chore(deps)(deps): bump @noble/ed25519 from 2.3.0 to 3.1.0

[dependabot]

Bumps @noble/ed25519 from 2.3.0 to 3.1.0.

Release notes

Sourced from @​noble/ed25519's releases.

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Minor code hardening in different places
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix sign() in Firefox WebExtension context. Closes gh-120
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

Full Changelog: paulmillr/noble-ed25519@3.0.1...3.1.0

3.0.1

• Fix a low-severity issue affecting verify
  • An attacker with an access to secret key was able to produce signatures, which were valid for all messages for their secret key
  • Impact: low, primarily systems which rely on non-repudiation
  • Special thanks to folks who've reported the issue: Yituo He (a.k.a. @​HaveYouTall) and @​sunyxedu
• Speed-up everything 1.5x using new modP with HAC 14.47, HAC 14.50.
  • Contributed by @​georg95 in paulmillr/noble-ed25519#117.
  • keygen x 10,594 ops/sec @ 94μs/op => 14,610 ops/sec @ 68μs/op
  • sign x 5,267 ops/sec @ 189μs/op => 7,225 ops/sec @ 138μs/op
  • verify x 1,203 ops/sec @ 830μs/op => 1,972 ops/sec @ 506μs/op

Full Changelog: paulmillr/noble-ed25519@3.0.0...3.0.1

3.0.0

v3 brings the package closer to noble-curves v2

• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen, keygenAsync method
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object:

// before
ed.etc.sha512Sync = (...m: Uint8Array[]) => sha512(ed.etc.concatBytes(...m));
ed.etc.sha512Async = (...m: Uint8Array[]) => Promise.resolve(sha512(ed.etc.concatBytes(...m)));
// after
ed.hashes.sha512 = sha512;
ed.hashes.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));

New Contributors

• @​steveluscher made their first contribution in paulmillr/noble-ed25519#110

... (truncated)

Commits

• f22a124 Release 3.1.0.
• 8680a16 Update benchmark
• 85fbbc4 Copy hashed input once more. Closes gh-120.
• f50580c Bump noble-hashes to 2.2
• 73b1b94 Implement changes as per Mar 2026 audit.
• 00c5ac0 Bump typescript to 6.0.2
• f65e1e3 Fix tests
• 262f882 Disable declmap
• e50cabd Add docs everywhere. Upgrade to ts 6.0-rc, jsbt 0.5. Add pkg.json scripts.
• 3106033 Release 3.0.1.
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/ed25519 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quittance	Ready	Preview, Comment	Jul 9, 2026 5:25pm