Bump @noble/ed25519 from 2.3.0 to 3.1.0

[dependabot]

Bumps @noble/ed25519 from 2.3.0 to 3.1.0.

Release notes

Sourced from @​noble/ed25519's releases.

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Minor code hardening in different places
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix sign() in Firefox WebExtension context. Closes gh-120
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

Full Changelog: paulmillr/noble-ed25519@3.0.1...3.1.0

3.0.1

• Fix a low-severity issue affecting verify
  • An attacker with an access to secret key was able to produce signatures, which were valid for all messages for their secret key
  • Impact: low, primarily systems which rely on non-repudiation
  • Special thanks to folks who've reported the issue: Yituo He (a.k.a. @​HaveYouTall) and @​sunyxedu
• Speed-up everything 1.5x using new modP with HAC 14.47, HAC 14.50.
  • Contributed by @​georg95 in paulmillr/noble-ed25519#117.
  • keygen x 10,594 ops/sec @ 94μs/op => 14,610 ops/sec @ 68μs/op
  • sign x 5,267 ops/sec @ 189μs/op => 7,225 ops/sec @ 138μs/op
  • verify x 1,203 ops/sec @ 830μs/op => 1,972 ops/sec @ 506μs/op

Full Changelog: paulmillr/noble-ed25519@3.0.0...3.0.1

3.0.0

v3 brings the package closer to noble-curves v2

• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen, keygenAsync method
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object:

// before
ed.etc.sha512Sync = (...m: Uint8Array[]) => sha512(ed.etc.concatBytes(...m));
ed.etc.sha512Async = (...m: Uint8Array[]) => Promise.resolve(sha512(ed.etc.concatBytes(...m)));
// after
ed.hashes.sha512 = sha512;
ed.hashes.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));

New Contributors

• @​steveluscher made their first contribution in paulmillr/noble-ed25519#110

... (truncated)

Commits

• f22a124 Release 3.1.0.
• 8680a16 Update benchmark
• 85fbbc4 Copy hashed input once more. Closes gh-120.
• f50580c Bump noble-hashes to 2.2
• 73b1b94 Implement changes as per Mar 2026 audit.
• 00c5ac0 Bump typescript to 6.0.2
• f65e1e3 Fix tests
• 262f882 Disable declmap
• e50cabd Add docs everywhere. Upgrade to ts 6.0-rc, jsbt 0.5. Add pkg.json scripts.
• 3106033 Release 3.0.1.
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/ed25519 since your current version.

[systemslibrarian]

Not landed — @noble/ed25519 stays pinned at ^2.3.0.

This bump was re-tested on its own against current main (d2641a1) and it fails the first step of this repo's gate, npm run typecheck, which deploy.yml runs before anything else:

src/crypto/ed25519.ts(20,8):  error TS2339: Property 'sha512Sync' does not exist on type ...
src/crypto/ed25519.ts(28,30): error TS2339: Property 'randomPrivateKey' does not exist on type ...

v3 removes etc.sha512Sync and utils.randomPrivateKey. src/crypto/ed25519.ts uses both: the first to wire noble's sync signing API to a SHA-512 implementation, the second in generateKeypair(). v3 renames the latter to utils.randomSecretKey, so this is a real API migration and not a version-range quirk. It fails alone, with the @noble/hashes v2 bump held back, so it is not collateral from that PR.

Clearing it means rewriting src/, and the standing policy here is to pin a dependency back rather than edit demo source to suit it. That applies with extra weight in this file — it is the signing path of a signature demo, and it deliberately pins strict RFC 8032 verification (zip215: false). Rewiring it deserves a human who will re-check that property, not an automated bump.

The rest of this repo's Dependabot batch did land on main in d2641a1 — vitest 3.2.6 -> 4.1.10, @axe-core/playwright 4.12.1 -> 4.13.0, and dependabot/fetch-metadata v2 -> v3 — verified against the full local gate (typecheck; 132 unit tests; vite build; 11 Playwright a11y/behavior tests incl. axe WCAG A/AA at desktop and 380px). Closing rather than leaving it open: Dependabot will reopen this bump if it is still applicable.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.