[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/hashes (source)	^1.8.0 → ^2.0.0

---

Release Notes

paulmillr/noble-hashes (@​noble/hashes)

v2.4.0

Compare Source

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

v2.3.0

Compare Source

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #​134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #​135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

v2.2.0

Compare Source

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Fixed dkLen=0 handling in pbkdf2, blake2, turboshake, and kt.
  • Fixed parallelHash with blockLen=0.
  • Made the argon2 progress callback reach 100%.
  • Changed digestInto to return no value for better performance.
  • Added support for non-four-divisible dkLen values in argon2 and blake2.
• Fixed all byte-array types for compatibility with both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 uses Uint8Array, while TypeScript 5.9+ made it generic as Uint8Array<ArrayBuffer>.
  • This previously caused incompatibilities and errors such as TS2345.
  • See TypeScript issue #​62240 for more context.
• Sped up SHA-3 by as much as 50%, contributed by @​ChALkeR in pull request #​126.
• Fixed compilation issues on TypeScript 6.
• Added big-endian support; all tests pass on s390x.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the package.
• Skipped version 2.1 to align with the other noble packages.

v2.0.1

Compare Source

• Required the .js extension for all module imports.
  • Old: @noble/hashes/sha3.
  • New: @noble/hashes/sha3.js.
  • This simplifies native browser use without transpilers.
  • The change was planned for 2.0.0 but accidentally omitted.
• Declared exported submodules in package.json to support TypeScript autocompletion.
• Fixed the scrypt maxmem error message, contributed by @​ChALkeR in pull request #​121.
• Sped up scrypt by 4%, contributed by @​ChALkeR in pull request #​122.

v2.0.0

Compare Source

High-level changes

• Made the package ESM-only. ESM can be loaded from CommonJS on Node.js 20.19 and later.
  • Node.js 20.19 is now the minimum required version.
  • Package imports now work correctly in bundler-free environments such as browsers.
  • Reduced npm package download size from 152 KB to 136 KB.
  • Reduced unpacked on-disk size from 1.1 MB to 669 KB.
• Reduced bundle sizes compared with version 1.
• Required the .js extension for all module imports.
  • Old: @noble/hashes/sha3.
  • New: @noble/hashes/sha3.js.
  • This simplifies native browser use without transpilers.

API changes

• Restricted hash inputs to Uint8Array and prohibited string inputs.
  • Strict validation improves security.
  • Use utils.utf8ToBytes to reproduce the previous behavior.
• Renamed or removed modules for consistency.
  • sha256 and sha512 → sha2.js.
  • blake2b and blake2s → blake2.js.
  • ripemd160, sha1, and md5 → legacy.js.
  • _assert → utils.js.
  • Removed the internal crypto module in favor of built-in WebCrypto.
• Improved TypeScript types and option autocompletion.
• Upgraded the TypeScript compilation environment to TypeScript 5.9 and ES2022.
• Made error messages substantially more descriptive.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud