chore(deps): bump @scure/btc-signer from 1.8.1 to 2.4.1 in /examples/reference-agent

[dependabot]

Bumps @scure/btc-signer from 1.8.1 to 2.4.1.

Release notes

Sourced from @​scure/btc-signer's releases.

2.4.1

• Upgrade micro-packed to 0.11.1

Full Changelog: paulmillr/scure-btc-signer@2.4.0...2.4.1

2.4.0

Tons of hardening. Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) for reports.

Breaking changes

Breaking changes do not mean "locked funds", it's mostly "throws a new error".

• Unknown and proprietary PSBT fields supplied directly to addInput/updateInput/addOutput/updateOutput now throw under the default strip policy instead of being silently dropped; pass unknown: 'ignore' (and/or proprietary: 'ignore') to preserve them
• Transaction.combine compares transaction version and effective lockTime (instead of raw constructor options) and throws on conflicting global fields it previously overwrote
• MuSig2 partialSigAgg with fewer signatures than participants now throws
• Taproot SIGHASH_SINGLE preimage for a missing output index now throws instead of returning a digest
• BIP370 locktime resolution now throws on inputs with incompatible height / time requirements (see below — the old behavior produced transactions which were not accepted by miners)

New features

• New TxOpts.unknown and TxOpts.proprietary policies for unknown / proprietary PSBT fields (proprietary defaults to the unknown setting; Unknowns type is exported):
  • 'strict': throw when an unknown field is encountered during parsing
  • 'strip' (default): accept & remove while parsing; throw when one is added / updated by the user
  • 'ignore': pass fields through from decode to encode (the spec's default behavior)
  • Why strip by default: opaque fields are a fingerprinting and data-exfiltration channel — a protocol can mark users with hidden fields, and a compromised cold wallet can leak secrets through data nobody inspects. Stripping guarantees no opaque data remains; known fields can still carry information, so inspecting all fields is still on the user
  • allowUnknown is deprecated: true maps to 'ignore', false to 'strip'
• Fields from recent BIPs are now decoded explicitly and survive round-trips instead of being treated as unknown: MuSig2 / BIP373 (musig2ParticipantPubkeys, musig2PubNonce, musig2PartialSig), silent payments / BIP375-376 (spEcdhShare, spDleq, spSpendBip32Derivation, spTweak, spV0Info, spV0Label), BIP322 (genericSignedMessage), BIP353 (dnssecProof) and pay-to-contract / BIP372 (p2cKeyTweak)
• Full PSBTv2 (BIP370) txModifiable support:
  • Newly created PSBTv2 transactions set the field by default (inputs & outputs modifiable), and addInput / updateInput / addOutput / updateOutput enforce its bits, including the restrictions implied by existing signatures. Unknown txModifiable bits follow the unknown policy
  • Previously the field was never emitted, which hurt interoperability: to other libraries an absent field means "no inputs / outputs can be added"
  • New TxOpts.allowMissingTxModifiable (default true) still treats an absent field as modifiable, for PSBTs produced by older versions; set it to false for stricter validation when possible
  • Note: emitting the field changes the serialized output, so older library versions cannot convert newly produced PSBTv2 into PSBTv0
• BIP370 locktime handling (breaking, but the old behavior produced transactions which were not accepted by miners):
  • requiredHeightLocktime / requiredTimeLocktime are range-validated and now survive input finalization — previously they were deleted on finalize, so the extracted transaction's lockTime almost never matched what was signed

... (truncated)

Changelog

Sourced from @​scure/btc-signer's changelog.

2.4.1 (2026-08-29)

• Upgrade micro-packed to 0.11.1

2.4.0 (2026-08-28)

Tons of hardening. Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) for reports.

Breaking changes

Breaking changes do not mean "locked funds", it's mostly "throws a new error".

• Unknown and proprietary PSBT fields supplied directly to addInput/updateInput/addOutput/updateOutput now throw under the default strip policy instead of being silently dropped; pass unknown: 'ignore' (and/or proprietary: 'ignore') to preserve them
• Transaction.combine compares transaction version and effective lockTime (instead of raw constructor options) and throws on conflicting global fields it previously overwrote
• MuSig2 partialSigAgg with fewer signatures than participants now throws
• Taproot SIGHASH_SINGLE preimage for a missing output index now throws instead of returning a digest
• BIP370 locktime resolution now throws on inputs with incompatible height / time requirements (see below — the old behavior produced transactions which were not accepted by miners)

New features

• New TxOpts.unknown and TxOpts.proprietary policies for unknown / proprietary PSBT fields (proprietary defaults to the unknown setting; Unknowns type is exported):
  • 'strict': throw when an unknown field is encountered during parsing
  • 'strip' (default): accept & remove while parsing; throw when one is added / updated by the user
  • 'ignore': pass fields through from decode to encode (the spec's default behavior)
  • Why strip by default: opaque fields are a fingerprinting and data-exfiltration channel — a protocol can mark users with hidden fields, and a compromised cold wallet can leak secrets through data nobody inspects. Stripping guarantees no opaque data remains; known fields can still carry information, so inspecting all fields is still on the user
  • allowUnknown is deprecated: true maps to 'ignore', false to 'strip'
• Fields from recent BIPs are now decoded explicitly and survive round-trips instead of being treated as unknown: MuSig2 / BIP373 (musig2ParticipantPubkeys, musig2PubNonce, musig2PartialSig), silent payments / BIP375-376 (spEcdhShare, spDleq, spSpendBip32Derivation, spTweak, spV0Info, spV0Label), BIP322 (genericSignedMessage), BIP353 (dnssecProof) and pay-to-contract / BIP372 (p2cKeyTweak)
• Full PSBTv2 (BIP370) txModifiable support:
  • Newly created PSBTv2 transactions set the field by default (inputs & outputs modifiable), and addInput / updateInput / addOutput / updateOutput enforce its bits, including the restrictions implied by existing signatures. Unknown txModifiable bits follow the unknown policy
  • Previously the field was never emitted, which hurt interoperability: to other libraries an absent field means "no inputs / outputs can be added"
  • New TxOpts.allowMissingTxModifiable (default true) still treats an absent field as modifiable, for PSBTs produced by older versions; set it to false for stricter validation when possible
  • Note: emitting the field changes the serialized output, so older library versions cannot convert newly produced PSBTv2 into PSBTv0
• BIP370 locktime handling (breaking, but the old behavior produced transactions which were not accepted by miners):
  • requiredHeightLocktime / requiredTimeLocktime are range-validated and now survive input finalization — previously they were deleted on finalize, so the extracted transaction's lockTime almost never matched what was signed

... (truncated)

Commits

• 373d2f3 Release 2.4.1.
• 997af7c Bump micro-packed
• 2270193 Release 2.4.0.
• 366978b Fix race condition in net
• 63af7a4 Add changelog
• 1e1faa2 Upgrade devdeps
• ce6af53 Upgrade deps
• dcda683 Rename workflow
• e995216 Fix tests
• 8178efc Bump devdeps
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scure/btc-signer since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
app	Ready	Preview	Sep 3, 2026 11:25am UTC
workspace	Ready	Preview	Sep 3, 2026 11:25am UTC