chore(deps): bump the noble-scure-crypto group across 1 directory with 5 updates

[dependabot]

Bumps the noble-scure-crypto group with 5 updates in the / directory:

Package	From	To
@noble/curves	2.2.0	2.4.0
@noble/hashes	2.2.0	2.4.0
@scure/base	2.2.0	2.4.0
@scure/bip32	2.2.0	2.4.0
@scure/bip39	2.2.0	2.4.0

Updates @noble/curves from 2.2.0 to 2.4.0

Release notes

Sourced from @​noble/curves's releases.

2.4.0

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

2.3.0

Security & constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
• General hardening across all modules
• Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

• ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
• BLS signatures 2x
• Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
• Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
• getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

• Smaller bundles: improved tree-shaking across modules
• Better error messages and type checks
• Upgrade noble-hashes to 2.3.0, with performance boost
• Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

2.3.0 (2026-08-06)

Security and constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees, with no measurable timing behavior across 200,000 samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, unprecomputed points use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New constant-time benchmarks track timing behavior.
• General hardening across all modules.
• Applied fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery ID, non-canonical BLS signature encodings are rejected, Edwards-to-Montgomery conversion helpers were corrected, and FROST DKG round-two retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519 across many samples and learn up to 4.036 bits of a long-term private key. The other 247 bits were not affected.

The impact is primarily fingerprinting—a key can be recognized across deployments—not key recovery or a break of X25519. The maintainer was also unable to escalate the attack to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr).
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou Street, 18534 Piraeus, Greece (kpatsak@unipi.gr).

Performance

• Improved ECDSA and EdDSA verification by up to 32%, Weierstrass ECDH by up to 19%, and X25519 getPublicKey by 2.7×.
• Improved BLS signature performance by 2×.
• Reduced initialization time for the first getPublicKey or sign call by approximately 2× for Ed25519, P-256, P-384, and P-521.
• Also improved verification of recovered signatures, pairing tower, FFT, and Pippenger performance, as well as joint-MSM paths in FROST and OPRF.
• getPublicKey and sign became slower because the window size was decreased from 8 to 6 and constant-time execution was hardened. Long-running applications that prefer 2.2.0-level speed can restore it with secp256k1.Point.BASE.precompute(8), and likewise for other curves.

Miscellaneous

• Improved tree-shaking for smaller bundles.
• Improved error messages and type checks.
• Upgraded noble-hashes to 2.3.0 for improved performance.
• Reduced on-disk size from 1,831 KB to 1,548 KB by disabling source maps, which have become less relevant.

Commits

• 656c436 Release 2.4.0.
• ca081f6 Add changelog
• 783fa9b Upgrade noble-hashes to 2.4.0
• 3becb84 readme
• bb52c57 readme
• 41f44d2 Restructure benchmarks. Update README
• 3587575 Bump vectors
• ae43344 Bump ci workflows
• 5c1aa39 Add fuzzing
• d5b95e4 test: add more hardening-related tests
• Additional commits viewable in compare view

Updates @noble/hashes from 2.2.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

2.3.0 (2026-08-06)

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates @scure/base from 2.2.0 to 2.4.0

Release notes

Sourced from @​scure/base's releases.

2.4.0

• Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
• Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
• bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
• bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
• base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected

Full Changelog: paulmillr/scure-base@2.3.0...2.4.0

2.3.0

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Full Changelog: paulmillr/scure-base@2.2.0...2.3.0

Changelog

Sourced from @​scure/base's changelog.

2.4.0 (2026-08-28)

• Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
• Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
• bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
• bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
• base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected

2.3.0 (2026-08-08)

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Commits

• d93da4f Release 2.4.0.
• ce220f1 Upgrade devdeps. Add changelog.
• 90de919 Harden: prohibit bech32/base_crockford non-printable; limit base58 to 4K
• c92f2d4 Bump devdeps
• 389e6bd Add base36 for ipfs; limit quadratic base encode length; add parity tests for...
• 5b846f5 Release 2.3.0.
• 27c9e1a Update jsbt
• 5e98800 test: use new syntax
• 655728b base58: limit decode to 64kb
• ff17fbe Small fixes
• Additional commits viewable in compare view

Updates @scure/bip32 from 2.2.0 to 2.4.0

Release notes

Sourced from @​scure/bip32's releases.

2.4.0

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

Full Changelog: paulmillr/scure-bip32@2.3.0...2.4.0

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

Changelog

Sourced from @​scure/bip32's changelog.

2.4.0 (2026-08-28)

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

2.3.0 (2026-08-08)

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Commits

• ab00d7f Release 2.4.0.
• d76c8e7 Upgrade deps, add changelog
• 06aeff3 Bump jsbt
• facbdf2 Harden: use nullish check; and prohibit second internal arg in deriveChild
• ba6e898 Use getters to ensure outputs cannot be mutated
• 09a0a15 Bump devdeps
• 23a2339 Harden. Improve deriveChild logic: do not blindly try-catch.
• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• See full diff in compare view

Updates @scure/bip39 from 2.2.0 to 2.4.0

Release notes

Sourced from @​scure/bip39's releases.

2.4.0

• Hardening: Unpaired UTF-16 surrogates are now rejected in mnemonics & passphrases. Normal input is unaffected
• Upgrade noble-hashes to 2.4.0
• Improve tests

Full Changelog: paulmillr/scure-bip39@2.3.0...2.4.0

2.3.0

• Rewrite package: the logic is now declared in scure-bip39 instead of @scure/base dependency, which was removed.
• Upgrade noble-hashes to 2.3.0.

Full Changelog: paulmillr/scure-bip39@2.2.0...2.3.0

Changelog

Sourced from @​scure/bip39's changelog.

2.4.0 (2026-08-28)

• Hardening: Unpaired UTF-16 surrogates are now rejected in mnemonics & passphrases. Normal input is unaffected
• Upgrade noble-hashes to 2.4.0
• Improve tests

2.3.0 (2026-08-08)

• Rewrite package: the logic is now declared in scure-bip39 instead of @scure/base dependency, which was removed.
• Upgrade noble-hashes to 2.3.0.

Commits

• 2c8cf46 Release 2.4.0.
• af5414c Update devdeps, add changelog
• f80dd87 wordlists: reject ill-formed words
• 8073136 Bump jsbt
• 4ccd7e5 Reject ill-formed Unicode from inputs
• 44ab886 Update devdeps / lockfile
• dfcb773 Add more tests, update fetch-wordlist
• db04e10 Bump devdeps
• 158de4a Release 2.3.0.
• 4507966 Rewrite package to not depend on scure-base.
• Additional commits viewable in compare view