chore(deps)(deps): bump @radiant-core/radiantjs from 1.9.6 to 2.0.6 in /relayer

[dependabot]

Bumps @radiant-core/radiantjs from 1.9.6 to 2.0.6.

Release notes

Sourced from @​radiant-core/radiantjs's releases.

v2.0.5 - Security: migrate ECDSA to @​noble/secp256k1

Security

Replaces the unmaintained elliptic dependency (GHSA-848j-6mx2-7j84: non-constant-time scalar multiplication, no upstream patch) with @noble/secp256k1 v3 for all ECDSA operations.

Public-key derivation, point arithmetic, ECDSA sign / verify, and signature-based public-key recovery now route through the audited noble implementation. elliptic is removed from dependencies; npm audit --omit=dev now reports 0 vulnerabilities, which also clears the trailing low-severity Dependabot alerts on downstream consumers like @radiant-core/mcp-server.

Signature parity — byte-identical output

This is a drop-in security fix: signing output is byte-identical to 2.0.4 under the same RFC 6979 deterministic inputs. Existing wallets, signed transactions, HD derivations, and Glyph protocol payloads remain compatible.

A new regression suite at https://github.com/Radiant-Core/radiantjs/blob/HEAD/test/regression/signature-vectors.js pins six (privkey, msgHash) → DER signature triples produced by the elliptic-backed predecessor as a permanent guard against future drift. All six pass byte-for-byte against the noble-backed code.

Public API

Unchanged. radiantjs.PrivateKey, .PublicKey, .Transaction#sign, .crypto.ECDSA, .crypto.Point, .crypto.Signature, and the sighash helpers retain their existing shape. Consumers should upgrade without code changes.

The single removed surface is radiantjs.deps.elliptic (the dependency is gone). Anyone inspecting that export to read elliptic's version should switch to reading @noble/secp256k1 directly.

Internal

• lib/crypto/point.js rewritten as a thin wrapper around @noble/secp256k1's Point, preserving the public surface (Point(x, y), Point.getG, Point.getN, Point.fromX, instance methods mul / add / mulAdd / eq / isInfinity / getX / getY / validate / toBuffer / toHex, plus pointToCompressed / pointFromCompressed).
• lib/crypto/ecdsa.js deliberately unchanged — the existing RFC 6979 deterministicK (including optional kEntropy for hedged-ECDSA) is the property that locks byte-identical output across the migration.
• Browser bundle (radiant.min.js) shrinks ~50 KB after the elliptic tree drops out.

Verification

• 3,508 mocha tests pass (no skips/regressions from 2.0.4); 6 new cross-implementation signature vectors all match byte-identical DER.
• npm audit --omit=dev → 0 vulnerabilities.
• Downstream smoke against @radiant-core/mcp-server: lint clean, 63 unit tests + 47 primitives tests pass, all 59 MCP tools and 10 resources register cleanly.

Follow-up

A separate issue will be filed on Radiant-Core/radiant-mcp-server to bump its @radiant-core/radiantjs dependency to ^2.0.5, which closes the two trailing low-severity Dependabot alerts there.

🤖 Generated with Claude Code

Changelog

Sourced from @​radiant-core/radiantjs's changelog.

2.0.6 — 2026-06-12

Fixed

• Removed the load-order dependency in the HD-key module-load invariants. lib/hdprivatekey.js and lib/hdpublickey.js ran three top-level assert(...) byte-layout sanity checks at module evaluation. Under some bundler emit orders — concretely, Rollup/Vite code-splitting radiantjs into a lazy chunk — the module-scope assert import is not yet initialized when those lines run, crashing every consumer of the chunk with TypeError: e is not a function (this white-screened Photonic Wallet's /predict build). The checks are now self-contained if (!cond) throw new Error(...) statements: the same invariants are enforced, with no dependency on import initialization order. No functional change — 3508 tests pass, HD derivation output is identical.

2.0.5 — 2026-05-29

Security

• Replaced elliptic with @noble/secp256k1 for all ECDSA operations. The legacy elliptic dependency carries the advisory GHSA-848j-6mx2-7j84 (non-constant-time scalar multiplication; private-key timing leak), with no patched release upstream. Public-key derivation, point arithmetic, ECDSA sign / verify, and signature-based public-key recovery now route through the audited @noble/secp256k1 v3 implementation. elliptic is removed from dependencies; npm audit --omit=dev reports 0 vulnerabilities.

  Signing output is byte-identical to the prior implementation under the same RFC 6979 deterministic inputs — verified by a new cross-implementation regression suite at test/regression/signature-vectors.js that pins six (privkey, msgHash) → DER signature triples produced by the elliptic-backed predecessor. Existing wallets, signed transactions, and HD derivations remain compatible.

Removed

• radiantjs.deps.elliptic is no longer exported (the dependency is gone). The corresponding radiant.d.ts type was also removed. Consumers inspecting elliptic's version through this surface must switch to reading @noble/secp256k1 directly.

Added

• test/regression/signature-vectors.js — permanent guard against ECDSA output drift.
• scripts/gen-signature-vectors.js — vector regeneration tool;

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.