build(deps): bump the production-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
@noble/curves	2.2.0	2.3.0
@noble/post-quantum	0.6.1	0.7.0
@scure/base	2.2.0	2.3.0
@scure/bip32	2.2.0	2.3.0
@scure/bip39	2.2.0	2.3.0
tar	7.5.20	7.5.22

Updates @noble/curves from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/curves's releases.

2.3.0

Security & constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
• General hardening across all modules
• Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

• ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
• BLS signatures 2x
• Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
• Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
• getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

• Smaller bundles: improved tree-shaking across modules
• Better error messages and type checks
• Upgrade noble-hashes to 2.3.0, with performance boost
• Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Commits

• da60750 Release 2.3.0.
• 9092187 README
• ff189ce Minor comment reformatting
• 17fda00 jsr: prepare for publish
• e23353d Upgrade to noble-hashes 2.3.0
• 24db224 Minor fixes
• a1d1c85 Update jsbt to 0.6.5
• 243bdaf test: use new syntax
• dc0acf5 Disable source maps
• e229382 Improve tree-shaking
• Additional commits viewable in compare view

Updates @noble/hashes from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Commits

• 8060cc8 Release 2.3.0.
• 16f8af9 Update workflow and benchmarks
• 734220f Update jsbt to 0.6.5
• fd3d3c3 Minor improvements
• 3654405 test: use new syntax
• e222e2d utils: minor fixes
• ef7ae52 Improve speed. Reduce bundle size. Reduce mem usage.
• 26b194a Rename npm action
• e89d6fa Bump jsbt to v0.6
• de8098a Move benchmarks top-level
• Additional commits viewable in compare view

Updates @noble/post-quantum from 0.6.1 to 0.7.0

Release notes

Sourced from @​noble/post-quantum's releases.

0.7.0

Breaking

• hybrid: legacy aliases removed. XWing/MLKEM768X25519 → ml_kem768_x25519, MLKEM768P256 → ml_kem768_p256, MLKEM1024P384 → ml_kem1024_p384, QSFMLKEM768P256 → QSF_ml_kem768_p256, QSFMLKEM1024P384 → QSF_ml_kem1024_p384, KitchenSinkMLKEM768X25519 → KitchenSink_ml_kem768_x25519.
• utils: afunction no longer exported — moved to @noble/curves/utils.js.

Other

• Falcon: Fix length check in detached (non-default) falcon
• MultiplyNTTs intermediate overflow — a1*b1*zeta could reach ~2³⁵; now mod(mod(a1*b1)*zeta + a0*b0).
• ML-DSA sign entropy ordering — randomness drawn before secret-key decoding, so an RNG throw can't leave partially-decoded key material live.
• ML-DSA externalMu length-checks msg as 64-byte µ; ML-KEM detaches the caller's public key before caching; equalBytes validates its inputs; stricter checks and messages throughout.
• Up to 2x speed boost for SLH-DSA
• +16-42% speed boost for hybrid ml-kem-768+x25519
• Upgrade noble deps to 2.3.0
• Reduce on-disk unpacked size, 813kb → 654kb (-159kb): by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-post-quantum@2.2.0...2.3.0

Commits

• 75c18a6 Release 0.7.0.
• 40c6b5c Update docs
• 602ebaa Fix bigint literals
• 3e63cde Fix pkg.json
• ca6e054 Upgrade deps
• da11fa2 Reduce code
• 8bff5fa Update jsbt and deps
• 68e5046 test: use new syntax
• 42ec4df hybrid: remove legacy aliases (use new ones)
• 6ee24a1 readme
• Additional commits viewable in compare view

Updates @scure/base from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/base's releases.

2.3.0

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Full Changelog: paulmillr/scure-base@2.2.0...2.3.0

Commits

• 5b846f5 Release 2.3.0.
• 27c9e1a Update jsbt
• 5e98800 test: use new syntax
• 655728b base58: limit decode to 64kb
• ff17fbe Small fixes
• e480812 Speed-up base58 15x. Speed-up bech32 2x. Remove utils, bytes, str, bytesToStr...
• 3b06771 Massive speed-up. Up to: 15x base16, 14x base32, 14x base64, 6x bech32.toWords.
• b009c91 Move benchmark directory
• acab2cb Update jsbt
• cc09895 Update jsbt. Improve error messages and type checks.
• See full diff in compare view

Updates @scure/bip32 from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/bip32's releases.

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

Commits

• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• See full diff in compare view

Updates @scure/bip39 from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/bip39's releases.

2.3.0

• Rewrite package: the logic is now declared in scure-bip39 instead of @scure/base dependency, which was removed.
• Upgrade noble-hashes to 2.3.0.

Full Changelog: paulmillr/scure-bip39@2.2.0...2.3.0

Commits

• 158de4a Release 2.3.0.
• 4507966 Rewrite package to not depend on scure-base.
• 857eed1 Upgrade deps
• aeb2733 test: add more tests. Use new syntax
• See full diff in compare view

Updates tar from 7.5.20 to 7.5.22

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 74f5a55

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR