build(deps): bump @noble/curves from 1.8.1 to 2.0.1

[dependabot]

Bumps @noble/curves from 1.8.1 to 2.0.1.

Release notes

Sourced from @​noble/curves's releases.

2.0.1

• Disable extension-less imports. If you've used /ed25519, switch to /ed25519.js now. See 2.0.0 for more details.
• package.json: specify exported submodules to ensure typescript autocompletion
• package.json: bump hashes to 2.0.1 with scrypt & pkg.json changes
• ed25519: export map_to_curve_elligator2_curve25519 paulmillr/noble-curves#211
• bls: try-catch pairingBatch in bls12_381.verify() by @​MegaManSec in paulmillr/noble-curves#212
• fft: expose extra info in rootsOfUnity

New Contributors

• @​MegaManSec made their first contribution in paulmillr/noble-curves#212

GitHub Immutable Releases

This GH release does not include standalone noble-curves.js: use 2.0.0 for now, until we upgrade to newly added Immutable Releases

Full Changelog: paulmillr/noble-curves@2.0.0...2.0.1

2.0.0

High-level

v2 massively simplifies internals, improves security, reduces bundle size and lays path for the future. To simplify upgrading, upgrade first to curves 1.9.x. It would show deprecations in vscode-like text editor.

• The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
  • Node v20.19 is now the minimum required version
  • Package imports now work correctly in bundler-less environments, such as browsers
  • Reduces npm package size (traffic consumed): 354KB => 300KB
  • Reduces unpacked npm size (on-disk space): 2.1MB => 1.2MB
• Make bundle sizes smaller, compared to v1.x: -4KB for schnorr, -5.3KB for ristretto255, -9.4KB for x448
• .js extension must be used for all modules
  • Old: @noble/curves/ed25519
  • New: @noble/curves/ed25519.js
  • This simplifies working in browsers natively without transpilers

New features

• webcrypto: create friendly noble-like wrapper over built-in WebCrypto
• oprf: implement RFC 9497 OPRFs (oblivious pseudorandom functions)
  • We support p256, p384, p521, ristretto255 and decaf448
• weierstrass, edwards: add isValidSecretKey, isValidPublicKey
• misc: add Brainpool curves: brainpoolP256r1, brainpoolP384r1, brainpoolP512r1

Changes

• Most methods now expect Uint8Array, string hex inputs are prohibited
  • The change simplifies reasoning, improves security and reduces malleability
  • Point.fromHex now expects string-only hex inputs, use Point.fromBytes for Uint8Array
• Breaking changes of ECDSA (secp256k1, p256, p384...):
  • sign, verify: Switch to prehashed messages. Instead of messageHash, the methods now expect unhashed message. To bring back old behavior, use option {prehash: false}

... (truncated)

Commits

• 99d9774 Release 2.0.1.
• e4d7b5a Bump hashes to 2.0.1: scrypt & pkg.json changes
• d588039 Export map_to_curve_elligator2_curve25519. Closes gh-211.
• 48a97b7 Merge pull request #212 from MegaManSec/throw
• 270e5d6 pkg.json: add back export maps for text editor autocompletion
• 0cdef32 try-catch pairingBatch in bls12_381.verify()
• fc60edf fft: expose extra info in rootsOfUnity
• 83bf33b Release 2.0.0 to JSR.
• 24d3110 Release 2.0.0.
• 9e35456 Bump jsbt
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• build(

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Oct 08 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Patel-Raj11]

@dependabot rebase

[Patel-Raj11]

@dependabot rebase

[kuan121]

I assume this package has good test coverage, so passing tests should be a reliable indicator that the upgrade won’t break anything. Can you confirm?

[Patel-Raj11]

IMO there are tests for exported functions, so should be good.

[pdp2121]

This PR will need to be merged first before #3151 since these packages are relying on each other