fix(deps): update dependency @noble/curves to v2.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/curves (source)	2.0.1 → 2.4.0

---

Release Notes

paulmillr/noble-curves (@​noble/curves)

v2.4.0

Compare Source

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

v2.3.0

Compare Source

Security & constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
• General hardening across all modules
• Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

• ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
• BLS signatures 2x
• Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
• Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
• getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

• Smaller bundles: improved tree-shaking across modules
• Better error messages and type checks
• Upgrade noble-hashes to 2.3.0, with performance boost
• Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

v2.2.0

Compare Source

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Updated Ed25519 ZIP 215 verification to match the specification more strictly where its vectors were insufficient.
  • Disabled ZIP 215 mode by default for Ed448 in favor of stricter verification.
  • Changed Schnorr randomness handling to reduce modulo N instead of throwing.
  • Hardened square-root calculations.
  • Corrected the Baby Jubjub curve and its parameters.
  • Improved DER parsing.
  • Improved BLS point decoding.
  • Fixed the Fp6 and Fp12 order for BLS and BN curves.
  • Made empty hash-to-curve DST and count values throw.
  • Applied Object.freeze to most primitives.
  • Other minor hardening.
• Fixed all byte-array types to work properly in both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 has Uint8Array, while TypeScript 5.9+ made it generic: Uint8Array<ArrayBuffer>.
  • This created incompatibilities between TypeScript versions.
  • Previously, usage was difficult and constantly emitted errors similar to TS2345.
  • See TypeScript issue #​62240 for more context.
• Implemented FROST threshold signatures from RFC 9591.
• Fixed compilation issues on TypeScript 6.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the codebase.

Version 2.1 was skipped to align with other noble packages.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.