Skip to content

build(deps): bump the library-runtime group across 1 directory with 7 updates - #337

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/library-runtime-0b7724803e
Open

build(deps): bump the library-runtime group across 1 directory with 7 updates#337
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/library-runtime-0b7724803e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the library-runtime group with 7 updates in the / directory:

Package From To
@noble/curves 2.3.0 2.4.0
@noble/hashes 2.3.0 2.4.0
@scure/base 2.3.0 2.4.0
react-native-passkey 3.6.1 3.6.2
viem 2.55.13 2.56.3
@scure/bip32 2.3.0 2.4.0
@scure/bip39 2.3.0 2.4.0

Updates @noble/curves from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/curves's releases.

2.4.0

  • Harden FROST distributed key generation against round-one transcript substitution.
    • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
  • FROST: Enforced RFC 9591 point validation for BLS and BN
  • POPRF: replace inversion with const-time version
  • Weierstrass: harden public-key boundaries & infinity handling
    • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
    • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
  • DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
  • Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

  • Harden FROST distributed key generation against round-one transcript substitution.
    • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
  • FROST: Enforced RFC 9591 point validation for BLS and BN
  • POPRF: replace inversion with const-time version
  • Weierstrass: harden public-key boundaries & infinity handling
    • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
    • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
  • DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
  • Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Commits

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization

Misc

  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

  • Protect passed options against mutation / pollution
  • keccakprg: fail until entropy is added
  • webcrypto: reject output sizes which crashed engine
  • blake3: fix tree merging for multi-terabyte streams
  • Improve zeroization

Misc

  • Speed-up Argon2 by 20%
  • Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
  • Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
  • nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.
Commits

Updates @scure/base from 2.3.0 to 2.4.0

Release notes

Sourced from @​scure/base's releases.

2.4.0

  • Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
  • Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
  • bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
  • bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
  • base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected

Full Changelog: paulmillr/scure-base@2.3.0...2.4.0

Changelog

Sourced from @​scure/base's changelog.

2.4.0 (2026-08-28)

  • Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
  • Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
  • bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
  • bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
  • base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected
Commits
  • d93da4f Release 2.4.0.
  • ce220f1 Upgrade devdeps. Add changelog.
  • 90de919 Harden: prohibit bech32/base_crockford non-printable; limit base58 to 4K
  • c92f2d4 Bump devdeps
  • 389e6bd Add base36 for ipfs; limit quadratic base encode length; add parity tests for...
  • See full diff in compare view

Updates react-native-passkey from 3.6.1 to 3.6.2

Release notes

Sourced from react-native-passkey's releases.

Release 3.6.2

Bug Fixes

  • [Android] skip explicit Kotlin plugin when AGP registers the kotlin extension (#116)
  • [iOS] detect no-credential from the error's failure reason (#112)

Thanks to @​kenlim1 and @​gabrieldonadel for their contribution!

Full Changelog: https://github.com/f-23/react-native-passkey/compare/v3.6.1..v3.6.2

Changelog

Sourced from react-native-passkey's changelog.

3.6.2 (2026-09-08)

Bug Fixes

  • android: skip explicit Kotlin plugin when AGP registers the kotlin extension (a1f6e81)
  • ios: detect no-credential from the error's failure reason (42875d2)
Commits
  • de644ad chore: release 3.6.2
  • e875e6d Merge pull request #116 from gabrieldonadel/fix/agp9-built-in-kotlin
  • a1f6e81 fix(android): skip explicit Kotlin plugin when AGP registers the kotlin exten...
  • 86fef71 Merge pull request #112 from kenlim1/stable
  • 42875d2 fix(ios): detect no-credential from the error's failure reason
  • See full diff in compare view

Updates viem from 2.55.13 to 2.56.3

Release notes

Sourced from viem's releases.

viem@2.56.3

Patch Changes

viem@2.56.2

Patch Changes

viem@2.56.1

Patch Changes

viem@2.56.0

Minor Changes

... (truncated)

Commits

Updates @scure/bip32 from 2.3.0 to 2.4.0

Release notes

Sourced from @​scure/bip32's releases.

2.4.0

Hardening:

  • The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
  • deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
  • fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
  • Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
  • derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
  • Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
  • fromJSON now also accepts { xpub } to restore a public-only key
  • Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

Full Changelog: paulmillr/scure-bip32@2.3.0...2.4.0

Changelog

Sourced from @​scure/bip32's changelog.

2.4.0 (2026-08-28)

Hardening:

  • The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
  • deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
  • fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
  • Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
  • derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
  • Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
  • fromJSON now also accepts { xpub } to restore a public-only key
  • Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.
Commits
  • ab00d7f Release 2.4.0.
  • d76c8e7 Upgrade deps, add changelog
  • 06aeff3 Bump jsbt
  • facbdf2 Harden: use nullish check; and prohibit second internal arg in deriveChild
  • ba6e898 Use getters to ensure outputs cannot be mutated
  • 09a0a15 Bump devdeps
  • 23a2339 Harden. Improve deriveChild logic: do not blindly try-catch.
  • See full diff in compare view

Updates @scure/bip39 from 2.3.0 to 2.4.0

Release notes

Sourced from @​scure/bip39's releases.

2.4.0

  • Hardening: Unpaired UTF-16 surrogates are now rejected in mnemonics & passphrases. Normal input is unaffected
  • Upgrade noble-hashes to 2.4.0
  • Improve tests

Full Changelog: paulmillr/scure-bip39@2.3.0...2.4.0

Changelog

Sourced from @​scure/bip39's changelog.

2.4.0 (2026-08-28)

  • Hardening: Unpaired UTF-16 surrogates are now rejected in mnemonics & passphrases. Normal input is unaffected
  • Upgrade noble-hashes to 2.4.0
  • Improve tests
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the library-runtime group across 1 directory with 7…
2dcd9eb 
… updates

Bumps the library-runtime group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@noble/curves](https://github.com/paulmillr/noble-curves) | `2.3.0` | `2.4.0` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.3.0` | `2.4.0` |
| [@scure/base](https://github.com/paulmillr/scure-base) | `2.3.0` | `2.4.0` |
| [react-native-passkey](https://github.com/f-23/react-native-passkey) | `3.6.1` | `3.6.2` |
| [viem](https://github.com/wevm/viem) | `2.55.13` | `2.56.3` |
| [@scure/bip32](https://github.com/paulmillr/scure-bip32) | `2.3.0` | `2.4.0` |
| [@scure/bip39](https://github.com/paulmillr/scure-bip39) | `2.3.0` | `2.4.0` |



Updates `@noble/curves` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-curves/releases)
- [Changelog](https://github.com/paulmillr/noble-curves/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-curves@2.3.0...2.4.0)

Updates `@noble/hashes` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.3.0...2.4.0)

Updates `@scure/base` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/scure-base/releases)
- [Changelog](https://github.com/paulmillr/scure-base/blob/main/CHANGELOG.md)
- [Commits](paulmillr/scure-base@2.3.0...2.4.0)

Updates `react-native-passkey` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/f-23/react-native-passkey/releases)
- [Changelog](https://github.com/f-23/react-native-passkey/blob/stable/CHANGELOG.md)
- [Commits](f-23/react-native-passkey@v3.6.1...v3.6.2)

Updates `viem` from 2.55.13 to 2.56.3
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.55.13...viem@2.56.3)

Updates `@scure/bip32` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/scure-bip32/releases)
- [Changelog](https://github.com/paulmillr/scure-bip32/blob/main/CHANGELOG.md)
- [Commits](paulmillr/scure-bip32@2.3.0...2.4.0)

Updates `@scure/bip39` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/scure-bip39/releases)
- [Changelog](https://github.com/paulmillr/scure-bip39/blob/main/CHANGELOG.md)
- [Commits](paulmillr/scure-bip39@2.3.0...2.4.0)

---
updated-dependencies:
- dependency-name: "@noble/curves"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
- dependency-name: "@noble/hashes"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
- dependency-name: "@scure/base"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
- dependency-name: react-native-passkey
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: library-runtime
- dependency-name: viem
  dependency-version: 2.56.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
- dependency-name: "@scure/bip32"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
- dependency-name: "@scure/bip39"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: library-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants