Bump @noble/hashes from 1.8.0 to 2.3.0

[dependabot]

Bumps @noble/hashes from 1.8.0 to 2.3.0.

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

2.2.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Fix: dkLen=0 handling in pbkdf2, blake2, turboshake, kt
  • Fix: parallelHash with blockLen=0
  • Fix: argon2 progress callback now reaches 100%
  • Improve: digestInto no longer returns a value (better performance)
  • Improve: argon2, blake2 support non-4-divisible dkLen
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• sha3: speed-up by up to 50%. Contributed by @​ChALkeR in paulmillr/noble-hashes#126
• Fix compilation issues on TypeScript v6
• Make package Big Endian friendly. All tests pass on s390x
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

(We're skipping v2.1, to align with other noble packages)

Full Changelog: paulmillr/noble-hashes@2.0.1...2.2.0

2.0.1

• .js extension must be used for all modules
  • Old: @noble/hashes/sha3
  • New: @noble/hashes/sha3.js
  • This simplifies working in browsers natively without transpilers
  • This was planned for 2.0.0, but was accidentally left out
• package.json: specify exported submodules to ensure typescript autocompletion
• scrypt: Fix error message for maxmem check by @​ChALkeR in paulmillr/noble-hashes#121
• scrypt: 4% speed-up by @​ChALkeR in paulmillr/noble-hashes#122

... (truncated)

Commits

• 8060cc8 Release 2.3.0.
• 16f8af9 Update workflow and benchmarks
• 734220f Update jsbt to 0.6.5
• fd3d3c3 Minor improvements
• 3654405 test: use new syntax
• e222e2d utils: minor fixes
• ef7ae52 Improve speed. Reduce bundle size. Reduce mem usage.
• 26b194a Rename npm action
• e89d6fa Bump jsbt to v0.6
• de8098a Move benchmarks top-level
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/hashes since your current version.

[systemslibrarian]

Not landed — @noble/hashes stays pinned at ^1.8.0.

This bump was re-tested on its own against current main (d2641a1) and it fails the first step of this repo's gate, npm run typecheck, which deploy.yml runs before anything else:

src/core/hash.ts(1,24): error TS2307: Cannot find module '@noble/hashes/sha256'
src/crypto/ed25519.ts(17,24): error TS2307: Cannot find module '@noble/hashes/sha512'

v2 drops the per-algorithm export subpaths ('./sha256', './sha512') that both of those modules import. It fails alone, with the @noble/ed25519 v3 bump held back, so it is not collateral from that PR — it is a genuine breaking change for this lab.

Clearing it means rewriting src/, and the standing policy here is to pin a dependency back rather than edit demo source to suit it. So this stays an open question for a human: it needs an intentional migration of the two import sites to v2's entry points, not an automated bump.

The rest of this repo's Dependabot batch did land on main in d2641a1 — vitest 3.2.6 -> 4.1.10, @axe-core/playwright 4.12.1 -> 4.13.0, and dependabot/fetch-metadata v2 -> v3 — verified against the full local gate (typecheck; 132 unit tests; vite build; 11 Playwright a11y/behavior tests incl. axe WCAG A/AA at desktop and 380px). Closing rather than leaving it open: Dependabot will reopen this bump if it is still applicable.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.