fix(deps): update dependency @noble/curves to v1.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@noble/curves (source)	1.8.1 -> 1.9.0

---

Release Notes

paulmillr/noble-curves (@​noble/curves)

v1.9.0

Compare Source

The release contains bugfixes and a few improvements which pave the way for upcoming v2.0.

• Modules are now available with .js extension
  • Old: @noble/curves/ed25519
  • New: @noble/curves/ed25519.js
  • Old path is still available
  • This simplifies working in browsers natively without transpilers
• poseidon: add support for sponge, grain LFSR
• p256, p384, p521: merge into new "nist" module
• weierstrass: prohibit y=0 when initializing
• hash-to-curve: use inv0 everywhere to ensure ZERO elements are returned in exceptional cases
• modular: harden FpLegendre & FpIsSquare, make it always return valid values, throw an error otherwise
• modular: fix FpInvertBatch creating arrays with holes instead of arrays with undefined
• modular: improve logic for tonelliShanks
• pasta: deprecate curves
• update noble-hashes to 1.8.0

Full Changelog: paulmillr/noble-curves@1.8.2...1.9.0

v1.8.2

Compare Source

• Important: this release adjusts wNAF scalar multiplication logic
  • The adjustment is small (deduplication), but wNAF is sensitive code handling private keys
  • Verify the change yourself https://github.com/paulmillr/noble-curves/pull/184
• edwards: (ed25519, ed448) always use complete formula in add()
• edwards: (ed25519, ed448) ban points with z=0 (zero points have z=1)
• ed25519: use slower, but more precise CURVE.a definition
• weierstrass: freeze Signature on creation
• weierstrass: Fix curve in Palemoon browser #​176
• hash-to-curve: throw better error for 0 in mapToCurve
• tower: fix wrong Fp12 fields type
• misc: new module. Contains jubjub and babyjubjub.
• utils: use built-in Uint8Array toHex / fromHex when available. Gives 13x speed-up on 256b arrays, 20x speed-up on 32kb arrays

Other changes

• Update noble-hashes to 1.7.2
• Reduce standalone file build size by 0.5kb
• Standalone build files are now attested in CI. Check out README for verification guide
• Typescript source can now be used without compilation in node.js v24, due to erasableSyntaxOnly

New Contributors

• @​tuantran-genetica made their first contribution in https://github.com/paulmillr/noble-curves/pull/181
• @​kigawas made their first contribution in https://github.com/paulmillr/noble-curves/pull/183

Acknowledgments

Thanks to @​ChALkeR for spotting edwards bug.

Full Changelog: paulmillr/noble-curves@1.8.1...1.8.2

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​noble/​curves@​1.9.0

View full report