fix(deps): update dependency @noble/hashes to v1.8.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/hashes (source)	1.7.1 → 1.8.0

---

Release Notes

paulmillr/noble-hashes (@​noble/hashes)

v1.8.0

Compare Source

Preparation for version 2

This release contains fixes and improvements that pave the way for version 2.

• Made modules available with a .js extension.
  • Old: @noble/hashes/sha2.
  • New: @noble/hashes/sha2.js.
  • The old path remains available.
  • This simplifies native browser use without transpilers.
• Refactored core functionality and removed duplicate code.
• Reduced package size.

Deprecations

Several modules were renamed for clearer grouping. The old names remain available but deprecated to ease migration:

• sha256 and sha512 → sha2.
• _assert → utils.
• blake2b and blake2s → blake2.
• ripemd160 and sha1 → legacy.

v1.7.2

Compare Source

• Added an MD5 implementation to the new legacy module.
• Moved SHA-1 to legacy, retaining the old alias until the next major release.
• Made randomBytes ensure a Uint8Array result on older Node.js versions.
• Used built-in Uint8Array.toHex and Uint8Array.fromHex when available, giving a 13× speedup for 256-byte arrays and a 20× speedup for 32 KB arrays.
• Made the TypeScript source runnable without compilation on Node.js 24 through erasableSyntaxOnly.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​noble/​hashes@​1.8.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: crypto/crypto/package.json → npm/@noble/hashes@1.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: crypto/crypto/package.json → npm/@noble/hashes@1.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report