFIX" \
+    ${LIBSODIUM_ENABLE_MINIMAL_FLAG} || exit 1
+  make -j${PROCESSORS} install || exit 1
 }

 build_watchos_simulator() {
@ -180,8 +196,8 @@ build_watchos_simulator() {

  ## arm64 simulator
  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"

    make distclean >/dev/null 2>&1
    ./configure --host=arm-apple-darwin20 --prefix="$WATCHOS_SIMULATOR_ARM64_PREFIX" \
@ -190,8 +206,8 @@ build_watchos_simulator() {
  fi

  ## i386 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=i686-apple-darwin10 --prefix="$WATCHOS_SIMULATOR_I386_PREFIX" \
@ -199,8 +215,8 @@ build_watchos_simulator() {
  make -j${PROCESSORS} install || exit 1

  ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=x86_64-apple-darwin10 --prefix="$WATCHOS_SIMULATOR_X86_64_PREFIX" \
@ -214,8 +230,8 @@ build_tvos() {
  export SDK="${BASEDIR}/SDKs/AppleTVOS.sdk"

  ## 64-bit tvOS
-  export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
+  export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
+  export LDFLAGS="-arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=arm-apple-darwin10 --prefix="$TVOS64_PREFIX" \
@ -230,8 +246,8 @@ build_tvos_simulator() {

  ## arm64 simulator
  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"

    make distclean >/dev/null 2>&1
    ./configure --host=arm-apple-darwin20 --prefix="$TVOS_SIMULATOR_ARM64_PREFIX" \
@ -240,8 +256,8 @@ build_tvos_simulator() {
  fi

  ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"

  make distclean >/dev/null 2>&1
  ./configure --host=x86_64-apple-darwin10 --prefix="$TVOS_SIMULATOR_X86_64_PREFIX" \
@ -276,23 +292,29 @@ build_catalyst() {
 }

 mkdir -p "${PREFIX}/tmp"
+
 echo "Building for macOS..."
 build_macos >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for iOS..."
 build_ios >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the iOS simulator..."
-build_ios_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for watchOS..."
 build_watchos >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the watchOS simulator..."
-build_watchos_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for tvOS..."
 build_tvos >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the tvOS simulator..."
-build_tvos_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for Catalyst..."
 build_catalyst >"$LOG_FILE" 2>&1 || exit 1

+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  echo "Building for the iOS simulator..."
+  build_ios_simulator >"$LOG_FILE" 2>&1 || exit 1
+  echo "Building for the watchOS simulator..."
+  build_watchos_simulator >"$LOG_FILE" 2>&1 || exit 1
+  echo "Building for the tvOS simulator..."
+  build_tvos_simulator >"$LOG_FILE" 2>&1 || exit 1
+  else
+  echo "[Skipping the simulators]"
+fi
+
 echo "Adding the Clibsodium module map for Swift..."

 find "$PREFIX" -name "include" -type d -print | while read -r f; do
@ -328,25 +350,6 @@ for ext in a dylib; do
    -output "$PREFIX/ios/lib/libsodium.${ext}"
 done

-echo "Bundling iOS simulators..."
-
-mkdir -p "${PREFIX}/ios-simulators/lib"
-cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
-  else
-    lipo -create \
-      "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
-  fi
-done
-
 echo "Bundling watchOS targets..."

 mkdir -p "${PREFIX}/watchos/lib"
@ -355,28 +358,10 @@ for ext in a dylib; do
  lipo -create \
    "${WATCHOS32_PREFIX}/lib/libsodium.${ext}" \
    "${WATCHOS64_32_PREFIX}/lib/libsodium.${ext}" \
+    "${WATCHOS64_PREFIX}/lib/libsodium.${ext}" \
    -output "${PREFIX}/watchos/lib/libsodium.${ext}"
 done

-echo "Bundling watchOS simulators..."
-
-mkdir -p "${PREFIX}/watchos-simulators/lib"
-cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
-  else
-    lipo -create \
-      "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
-  fi
-done
-
 echo "Bundling tvOS targets..."

 mkdir -p "${PREFIX}/tvos/lib"
@ -387,23 +372,6 @@ for ext in a dylib; do
    -output "$PREFIX/tvos/lib/libsodium.${ext}"
 done

-echo "Bundling tvOS simulators..."
-
-mkdir -p "${PREFIX}/tvos-simulators/lib"
-cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
-  else
-    lipo -create \
-      "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
-  fi
-done
-
 echo "Bundling Catalyst targets..."

 mkdir -p "${PREFIX}/catalyst/lib"
@ -424,15 +392,78 @@ for ext in a dylib; do
  fi
 done

+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  echo "Bundling iOS simulators..."
+
+  mkdir -p "${PREFIX}/ios-simulators/lib"
+  cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
+    else
+      lipo -create \
+        "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
+    fi
+  done
+
+  echo "Bundling watchOS simulators..."
+
+  mkdir -p "${PREFIX}/watchos-simulators/lib"
+  cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
+    else
+      lipo -create \
+        "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
+    fi
+  done
+
+  echo "Bundling tvOS simulators..."
+
+  mkdir -p "${PREFIX}/tvos-simulators/lib"
+  cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
+    else
+      lipo -create \
+        "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
+    fi
+  done
+fi
+
 echo "Creating Clibsodium.xcframework..."

 rm -rf "${PREFIX}/Clibsodium.xcframework"

 XCFRAMEWORK_ARGS=""
-for f in macos ios ios-simulators watchos watchos-simulators tvos tvos-simulators catalyst; do
+for f in macos ios watchos tvos catalyst; do
  XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -library ${PREFIX}/${f}/lib/libsodium.a"
  XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -headers ${PREFIX}/${f}/include"
 done
+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  for f in ios-simulators watchos-simulators tvos-simulators; do
+    XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -library ${PREFIX}/${f}/lib/libsodium.a"
+    XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -headers ${PREFIX}/${f}/include"
+  done
+fi
 xcodebuild -create-xcframework \
  ${XCFRAMEWORK_ARGS} \
  -output "${PREFIX}/Clibsodium.xcframework" >/dev/null
--- a/deps/libsodium/dist-build/emscripten-symbols.def
+++ b/deps/libsodium/dist-build/emscripten-symbols.def
@ -289,10 +289,10 @@ _crypto_onetimeauth_primitive 0 1
 _crypto_onetimeauth_statebytes 0 1
 _crypto_onetimeauth_update 0 1
 _crypto_onetimeauth_verify 0 1
-_crypto_pwhash 1 1
-_crypto_pwhash_alg_argon2i13 1 1
-_crypto_pwhash_alg_argon2id13 1 1
-_crypto_pwhash_alg_default 1 1
+_crypto_pwhash 0 1
+_crypto_pwhash_alg_argon2i13 0 1
+_crypto_pwhash_alg_argon2id13 0 1
+_crypto_pwhash_alg_default 0 1
 _crypto_pwhash_argon2i 0 1
 _crypto_pwhash_argon2i_alg_argon2i13 0 1
 _crypto_pwhash_argon2i_bytes_max 0 1
@ -337,22 +337,22 @@ _crypto_pwhash_argon2id_str_needs_rehash 0 1
 _crypto_pwhash_argon2id_str_verify 0 1
 _crypto_pwhash_argon2id_strbytes 0 1
 _crypto_pwhash_argon2id_strprefix 0 1
-_crypto_pwhash_bytes_max 1 1
-_crypto_pwhash_bytes_min 1 1
-_crypto_pwhash_memlimit_interactive 1 1
-_crypto_pwhash_memlimit_max 1 1
-_crypto_pwhash_memlimit_min 1 1
-_crypto_pwhash_memlimit_moderate 1 1
-_crypto_pwhash_memlimit_sensitive 1 1
-_crypto_pwhash_opslimit_interactive 1 1
-_crypto_pwhash_opslimit_max 1 1
-_crypto_pwhash_opslimit_min 1 1
-_crypto_pwhash_opslimit_moderate 1 1
-_crypto_pwhash_opslimit_sensitive 1 1
-_crypto_pwhash_passwd_max 1 1
-_crypto_pwhash_passwd_min 1 1
+_crypto_pwhash_bytes_max 0 1
+_crypto_pwhash_bytes_min 0 1
+_crypto_pwhash_memlimit_interactive 0 1
+_crypto_pwhash_memlimit_max 0 1
+_crypto_pwhash_memlimit_min 0 1
+_crypto_pwhash_memlimit_moderate 0 1
+_crypto_pwhash_memlimit_sensitive 0 1
+_crypto_pwhash_opslimit_interactive 0 1
+_crypto_pwhash_opslimit_max 0 1
+_crypto_pwhash_opslimit_min 0 1
+_crypto_pwhash_opslimit_moderate 0 1
+_crypto_pwhash_opslimit_sensitive 0 1
+_crypto_pwhash_passwd_max 0 1
+_crypto_pwhash_passwd_min 0 1
 _crypto_pwhash_primitive 0 1
-_crypto_pwhash_saltbytes 1 1
+_crypto_pwhash_saltbytes 0 1
 _crypto_pwhash_scryptsalsa208sha256 0 1
 _crypto_pwhash_scryptsalsa208sha256_bytes_max 0 1
 _crypto_pwhash_scryptsalsa208sha256_bytes_min 0 1
@ -373,12 +373,12 @@ _crypto_pwhash_scryptsalsa208sha256_str_needs_rehash 0 1
 _crypto_pwhash_scryptsalsa208sha256_str_verify 0 1
 _crypto_pwhash_scryptsalsa208sha256_strbytes 0 1
 _crypto_pwhash_scryptsalsa208sha256_strprefix 0 1
-_crypto_pwhash_str 1 1
-_crypto_pwhash_str_alg 1 1
-_crypto_pwhash_str_needs_rehash 1 1
-_crypto_pwhash_str_verify 1 1
-_crypto_pwhash_strbytes 1 1
-_crypto_pwhash_strprefix 1 1
+_crypto_pwhash_str 0 1
+_crypto_pwhash_str_alg 0 1
+_crypto_pwhash_str_needs_rehash 0 1
+_crypto_pwhash_str_verify 0 1
+_crypto_pwhash_strbytes 0 1
+_crypto_pwhash_strprefix 0 1
 _crypto_scalarmult 1 1
 _crypto_scalarmult_base 1 1
 _crypto_scalarmult_bytes 1 1
--- a/deps/libsodium/dist-build/emscripten.sh
+++ b/deps/libsodium/dist-build/emscripten.sh
--- a/deps/libsodium/dist-build/generate-emscripten-symbols.sh
+++ b/deps/libsodium/dist-build/generate-emscripten-symbols.sh
@ -2,6 +2,8 @@

 set -e

+LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.23.dylib}
+
 symbols() {
  {
    SUMO="$1"
@ -17,8 +19,8 @@ symbols() {
      fi
    done < emscripten-symbols.def

-    /usr/bin/nm /usr/local/lib/libsodium.23.dylib | \
-    fgrep ' T _' | \
+    /usr/bin/nm "$LIBSODIUM" |
+      fgrep ' T _' |
      cut -d' ' -f3 | {
      while read symbol; do
        eval "found=\$defined_${symbol}"
--- a/deps/libsodium/dist-build/wasm32-wasi.sh
+++ b/deps/libsodium/dist-build/wasm32-wasi.sh
@ -7,8 +7,8 @@ export PREFIX="$(pwd)/libsodium-wasm32-wasi"
 mkdir -p $PREFIX || exit 1

 export CC="zig cc"
-export CFLAGS="--target=wasm32-wasi -O2"
-export LDFLAGS="-s -Wl,--stack-first"
+export CFLAGS="--target=wasm32-wasi -O3"
+export LDFLAGS="-s"
 export AR="zig ar"
 export RANLIB="zig ranlib"

@ -16,7 +16,7 @@ make distclean >/dev/null

 if [ "x$1" = "x--bench" ]; then
  export BENCHMARKS=1
-  export CPPFLAGS="-DBENCHMARKS -DITERATIONS=100"
+  export CPPFLAGS="-DBENCHMARKS -DITERATIONS=200"
 else
  export CPPFLAGS="-DED25519_NONDETERMINISTIC=1"
 fi
--- a/deps/libsodium/m4/ax_check_catchable_segv.m4
+++ b/deps/libsodium/m4/ax_check_catchable_segv.m4
@ -24,6 +24,8 @@ size_t i;
 signal(SIGSEGV, sig);
 signal(SIGBUS, sig);
 #if !defined(__SANITIZE_ADDRESS__) && !defined(__EMSCRIPTEN__)
+*((volatile unsigned char *) -1) = 0xd0;
+*((volatile unsigned char *) 1) = 0xd0;
 for (i = 0; i < 10000000; i += 1024) { x[-i] = x[i] = (unsigned char) i; }
 #endif
 free((void *) x);
--- a/deps/libsodium/packaging/dotnet-core/libsodium.pkgproj
+++ b/deps/libsodium/packaging/dotnet-core/libsodium.pkgproj
@ -9,7 +9,7 @@

  <PropertyGroup>
    <PackageId>libsodium</PackageId>
-    <Version>1.0.18.2</Version>
+    <Version>1.0.18.4</Version>
    <Authors>Frank Denis</Authors>
    <Description>Internal implementation package not meant for direct consumption. Please do not reference directly.</Description>
    <Copyright>&#169; $([System.DateTime]::UtcNow.ToString(yyyy)) Frank Denis</Copyright>
@ -28,9 +28,11 @@
    <Content Include="runtimes/win-x64/native/libsodium.dll" PackagePath="runtimes/win-x64/native/" />
    <Content Include="runtimes/win-x86/native/libsodium.dll" PackagePath="runtimes/win-x86/native/" />
    <Content Include="runtimes/linux-x64/native/libsodium.so" PackagePath="runtimes/linux-x64/native/" />
-    <Content Include="runtimes/linux-arm64/native/libsodium.so" PackagePath="runtimes/linux-arm64/native/" />
    <Content Include="runtimes/linux-arm/native/libsodium.so" PackagePath="runtimes/linux-arm/native/" />
+    <Content Include="runtimes/linux-arm64/native/libsodium.so" PackagePath="runtimes/linux-arm64/native/" />
    <Content Include="runtimes/linux-musl-x64/native/libsodium.so" PackagePath="runtimes/linux-musl-x64/native/" />
+    <Content Include="runtimes/linux-musl-arm/native/libsodium.so" PackagePath="runtimes/linux-musl-arm/native/" />
+    <Content Include="runtimes/linux-musl-arm64/native/libsodium.so" PackagePath="runtimes/linux-musl-arm64/native/" />
    <Content Include="runtimes/osx-x64/native/libsodium.dylib" PackagePath="runtimes/osx-x64/native/" />
    <Content Include="runtimes/osx-arm64/native/libsodium.dylib" PackagePath="runtimes/osx-arm64/native/" />    
  </ItemGroup>
--- a/deps/libsodium/packaging/nuget/package.config
+++ b/deps/libsodium/packaging/nuget/package.config
@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- These values are populated into the package.gsl templates by package.bat. -->
 <!-- The target attribute controls path and file name only, id controls package naming. -->
-<package id="libsodium_vc120" target="libsodium" version = "1.0.18.2" pathversion="1_0_18_2" platformtoolset="v120" />
+<package id="libsodium_vc120" target="libsodium" version = "1.0.18.4" pathversion="1_0_18_4" platformtoolset="v120" />
--- a/deps/libsodium/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
+++ b/deps/libsodium/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
--- a/deps/libsodium/src/libsodium/crypto_pwhash/argon2/argon2.c
+++ b/deps/libsodium/src/libsodium/crypto_pwhash/argon2/argon2.c
@ -17,6 +17,7 @@
 #include <stdlib.h>
 #include <string.h>

+#include "randombytes.h"
 #include "utils.h"

 #include "argon2-core.h"
@ -93,6 +94,10 @@ argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
    int            result;
    uint8_t       *out;

+    if (hash != NULL) {
+        randombytes_buf(hash, hashlen);
+    }
+
    if (pwdlen > ARGON2_MAX_PWD_LENGTH) {
        return ARGON2_PWD_TOO_LONG;
    }
--- a/deps/libsodium/src/libsodium/crypto_pwhash/scryptsalsa208sha256/crypto_scrypt-common.c
+++ b/deps/libsodium/src/libsodium/crypto_pwhash/scryptsalsa208sha256/crypto_scrypt-common.c
@ -24,6 +24,7 @@
 #include "crypto_pwhash_scryptsalsa208sha256.h"
 #include "crypto_scrypt.h"
 #include "private/common.h"
+#include "randombytes.h"
 #include "runtime.h"
 #include "utils.h"

@ -150,6 +151,10 @@ escrypt_r(escrypt_local_t *local, const uint8_t *passwd, size_t passwdlen,
    uint32_t       r;
    uint32_t       p;

+    if (buf != NULL) {
+        randombytes_buf(buf, buflen);
+    }
+
    src = escrypt_parse_setting(setting, &N_log2, &r, &p);
    if (!src) {
        return NULL;
--- a/deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c
+++ b/deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c
@ -74,7 +74,7 @@ crypto_scalarmult_curve25519_ref10(unsigned char *q,
                                   const unsigned char *n,
                                   const unsigned char *p)
 {
-    unsigned char *t = q;
+    unsigned char  t[32];
    unsigned int   i;
    fe25519        x1;
    fe25519        x2;
@ -136,6 +136,8 @@ crypto_scalarmult_curve25519_ref10(unsigned char *q,
    fe25519_mul(x2, x2, z2);
    fe25519_tobytes(q, x2);

+    sodium_memzero(t, sizeof t);
+
    return 0;
 }

--- a/deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/curve25519_sandy2x.c
+++ b/deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/curve25519_sandy2x.c
@ -24,7 +24,7 @@ static int
 crypto_scalarmult_curve25519_sandy2x(unsigned char *q, const unsigned char *n,
                                     const unsigned char *p)
 {
-  unsigned char *t = q;
+    unsigned char  t[32];
    fe             var[3];
    fe51           x_51;
    fe51           z_51;
@ -57,6 +57,8 @@ crypto_scalarmult_curve25519_sandy2x(unsigned char *q, const unsigned char *n,
    fe51_mul(&x_51, &x_51, &z_51);
    fe51_pack(q, &x_51);

+    sodium_memzero(t, sizeof t);
+
    return 0;
 }

--- a/deps/libsodium/src/libsodium/crypto_stream/salsa20/xmm6int/u0.h
+++ b/deps/libsodium/src/libsodium/crypto_stream/salsa20/xmm6int/u0.h
@ -5,7 +5,7 @@ if (bytes > 0) {
    __m128i diag3 = _mm_loadu_si128((const __m128i *) (x + 12));
    __m128i a0, a1, a2, a3, a4, a5, a6, a7;
    __m128i b0, b1, b2, b3, b4, b5, b6, b7;
-    uint8_t partialblock[64];
+    uint8_t partialblock[64] = { 0 };

    unsigned int i;

--- a/deps/libsodium/src/libsodium/sodium/utils.c
+++ b/deps/libsodium/src/libsodium/sodium/utils.c
@ -121,7 +121,7 @@ _sodium_dummy_symbol_to_prevent_memzero_lto(void *const  pnt,
 void
 sodium_memzero(void * const pnt, const size_t len)
 {
-#ifdef _WIN32
+#if defined(_WIN32) && !defined(__CRT_INLINE)
    SecureZeroMemory(pnt, len);
 #elif defined(HAVE_MEMSET_S)
    if (len > 0U && memset_s(pnt, (rsize_t) len, 0, (rsize_t) len) != 0) {
@ -129,6 +129,8 @@ sodium_memzero(void * const pnt, const size_t len)
    }
 #elif defined(HAVE_EXPLICIT_BZERO)
    explicit_bzero(pnt, len);
+#elif defined(HAVE_MEMSET_EXPLICIT)
+    memset_explicit(pnt, 0, len);
 #elif defined(HAVE_EXPLICIT_MEMSET)
    explicit_memset(pnt, 0, len);
 #elif HAVE_WEAK_SYMBOLS
@ -614,7 +616,7 @@ _sodium_malloc(const size_t size)
    memcpy(unprotected_ptr + unprotected_size, canary, sizeof canary);
 # endif
    _mprotect_noaccess(unprotected_ptr + unprotected_size, page_size);
-    sodium_mlock(unprotected_ptr, unprotected_size);
+    (void) sodium_mlock(unprotected_ptr, unprotected_size); /* not a hard error in the context of sodium_malloc() */
    canary_ptr =
        unprotected_ptr + _page_round(size_with_canary) - size_with_canary;
    user_ptr = canary_ptr + sizeof canary;
@ -684,7 +686,7 @@ sodium_free(void *ptr)
        _out_of_bounds();
    }
 # endif
-    sodium_munlock(unprotected_ptr, unprotected_size);
+    (void) sodium_munlock(unprotected_ptr, unprotected_size);
    _free_aligned(base_ptr, total_size);
 }
 #endif /* HAVE_ALIGNED_MALLOC */
--- a/deps/libsodium/test/default/Makefile.am
+++ b/deps/libsodium/test/default/Makefile.am
@ -1,5 +1,6 @@

 EXTRA_DIST = \
+	run.sh \
 	cmptest.h \
 	wasi-test-wrapper.sh \
 	wintest.bat \
--- a/deps/libsodium/test/default/Makefile.in
+++ b/deps/libsodium/test/default/Makefile.in
@ -901,6 +901,7 @@ top_srcdir = @top_srcdir@
 valgrind_enabled_tools = @valgrind_enabled_tools@
 valgrind_tools = @valgrind_tools@
 EXTRA_DIST = \
+	run.sh \
 	cmptest.h \
 	wasi-test-wrapper.sh \
 	wintest.bat \
--- a/deps/libsodium/test/default/aead_aes256gcm.c
+++ b/deps/libsodium/test/default/aead_aes256gcm.c
@ -3081,6 +3081,7 @@ tv(void)
 {
    unsigned char      *ad;
    unsigned char      *ciphertext;
+    unsigned char      *ciphertext2;
    unsigned char      *decrypted;
    unsigned char      *detached_ciphertext;
    unsigned char      *expected_ciphertext;
@ -3210,6 +3211,32 @@ tv(void)
            printf("Incorrect decryption of test vector #%u\n", (unsigned int) i);
        }

+        ciphertext2 = (unsigned char *) sodium_malloc(ciphertext_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext, &found_ciphertext_len, message,
+                                      message_len, ad, ad_len, NULL, nonce, key);
+        assert(found_ciphertext_len == ciphertext_len);
+        memcpy(ciphertext2, message, message_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext2, &found_ciphertext_len,
+                                      ciphertext2, message_len, ad, ad_len, NULL,
+                                      nonce, key);
+        assert(found_ciphertext_len == ciphertext_len);
+        assert(memcmp(ciphertext, ciphertext2, ciphertext_len) == 0);
+        if (crypto_aead_aes256gcm_decrypt(ciphertext2, &found_message_len, NULL,
+                                          ciphertext2, ciphertext_len, ad, ad_len,
+                                          nonce, key) != 0) {
+            printf("In-place decryption of vector #%u failed\n", (unsigned int) i);
+        }
+        assert(found_message_len == message_len);
+        assert(memcmp(ciphertext2, message, message_len) == 0);
+        if (crypto_aead_aes256gcm_decrypt(message, &found_message_len, NULL,
+                                          ciphertext, ciphertext_len, ad, ad_len,
+                                          nonce, key) != 0) {
+            printf("Decryption of vector #%u failed\n", (unsigned int) i);
+        }
+        assert(found_message_len == message_len);
+        assert(memcmp(ciphertext2, message, message_len) == 0);
+
+        sodium_free(ciphertext2);
        sodium_free(message);
        sodium_free(ad);
        sodium_free(expected_ciphertext);
@ -3225,11 +3252,54 @@ tv(void)
    return 0;
 }

+static int
+tv2(void)
+{
+    unsigned char *ciphertext;
+    unsigned char *message;
+    unsigned char *message2;
+    unsigned char *nonce;
+    unsigned char *key;
+    size_t         message_len;
+    size_t         ciphertext_len;
+    int            i;
+
+    for (i = 0; i < 250; i++) {
+        message_len = randombytes_uniform(1000);
+        ciphertext_len = message_len + crypto_aead_aes256gcm_ABYTES;
+        message = (unsigned char *) sodium_malloc(message_len);
+        message2 = (unsigned char *) sodium_malloc(message_len);
+        ciphertext = (unsigned char *) sodium_malloc(ciphertext_len);
+        nonce = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_NPUBBYTES);
+        key = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_KEYBYTES);
+
+        crypto_aead_aes256gcm_keygen(key);
+        randombytes_buf(nonce, crypto_aead_aes256gcm_NPUBBYTES);
+        randombytes_buf(message, message_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext, NULL, message, message_len,
+                                      NULL, 0, NULL, nonce, key);
+        if (crypto_aead_aes256gcm_decrypt(message2, NULL, NULL,
+                                          ciphertext, ciphertext_len,
+                                          NULL, 0, nonce, key) != 0) {
+            printf("Decryption of random ciphertext failed");
+        }
+        assert(message_len == 0 || memcmp(message, message2, message_len) == 0);
+        sodium_free(key);
+        sodium_free(nonce);
+        sodium_free(ciphertext);
+        sodium_free(message2);
+        sodium_free(message);
+    }
+
+    return 0;
+}
+
 int
 main(void)
 {
    if (crypto_aead_aes256gcm_is_available()) {
        tv();
+        tv2();
    }
    assert(crypto_aead_aes256gcm_keybytes() == crypto_aead_aes256gcm_KEYBYTES);
    assert(crypto_aead_aes256gcm_nsecbytes() == crypto_aead_aes256gcm_NSECBYTES);
--- a/deps/libsodium/test/default/cmptest.h
+++ b/deps/libsodium/test/default/cmptest.h
@ -118,16 +118,23 @@ static int mempool_free_all(void)

 static unsigned long long now(void)
 {
+#if defined(HAVE_CLOCK_GETTIME) && defined(CLOCK_MONOTONIC)
+    struct timespec tp;
+
+    if (clock_gettime(CLOCK_MONOTONIC, &tp) != 0) {
+        abort();
+    }
+    return (unsigned long long) tp.tv_sec * 1000000ULL +
+        (unsigned long long) tp.tv_nsec / 1000ULL;
+#else
    struct timeval tp;
-    unsigned long long now;

    if (gettimeofday(&tp, NULL) != 0) {
        abort();
    }
-    now = ((unsigned long long) tp.tv_sec * 1000000ULL) +
+    return (unsigned long long) tp.tv_sec * 1000000ULL +
        (unsigned long long) tp.tv_usec;
-
-    return now;
+#endif
 }

 int main(void)
--- a/deps/libsodium/test/default/misuse.c
+++ b/deps/libsodium/test/default/misuse.c
@ -4,12 +4,15 @@

 #ifdef HAVE_CATCHABLE_ABRT
 # include <signal.h>
+#ifndef _WIN32
+# include <unistd.h>
+#endif

 static void
 sigabrt_handler_15(int sig)
 {
    (void) sig;
-    exit(0);
+    _exit(0);
 }

 # ifndef SODIUM_LIBRARY_MINIMAL
@ -21,7 +24,7 @@ sigabrt_handler_14(int sig)
    assert(crypto_box_curve25519xchacha20poly1305_easy
           (guard_page, guard_page, crypto_stream_xchacha20_MESSAGEBYTES_MAX - 1,
            guard_page, guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -32,7 +35,7 @@ sigabrt_handler_13(int sig)
    assert(crypto_box_curve25519xchacha20poly1305_easy_afternm
           (guard_page, guard_page, crypto_stream_xchacha20_MESSAGEBYTES_MAX - 1,
            guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 # endif

@ -47,7 +50,7 @@ sigabrt_handler_12(int sig)
 # endif
    assert(crypto_pwhash_str_alg((char *) guard_page,
                                 "", 0U, 1U, 1U, -1) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -58,7 +61,7 @@ sigabrt_handler_11(int sig)
    assert(crypto_box_easy(guard_page, guard_page,
                           crypto_stream_xsalsa20_MESSAGEBYTES_MAX,
                           guard_page, guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -69,7 +72,7 @@ sigabrt_handler_10(int sig)
    assert(crypto_box_easy_afternm(guard_page, guard_page,
                                   crypto_stream_xsalsa20_MESSAGEBYTES_MAX,
                                   guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -79,7 +82,7 @@ sigabrt_handler_9(int sig)
    signal(SIGABRT, sigabrt_handler_10);
    assert(sodium_base642bin(guard_page, 1, (const char *) guard_page, 1,
                             NULL, NULL, NULL, -1) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -89,7 +92,7 @@ sigabrt_handler_8(int sig)
    signal(SIGABRT, sigabrt_handler_9);
    assert(sodium_bin2base64((char *) guard_page, 1, guard_page, 1,
                             sodium_base64_VARIANT_ORIGINAL) == NULL);
-    exit(1);
+    _exit(1);
 }

 static void
@ -99,7 +102,7 @@ sigabrt_handler_7(int sig)
    signal(SIGABRT, sigabrt_handler_8);
    assert(sodium_bin2base64((char *) guard_page, 1,
                             guard_page, 1, -1) == NULL);
-    exit(1);
+    _exit(1);
 }

 static void
@ -108,7 +111,7 @@ sigabrt_handler_6(int sig)
    (void) sig;
    signal(SIGABRT, sigabrt_handler_7);
    assert(sodium_pad(NULL, guard_page, SIZE_MAX, 16, 1) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -119,7 +122,7 @@ sigabrt_handler_5(int sig)
    assert(crypto_aead_xchacha20poly1305_ietf_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                      NULL, 0, NULL,
                                                      guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -130,7 +133,7 @@ sigabrt_handler_4(int sig)
    assert(crypto_aead_chacha20poly1305_ietf_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                     NULL, 0, NULL,
                                                     guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -141,7 +144,7 @@ sigabrt_handler_3(int sig)
    assert(crypto_aead_chacha20poly1305_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                NULL, 0, NULL,
                                                guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 static void
@ -154,7 +157,7 @@ sigabrt_handler_2(int sig)
 #else
    abort();
 #endif
-    exit(1);
+    _exit(1);
 }

 static void
@ -164,7 +167,7 @@ sigabrt_handler_1(int sig)
    signal(SIGABRT, sigabrt_handler_2);
    assert(crypto_kx_server_session_keys(NULL, NULL, guard_page, guard_page,
                                         guard_page) == -1);
-    exit(1);
+    _exit(1);
 }

 int
--- a/deps/libsodium/test/default/pwhash_argon2i.c
+++ b/deps/libsodium/test/default/pwhash_argon2i.c
@ -290,11 +290,25 @@ str_tests(void)
        -1) {
        printf("pwhash_str() with a small opslimit should have failed\n");
    }
-    if (crypto_pwhash_argon2i_str_verify("$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
-                                         "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
-                                         "password", 0x100000000ULL) != -1) {
+    {
+        const char *str_in_ = "$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
+            "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ";
+        char       *str_in = (char *) sodium_malloc(strlen(str_in_) + 1U);
+
+        const char *password_in_ = "password";
+        char       *password_in = (char *) sodium_malloc(strlen(password_in_) + 1U);
+
+        memcpy(str_in, str_in_, strlen(str_in_) + 1U);
+        memcpy(password_in, password_in_, strlen(password_in_) + 1U);
+
+        if (crypto_pwhash_argon2i_str_verify(str_in, password_in,
+                                             0x100000000ULL) != -1) {
            printf("pwhash_str_verify(invalid(0)) failure\n");
        }
+
+        sodium_free(password_in);
+        sodium_free(str_in);
+    }
    if (crypto_pwhash_argon2i_str_verify("$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
                                 "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
                                 "password", strlen("password")) != -1) {
--- a/deps/libsodium/test/default/pwhash_argon2id.c
+++ b/deps/libsodium/test/default/pwhash_argon2id.c
@ -304,11 +304,25 @@ str_tests(void)
    if (crypto_pwhash_str(str_out2, passwd, strlen(passwd), 0, MEMLIMIT) != -1) {
        printf("pwhash_argon2id_str() with a null opslimit should have failed\n");
    }
-    if (crypto_pwhash_str_verify("$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
-                                 "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
-                                 "password", 0x100000000ULL) != -1) {
+    {
+        const char *str_in_ ="$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
+            "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ";
+        char       *str_in = (char *) sodium_malloc(strlen(str_in_) + 1U);
+
+        const char *password_in_ = "password";
+        char       *password_in = (char *) sodium_malloc(strlen(password_in_) + 1U);
+
+        memcpy(str_in, str_in_, strlen(str_in_) + 1U);
+        memcpy(password_in, password_in_, strlen(password_in_) + 1U);
+
+        if (crypto_pwhash_argon2i_str_verify(str_in, password_in,
+                                             0x100000000ULL) != -1) {
            printf("pwhash_str_verify(invalid(0)) failure\n");
        }
+
+        sodium_free(password_in);
+        sodium_free(str_in);
+    }
    if (crypto_pwhash_str_verify("$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
                                 "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
                                 "password", strlen("password")) != -1) {
--- a/deps/libsodium/test/default/run.sh
+++ b/deps/libsodium/test/default/run.sh
@ -0,0 +1,9 @@
+#! /bin/sh
+
+find . -type f -perm -100 -print | grep -v run.sh | sort | while read -r x; do
+  echo "[$x]"
+  if ! "$x"; then
+    echo "*** [$x] FAILED" >&2
+    exit 1
+  fi
+done
--- a/deps/libsodium/test/default/sodium_core.c
+++ b/deps/libsodium/test/default/sodium_core.c
@ -31,11 +31,11 @@ main(void)
    (void) sodium_runtime_has_rdrand();

    sodium_set_misuse_handler(misuse_handler);
-#ifndef __EMSCRIPTEN__
+#if defined(__EMSCRIPTEN__) || defined(__wasm__) || defined(BENCHMARKS)
+    printf("misuse_handler()\n");
+#else
    sodium_misuse();
    printf("Misuse handler returned\n");
-#else
-    printf("misuse_handler()\n");
 #endif

    return 0;
--- a/deps/libsodium/test/default/sodium_utils2.c
+++ b/deps/libsodium/test/default/sodium_utils2.c
@ -6,6 +6,9 @@
 #ifdef HAVE_CATCHABLE_SEGV
 # include <signal.h>
 #endif
+#ifndef _WIN32
+# include <unistd.h>
+#endif

 #define TEST_NAME "sodium_utils2"
 #include "cmptest.h"
@ -36,7 +39,7 @@ segv_handler(int sig)
    signal(SIGABRT, SIG_DFL);
 # endif
 #endif
-    exit(0);
+    _exit(0);
 }

 int
--- a/deps/libsodium/test/default/sodium_utils3.c
+++ b/deps/libsodium/test/default/sodium_utils3.c
@ -6,6 +6,9 @@
 #ifdef HAVE_CATCHABLE_SEGV
 # include <signal.h>
 #endif
+#ifndef _WIN32
+# include <unistd.h>
+#endif

 #define TEST_NAME "sodium_utils3"
 #include "cmptest.h"
@ -32,7 +35,7 @@ segv_handler(int sig)
    signal(SIGABRT, SIG_DFL);
 # endif
 #endif
-    exit(0);
+    _exit(0);
 }

 int
--- a/deps/libsodium/test/default/wasi-test-wrapper.sh
+++ b/deps/libsodium/test/default/wasi-test-wrapper.sh
@ -1,7 +1,5 @@
 #! /bin/sh

-MAX_MEMORY_TESTS="67108864"
-
 unset LDFLAGS
 unset CFLAGS

@ -9,36 +7,6 @@ if command -v wasm-opt >/dev/null; then
  wasm-opt -O4 -o "${1}.tmp" "$1" && mv -f "${1}.tmp" "$1"
 fi

-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wavm" ]; then
-  if command -v wavm >/dev/null; then
-    wavm run --abi=wasi "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmtime" ]; then
-  if command -v wasmtime >/dev/null; then
-    wasmtime run --dir=. "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer" ]; then
-  if command -v wasmer >/dev/null; then
-    wasmer run "$1" "--${WASMER_BACKEND:-cranelift}" --dir=. && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasm3" ]; then
-  if command -v wasm3 >/dev/null; then
-    wasm3 "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "iwasm" ]; then
-  if iwasm | grep -qi wasi >/dev/null 2>&1; then
-    iwasm "$1" && exit 0
-  fi
-fi
-
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmedge" ]; then
  if command -v wasmedgec >/dev/null && command -v wasmedge >/dev/null; then
    wasmedgec "$1" "${1}.so" &&
@ -48,22 +16,84 @@ if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmedge" ]; then
  fi
 fi

+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer" ]; then
+  if command -v wasmer >/dev/null; then
+    wasmer run "$1" "--${WASMER_BACKEND:-cranelift}" --dir=. && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmtime" ]; then
+  if command -v wasmtime >/dev/null; then
+    wasmtime run --dir=. "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wavm" ]; then
+  if command -v wavm >/dev/null; then
+    wavm run --abi=wasi "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "bun" ]; then
+  if echo | bun help >/dev/null 2>&1; then
+    {
+      echo "import fs from 'fs'; import { init, WASI } from '@wasmer/wasi';"
+      echo "await init();"
+      echo "const wasi = new WASI({args: process.argv, env: process.env, preopens: {'.':'/'}});"
+      echo "await (async function() {"
+      echo "  const wasm = await WebAssembly.compile(fs.readFileSync('${1}'));"
+      echo "  await wasi.instantiate(wasm, {});"
+      echo "  wasi.start();"
+      echo "  console.log(wasi.getStdoutString());"
+      echo "})().catch(e => { console.error(e); process.exit(1); });"
+    } >"${1}.mjs"
+    bun run "${1}.mjs" 2>/tmp/err &&
+      rm -f "${1}.mjs" && exit 0
+  fi
+fi
+
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "node" ]; then
  if echo | node --experimental-wasi-unstable-preview1 >/dev/null 2>&1; then
    {
      echo "import fs from 'fs'; import { WASI } from 'wasi';"
      echo "const wasi = new WASI({args: process.argv, env: process.env, preopens: {'.':'.'}});"
      echo "const importObject = { wasi_snapshot_preview1: wasi.wasiImport };"
-      echo "const wasm = await WebAssembly.compile(fs.readFileSync('${1}'));"
-      echo "const instance = await WebAssembly.instantiate(wasm, importObject);"
-      echo "wasi.start(instance);"
+      echo "await (async function() {"
+      echo "  const wasm = await WebAssembly.compile(fs.readFileSync('${1}'));"
+      echo "  const instance = await WebAssembly.instantiate(wasm, importObject);"
+      echo "  wasi.start(instance);"
+      echo "})().catch(e => { console.error(e); process.exit(1); });"
    } >"${1}.mjs"
-    cat "${1}.mjs" >/tmp/a
-    node --experimental-wasi-unstable-preview1 "${1}.mjs" 2>/tmp/err &&
+    node --experimental-wasm-bigint --experimental-wasi-unstable-preview1 "${1}.mjs" 2>/tmp/err &&
      rm -f "${1}.mjs" && exit 0
  fi
 fi

+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasm3" ]; then
+  if command -v wasm3 >/dev/null; then
+    wasm3 "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "iwasm" ]; then
+  if command -v iwasm >/dev/null; then
+  if iwasm | grep -qi wasi >/dev/null 2>&1; then
+    if wamrc --version; then
+      wamrc -o "${1}.o" "$1" >/dev/null &&
+        iwasm --dir=. "${1}.o" && exit 0
+    else
+      iwasm --dir=. "$1" && exit 0
+    fi
+  fi
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wazero" ]; then
+  if command -v wazero >/dev/null; then
+    wazero run -mount .:/ "$1" && exit 0
+  fi
+fi
+
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer-js" ]; then
  if command -v wasmer-js >/dev/null; then
    wasmer-js run "$1" --dir=. && exit 0