Skip to content

chore(deps): bump the npm-sdk-non-security group across 2 directories with 4 updates - #68

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/sdk/pq/main/npm-sdk-non-security-6b23741a81
Open

chore(deps): bump the npm-sdk-non-security group across 2 directories with 4 updates#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/sdk/pq/main/npm-sdk-non-security-6b23741a81

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-sdk-non-security group with 3 updates in the /sdk/pq directory: @noble/post-quantum, @types/node and vitest.
Bumps the npm-sdk-non-security group with 3 updates in the /sdk/threshold directory: @types/node, vitest and @noble/curves.

Updates @noble/post-quantum from 0.6.1 to 0.7.1

Release notes

Sourced from @​noble/post-quantum's releases.

0.7.1

  • Added @noble/post-quantum/webcrypto.js, an async noble-style wrapper around the experimental built-in WebCrypto implementations of ML-KEM-512, ML-KEM-768, ML-KEM-1024, and ML-KEM-768 + X25519. It supports deterministic raw-seed key generation, public-key derivation, encapsulation, decapsulation, and a memoized isSupported() probe that performs a complete round trip instead of checking method presence alone.
  • Snapshot all options to ensure they're not mutated later
  • Snapshot msg in falcon*.attached.open()
  • Ensure falcon*.attached.open() throws correct error for malformed sig / pubkey
  • combineKEMS() and combineSigners() now expect valid byte arrays
  • Enforce digest lengths promised by pre-hash XOF OIDs: 32b for SHAKE128, 64b for SHAKE256
  • Improve zeroization
  • Improve Falcon signing and parsing: imported compact secret keys are rejected when the reconstructed sampler deviation is outside Falcon's proof interval
  • Harden WebCrypto input validation
  • Upgraded noble dependencies to 2.4.0

Special thanks to Leon Acosta (from QuantaKrypto audits).

Full Changelog: paulmillr/noble-post-quantum@0.7.0...0.7.1

0.7.0

Breaking

  • hybrid: legacy aliases removed. XWing/MLKEM768X25519 → ml_kem768_x25519, MLKEM768P256 → ml_kem768_p256, MLKEM1024P384 → ml_kem1024_p384, QSFMLKEM768P256 → QSF_ml_kem768_p256, QSFMLKEM1024P384 → QSF_ml_kem1024_p384, KitchenSinkMLKEM768X25519 → KitchenSink_ml_kem768_x25519.
  • utils: afunction no longer exported — moved to @noble/curves/utils.js.

Other

  • Falcon: Fix length check in detached (non-default) falcon
  • MultiplyNTTs intermediate overflow — a1*b1*zeta could reach ~2³⁵; now mod(mod(a1*b1)*zeta + a0*b0).
  • ML-DSA sign entropy ordering — randomness drawn before secret-key decoding, so an RNG throw can't leave partially-decoded key material live.
  • ML-DSA externalMu length-checks msg as 64-byte µ; ML-KEM detaches the caller's public key before caching; equalBytes validates its inputs; stricter checks and messages throughout.
  • Up to 2x speed boost for SLH-DSA
  • +16-42% speed boost for hybrid ml-kem-768+x25519
  • Upgrade noble deps to 2.3.0
  • Reduce on-disk unpacked size, 813kb → 654kb (-159kb): by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-post-quantum@2.2.0...2.3.0

Changelog

Sourced from @​noble/post-quantum's changelog.

0.7.1 (2026-08-27)

  • Added @noble/post-quantum/gwebcrypto.js, an async noble-style wrapper around the experimental built-in WebCrypto implementations of ML-KEM-512, ML-KEM-768, ML-KEM-1024, and ML-KEM-768 + X25519. It supports deterministic raw-seed key generation, public-key derivation, encapsulation, decapsulation, and a memoized isSupported() probe that performs a complete round trip instead of checking method presence alone.
  • Snapshot all options to ensure they're not mutated later
  • Snapshot msg in falcon*.attached.open()
  • Ensure falcon*.attached.open() throws correct error for malformed sig / pubkey
  • combineKEMS() and combineSigners() now expect valid byte arrays
  • Enforce digest lengths promised by pre-hash XOF OIDs: 32b for SHAKE128, 64b for SHAKE256
  • Improve zeroization
  • Improve Falcon signing and parsing: imported compact secret keys are rejected when the reconstructed sampler deviation is outside Falcon's proof interval
  • Harden WebCrypto input validation
  • Upgraded noble dependencies to 2.4.0

Special thanks to Leon Acosta (from QuantaKrypto audits).

0.7.0 (2026-08-09)

Breaking changes

  • Removed legacy hybrid aliases:
    • XWing and MLKEM768X25519 → ml_kem768_x25519.
    • MLKEM768P256 → ml_kem768_p256.
    • MLKEM1024P384 → ml_kem1024_p384.
    • QSFMLKEM768P256 → QSF_ml_kem768_p256.
    • QSFMLKEM1024P384 → QSF_ml_kem1024_p384.
    • KitchenSinkMLKEM768X25519 → KitchenSink_ml_kem768_x25519.
  • Stopped exporting afunction from utils; it moved to @noble/curves/utils.js.

Other changes

  • Fixed the length check in detached, non-default Falcon.
  • Fixed an intermediate overflow in MultiplyNTTs, where a1 * b1 * zeta could reach approximately 2³⁵.
  • Changed ML-DSA signing to draw entropy before decoding the secret key, so an RNG exception cannot leave partially decoded key material live.
  • Made ML-DSA externalMu require a 64-byte msg value.
  • Made ML-KEM detach the caller's public key before caching it.
  • Made equalBytes validate its inputs and tightened other checks and error messages.
  • Improved SLH-DSA performance by up to 2×.
  • Improved hybrid ML-KEM-768 and X25519 performance by 16–42%.
  • Upgraded noble dependencies to 2.3.0.
  • Reduced unpacked package size from 813 KB to 654 KB by disabling source maps.
Commits

Updates @types/node from 26.1.0 to 26.4.0

Commits

Updates vitest from 4.1.9 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

Updates @types/node from 26.1.0 to 26.4.0

Commits

Updates vitest from 4.1.9 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

Updates @types/node from 26.1.0 to 26.4.0

Commits

Updates vitest from 4.1.9 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

Updates @noble/curves from 2.2.0 to 2.4.0

Release notes

Sourced from @​noble/curves's releases.

2.4.0

  • Harden FROST distributed key generation against round-one transcript substitution.
    • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
  • FROST: Enforced RFC 9591 point validation for BLS and BN
  • POPRF: replace inversion with const-time version
  • Weierstrass: harden public-key boundaries & infinity handling
    • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
    • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
  • DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
  • Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

2.3.0

Security & constant-timeness

  • Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
  • General hardening across all modules
  • Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

  • George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
  • Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

  • ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
  • BLS signatures 2x
  • Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
  • Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
  • getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

  • Smaller bundles: improved tree-shaking across modules
  • Better error messages and type checks
  • Upgrade noble-hashes to 2.3.0, with performance boost
  • Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

  • Harden FROST distributed key generation against round-one transcript substitution.
    • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
  • FROST: Enforced RFC 9591 point validation for BLS and BN
  • POPRF: replace inversion with const-time version
  • Weierstrass: harden public-key boundaries & infinity handling
    • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
    • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
  • DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
  • Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

2.3.0 (2026-08-06)

Security and constant-timeness

  • Hardened constant-time execution from best-effort to actual guarantees, with no measurable timing behavior across 200,000 samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, unprecomputed points use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New constant-time benchmarks track timing behavior.
  • General hardening across all modules.
  • Applied fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery ID, non-canonical BLS signature encodings are rejected, Edwards-to-Montgomery conversion helpers were corrected, and FROST DKG round-two retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519 across many samples and learn up to 4.036 bits of a long-term private key. The other 247 bits were not affected.

The impact is primarily fingerprinting—a key can be recognized across deployments—not key recovery or a break of X25519. The maintainer was also unable to escalate the attack to co-residency (SMT).

Reported and found by:

  • George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr).
  • Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou Street, 18534 Piraeus, Greece (kpatsak@unipi.gr).

Performance

  • Improved ECDSA and EdDSA verification by up to 32%, Weierstrass ECDH by up to 19%, and X25519 getPublicKey by 2.7×.
  • Improved BLS signature performance by 2×.
  • Reduced initialization time for the first getPublicKey or sign call by approximately 2× for Ed25519, P-256, P-384, and P-521.
  • Also improved verification of recovered signatures, pairing tower, FFT, and Pippenger performance, as well as joint-MSM paths in FROST and OPRF.
  • getPublicKey and sign became slower because the window size was decreased from 8 to 6 and constant-time execution was hardened. Long-running applications that prefer 2.2.0-level speed can restore it with secp256k1.Point.BASE.precompute(8), and likewise for other curves.

Miscellaneous

  • Improved tree-shaking for smaller bundles.
  • Improved error messages and type checks.
  • Upgraded noble-hashes to 2.3.0 for improved performance.
  • Reduced on-disk size from 1,831 KB to 1,548 KB by disabling source maps, which have become less relevant.
Commits

Updates @types/node from 26.1.0 to 26.4.0

Commits

Updates vitest from 4.1.9 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
@dependabot
dependabot Bot requested a review from IceMasterT as a code owner August 14, 2026 22:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sdk/pq/main/npm-sdk-non-security-6b23741a81 branch from 3949f6c to 5a75a54 Compare September 2, 2026 18:34
@dependabot
chore(deps): bump the npm-sdk-non-security group across 2 directories…
1e35508 
… with 4 updates

Bumps the npm-sdk-non-security group with 3 updates in the /sdk/pq directory: [@noble/post-quantum](https://github.com/paulmillr/noble-post-quantum), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the npm-sdk-non-security group with 3 updates in the /sdk/threshold directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@noble/curves](https://github.com/paulmillr/noble-curves).


Updates `@noble/post-quantum` from 0.6.1 to 0.7.1
- [Release notes](https://github.com/paulmillr/noble-post-quantum/releases)
- [Changelog](https://github.com/paulmillr/noble-post-quantum/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-post-quantum@0.6.1...0.7.1)

Updates `@types/node` from 26.1.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `@types/node` from 26.1.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `@types/node` from 26.1.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `@noble/curves` from 2.2.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-curves/releases)
- [Changelog](https://github.com/paulmillr/noble-curves/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-curves@2.2.0...2.4.0)

Updates `@types/node` from 26.1.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@noble/curves"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: "@noble/post-quantum"
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-non-security
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-non-security
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-non-security
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-non-security
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-non-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sdk/pq/main/npm-sdk-non-security-6b23741a81 branch from 5a75a54 to 1e35508 Compare September 2, 2026 21:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@IceMasterT IceMasterT Awaiting requested review from IceMasterT IceMasterT is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants