Skip to content

Bump @noble/curves from 1.4.0 to 1.9.1 #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 14, 2025

Bumps @noble/curves from 1.4.0 to 1.9.1.

Release notes

Sourced from @​noble/curves's releases.

1.9.1

  • abstract/fft - new experimental implementation of FFT (Fast Fourier Transform) / NTT
  • abstract/edwards: verify curve parameters (equation) on initialization
  • abstract/weierstrass: verify curve parameters (discriminant) on initialization
  • abstract/weierstrass: improve getSharedSecret arg validation for rare curves
  • abstract/weierstrass: fix invalid sig recovery decoding length for rare curves
  • abstract/modular: improve sqrt calculation
  • x25519, x448: accept more valid inputs for priv / pub keys
  • secp256k1: improve tree-shaking

Full Changelog: paulmillr/noble-curves@1.9.0...1.9.1

1.9.0

The release contains bugfixes and a few improvements which pave the way for upcoming v2.0.

  • Modules are now available with .js extension
    • Old: @noble/curves/ed25519
    • New: @noble/curves/ed25519.js
    • Old path is still available
    • This simplifies working in browsers natively without transpilers
  • poseidon: add support for sponge, grain LFSR
  • p256, p384, p521: merge into new "nist" module
  • weierstrass: prohibit y=0 when initializing
  • hash-to-curve: use inv0 everywhere to ensure ZERO elements are returned in exceptional cases
  • modular: improve sqrt logic (tonelliShanks, legendre)
  • modular: fix FpInvertBatch creating arrays with holes instead of arrays with undefined
  • pasta: deprecate curves
  • update noble-hashes to 1.8.0

Full Changelog: paulmillr/noble-curves@1.8.2...1.9.0

1.8.2

  • Important: this release adjusts wNAF scalar multiplication logic
    • The adjustment is small (deduplication), but wNAF is sensitive code handling private keys
    • Verify the change yourself paulmillr/noble-curves#184
  • edwards: (ed25519, ed448) always use complete formula in add()
  • edwards: (ed25519, ed448) ban points with z=0 (zero points have z=1)
  • ed25519: use slower, but more precise CURVE.a definition
  • weierstrass: freeze Signature on creation
  • weierstrass: Fix curve in Palemoon browser #176
  • hash-to-curve: throw better error for 0 in mapToCurve
  • tower: fix wrong Fp12 fields type
  • misc: new module. Contains jubjub and babyjubjub.
  • utils: use built-in Uint8Array toHex / fromHex when available. Gives 13x speed-up on 256b arrays, 20x speed-up on 32kb arrays

Other changes

  • Update noble-hashes to 1.7.2
  • Reduce standalone file build size by 0.5kb
  • Standalone build files are now attested in CI. Check out README for verification guide

... (truncated)

Commits
  • ede19f4 Release 1.9.1.
  • e3e288c Update jsbt to 0.4.0
  • a8e4aff weierstrass: fix invalid sig recovery decoding length for rare curves
  • 9c60b60 weierstrass, edwards: validate curve params on init, discriminant
  • b88a6e6 weierstrass: improve getSharedSecret arg validation for rare curves
  • e3f25bc weierstrass: more comments on endomorphism, add endo calculator to test/misc
  • 584add3 abstract/tower, bls: clarify comments
  • 947f0d6 modular: strict return type for FpLegendre
  • 44ded74 readme
  • b3ca021 Add fft test
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

🔗 zboto Link

Bumps [@noble/curves](https://github.com/paulmillr/noble-curves) from 1.4.0 to 1.9.1.
- [Release notes](https://github.com/paulmillr/noble-curves/releases)
- [Commits](paulmillr/noble-curves@1.4.0...1.9.1)

---
updated-dependencies:
- dependency-name: "@noble/curves"
  dependency-version: 1.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 14, 2025
Copy link

@windsurf-bot windsurf-bot bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 file skipped due to size limits:
  • yarn.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants