[dependabot]

Bumps @noble/secp256k1 from 2.3.0 to 3.2.0.

Release notes

Sourced from @​noble/secp256k1's releases.

3.2.0

• verify: ensure recovery id is bound to msg/sig (only for recovered format)
• Added isCompressed to the options for recoverPublicKey() and recoverPublicKeyAsync()
• Made safe generic Point#multiply() execute the full 256-bit ladder regardless of the scalar's leading zero bits
• Made signAsync(), schnorr.sign(), and schnorr.signAsync() snapshot the message at invocation, preventing caller mutation
• Reduce code size by ~10%, rewrite some utils for this purpose

Full Changelog: paulmillr/noble-secp256k1@3.1.0...3.2.0

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • General hardening was completed
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

New Contributors

• @​Zosoled made their first contribution in paulmillr/noble-secp256k1#140

Full Changelog: paulmillr/noble-secp256k1@3.0.0...3.1.0

3.0.0

v3 brings the package closer to noble-curves v2

• Add Schnorr signatures
• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen method
• sign, verify: Switch to prehashed messages. Instead of messageHash, the methods now expect unhashed message. To bring back old behavior, use option {prehash: false}
• sign, verify: Switch to Uint8Array signatures (format: 'compact') by default.
• verify: recovered format must be explicitly specified in {format: 'recovered'}. This reduces malleability
• verify: prohibit Signature-instance signature. User must now always do signature.toBytes()
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object. Also sha256 needs to be set now for prehash: true:

// before
// etc.hmacSha256Sync = (key, ...messages) => hmac(sha256, key, etc.concatBytes(...messages));
// etc.hmacSha256Async = (key, ...messages) => Promise.resolve(etc.hmacSha256Sync(key, ...messages));
// after
</tr></table> 

... (truncated)

Changelog

Sourced from @​noble/secp256k1's changelog.

3.2.0 (2026-08-30)

• verify: ensure recovery id is bound to msg/sig (only for recovered format)
• Added isCompressed to the options for recoverPublicKey() and recoverPublicKeyAsync()
• Made safe generic Point#multiply() execute the full 256-bit ladder regardless of the scalar's leading zero bits
• Made signAsync(), schnorr.sign(), and schnorr.signAsync() snapshot the message at invocation, preventing caller mutation
• Reduce code size by ~10%, rewrite some utils for this purpose

3.1.0 (2026-04-11)

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • General hardening was completed
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

New Contributors

• @​Zosoled made their first contribution in paulmillr/noble-secp256k1#140

3.0.0 (2025-08-25)

v3 brings the package closer to noble-curves v2

• Add Schnorr signatures
• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen method
• sign, verify: Switch to prehashed messages. Instead of messageHash, the methods now expect unhashed message. To bring back old behavior, use option {prehash: false}
• sign, verify: Switch to Uint8Array signatures (format: 'compact') by default.
• verify: recovered format must be explicitly specified in {format: 'recovered'}. This reduces malleability
• verify: prohibit Signature-instance signature. User must now always do signature.toBytes()
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object. Also sha256 needs to be set now for prehash: true:

// before
// etc.hmacSha256Sync = (key, ...messages) => hmac(sha256, key, etc.concatBytes(...messages));
// etc.hmacSha256Async = (key, ...messages) => Promise.resolve(etc.hmacSha256Sync(key, ...messages));
// after
</tr></table> 

... (truncated)

Commits

• 04c95fb Release 3.2.0.
• 58810d5 readme
• 9a797be Clarify benchmark
• a94be09 Bump devdeps. Switch property tests to jsbt
• e41d31b Snapshot better. Validate recovered id in verify.
• 39146c7 Add tests
• c431edb Reduce code size: 4.76 to 4.68kb
• b95d37f Reduce code size: 4.93 to 4.76kb
• ab560b1 Add better benchmark:size
• e87558a Add changelog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/secp256k1 since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Maintenance integration review: independently reviewed all six changed files and verified 133 historical evidence receipt hashes. The paired secp256k1 3.2.0/hashes 2.4.0 migration explicitly preserves Bitcoin double-SHA256 through prehash:false in all signing/verification entrypoints; native OpenSSL positive and extra-hash negative controls detect a matching sign/verify trap. All original assertions, budgets and workflow source are preserved. Exact candidate 3681683 Node24 run 38192256290 passed 49 units, 8 production smoke cases and all 43 browser cases. Historical local timing failures remain in evidence; a later original-budget 49-case local run passed. Normal integration is followed by separate main CI, Pages, artifact and actual public verification.