Upgrade noble and scure dependencies to v2.2

[paulmillr]

See #4575. Feel free to copy / edit / incorporate into your own branch. Feel free to delay until v3 (this is compat-breaking because of node.js >=20.19 requirement) is released.

Duplicating text from 4575:

We now have stable noble v2.2.x.

• Reason 1: The packages had undergone through a very detailed self-audit, which found more minor & medium-severity issues than all previous third party audits combined.

• Reason 2: Because of the LLMs, attackers are having a breakthrough and it would be great to have Viem line up with the latest, and the only security-relevant noble versions. Older versions would degrade and probably get broken sooner.

• hashes

  • v2.2 apr 2026 notes
  • v2.0 aug 2025 notes
  • 1.8..2.2 diff

• curves

  • v2.2 apr 2026 notes
  • v2.0 aug 2025 notes
  • 1.9..2.2 diff

[vercel]

@paulmillr is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a32044d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​paulmillr/​trusted-setups@​0.1.2 ⏵ 0.3.0			+2	+4
	micro-eth-signer@​0.14.0 ⏵ 0.18.1	+1
	@​scure/​bip39@​2.2.0
	@​scure/​bip32@​2.2.0
	@​noble/​hashes@​1.7.2 ⏵ 2.2.0	+1
	@​noble/​curves@​1.8.2 ⏵ 2.2.0

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/viem@4588

commit: a32044d

[paulmillr]

More packages are using noble v2 now; because of the new features and security improvements. By keeping the old v1 around, viem will increase bundle size of users by a large amount, until the deps are upgraded.

[jxom]

Yes I know :) we have v3 planned.

[frosty00]

More packages are using noble v2 now; because of the new features and security improvements. By keeping the old v1 around, viem will increase bundle size of users by a large amount, until the deps are upgraded.

+1 from https://github.com/ccxt/ccxt