chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/curves (source)	1.9.2 → 1.9.7
@scure/base (source)	2.0.0 → 2.2.0

---

Release Notes

paulmillr/noble-curves (@​noble/curves)

v1.9.7

Compare Source

• edwards: rename newly introduced / experimental toMontgomeryPriv => toMontgomerySecret
• weierstrass: Add back SignatureConstructor
• More deprecations and preparations for v2

Full Changelog: paulmillr/noble-curves@1.9.6...1.9.7

v1.9.6

Compare Source

• edwards: expose nBitLength, nByteLength
• Experimental CurveLengths interface: rename secret, public to secretKey, publicKey
• Point precomputes: initialize calculation earlier, within weierstrass() method (still lazy, waits for first call)
• bls: new internal tower from v2
• ed448: Ensure there are two different Fn fields with different BITS length for ed448 / decaf44

Full Changelog: paulmillr/noble-curves@1.9.5...1.9.6

v1.9.5

Compare Source

• Fix rollup warnings from gh-205
• add back aliases for secp256r1 / secp384r1 / secp521r1 from gh-203
• bring back CURVE.nByteLength from gh-202
• More preparations and deprecations for future v2 release

Full Changelog: paulmillr/noble-curves@1.9.4...1.9.5

v1.9.4

Compare Source

• Fix gh-201: invalid renaming of ProjConstructor
• Add more deprecations for the upcoming v2

Full Changelog: paulmillr/noble-curves@1.9.3...1.9.4

v1.9.3

Compare Source

The release contains bugfixes and a few improvements which pave the way for upcoming v2.0.

There are lots of renamings and API adjustments; but all old code would work as-is. The code would visually flagged as "deprecated" (using jsdoc flag) in typescript-supported code environments, which makes it easy to upgrade to new versions.

• Rename *privateKey to *secretKey everywhere for consistency with post-quantum and non-noble libraries
• Add keygen method to curves which creates both secret and public keys
• weierstrass: make endomorphism generic and work for all Koblitz curves
• weierstrass: add fromBytes and toBytes to Signature, deprecate fromDER, fromCompact, toDERRawBytes, toCompactRawBytes
• edwards: move edwardsToMontgomery into utils.toMontgomery
• decaf, ristretto: new interface which makes it more similar to other Points
• ed448: add ED448_TORSION_GROUP
• curve: add curve.info interface to all curves for better interop.
• curve: change public wNAF API
• modular: add sqrt9mod16
• hash-to-curve: move all hashers into _hasher props. E.g. secp256k1_hasher
• test: Add ACVP test vectors

Sensitive code changes

• wNAF: mostly renamings
• Field bound validation: for scalars (Fn) and curve fields (Fp)

Full Changelog: paulmillr/noble-curves@1.9.2...1.9.3

paulmillr/scure-base (@​scure/base)

v2.2.0

Compare Source

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• utf8: make decoder strict, use isWellFormed (polyfilled in some envs)
• Add strict ascii decoder (char range 0..127)
• Bech32 examples in the docs by @​davay42 in #​44
• Add overload to Bech32.decode to handle arbitrary string input by @​webmaster128 in #​45
• perf: trust Uint8Array.fromBase64 to check non-whitespace chars by @​ChALkeR in #​47

New Contributors

• @​davay42 made their first contribution in #​44
• @​webmaster128 made their first contribution in #​45
• @​ChALkeR made their first contribution in #​47

(We're skipping v2.1, to align with other noble / scure packages)

Full Changelog: paulmillr/scure-base@2.0.0...2.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks