fix(deps): update dependency @noble/curves to v2.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/curves (source)	2.0.1 → 2.4.0

---

Release Notes

paulmillr/noble-curves (@​noble/curves)

v2.4.0

Compare Source

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

v2.3.0

Compare Source

Security and constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees, with no measurable timing behavior across 200,000 samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, unprecomputed points use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New constant-time benchmarks track timing behavior.
• General hardening across all modules.
• Applied fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery ID, non-canonical BLS signature encodings are rejected, Edwards-to-Montgomery conversion helpers were corrected, and FROST DKG round-two retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519 across many samples and learn up to 4.036 bits of a long-term private key. The other 247 bits were not affected.

The impact is primarily fingerprinting—a key can be recognized across deployments—not key recovery or a break of X25519. The maintainer was also unable to escalate the attack to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr).
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou Street, 18534 Piraeus, Greece (kpatsak@unipi.gr).

Performance

• Improved ECDSA and EdDSA verification by up to 32%, Weierstrass ECDH by up to 19%, and X25519 getPublicKey by 2.7×.
• Improved BLS signature performance by 2×.
• Reduced initialization time for the first getPublicKey or sign call by approximately 2× for Ed25519, P-256, P-384, and P-521.
• Also improved verification of recovered signatures, pairing tower, FFT, and Pippenger performance, as well as joint-MSM paths in FROST and OPRF.
• getPublicKey and sign became slower because the window size was decreased from 8 to 6 and constant-time execution was hardened. Long-running applications that prefer 2.2.0-level speed can restore it with secp256k1.Point.BASE.precompute(8), and likewise for other curves.

Miscellaneous

• Improved tree-shaking for smaller bundles.
• Improved error messages and type checks.
• Upgraded noble-hashes to 2.3.0 for improved performance.
• Reduced on-disk size from 1,831 KB to 1,548 KB by disabling source maps, which have become less relevant.

v2.2.0

Compare Source

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Updated Ed25519 ZIP 215 verification to match the specification more strictly where its vectors were insufficient.
  • Disabled ZIP 215 mode by default for Ed448 in favor of stricter verification.
  • Changed Schnorr randomness handling to reduce modulo N instead of throwing.
  • Hardened square-root calculations.
  • Corrected the Baby Jubjub curve and its parameters.
  • Improved DER parsing.
  • Improved BLS point decoding.
  • Fixed the Fp6 and Fp12 order for BLS and BN curves.
  • Made empty hash-to-curve DST and count values throw.
  • Applied Object.freeze to most primitives.
  • Other minor hardening.
• Fixed all byte-array types to work properly in both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 has Uint8Array, while TypeScript 5.9+ made it generic: Uint8Array<ArrayBuffer>.
  • This created incompatibilities between TypeScript versions.
  • Previously, usage was difficult and constantly emitted errors similar to TS2345.
  • See TypeScript issue #​62240 for more context.
• Implemented FROST threshold signatures from RFC 9591.
• Fixed compilation issues on TypeScript 6.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the codebase.

Version 2.1 was skipped to align with other noble packages.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.