deps: bump @noble/secp256k1 from 2.3.0 to 3.1.0

[dependabot]

Bumps @noble/secp256k1 from 2.3.0 to 3.1.0.

Release notes

Sourced from @​noble/secp256k1's releases.

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • General hardening was completed
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

New Contributors

• @​Zosoled made their first contribution in paulmillr/noble-secp256k1#140

Full Changelog: paulmillr/noble-secp256k1@3.0.0...3.1.0

3.0.0

v3 brings the package closer to noble-curves v2

• Add Schnorr signatures
• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen method
• sign, verify: Switch to prehashed messages. Instead of messageHash, the methods now expect unhashed message. To bring back old behavior, use option {prehash: false}
• sign, verify: Switch to Uint8Array signatures (format: 'compact') by default.
• verify: recovered format must be explicitly specified in {format: 'recovered'}. This reduces malleability
• verify: prohibit Signature-instance signature. User must now always do signature.toBytes()
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object. Also sha256 needs to be set now for prehash: true:

// before
// etc.hmacSha256Sync = (key, ...messages) => hmac(sha256, key, etc.concatBytes(...messages));
// etc.hmacSha256Async = (key, ...messages) => Promise.resolve(etc.hmacSha256Sync(key, ...messages));
// after
hashes.hmacSha256 = (key, msg) => hmac(sha256, key, msg);
hashes.sha256 = sha256;
hashes.hmacSha256Async = async (key, msg) => hmac(sha256, key, msg);
hashes.sha256Async = async (msg) => sha256(msg);

Full Changelog: paulmillr/noble-secp256k1@2.3.0...3.0.0

Commits

• f61f685 Release 3.1.0.
• 30841b9 Minor fixes
• 943f916 Implement changes as per Mar 2026 audit.
• f982d7d Bump typescript to 6.0.2
• 4639c0f Fix tests
• 7c74a5a Add docs everywhere. Upgrade to ts 6.0-rc, jsbt 0.5. Add pkg.json scripts.
• 18cf7c0 Merge pull request #141 from Zosoled/bugfix/p-documentation
• 0f3c1e9 Fix P documentation in .ts
• 3e1e0ce Merge pull request #140 from Zosoled/bugfix/p-documentation
• f7cb2dc Fix P documentation
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/secp256k1 since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[catomean]

Superseded by #85, which took @noble/secp256k1 to 3.1.0 on main — the exact version this PR proposes — and proved the signing path byte-identical before landing it. Nothing left to merge.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.