[dependabot]

Bumps @noble/ed25519 from 3.0.0 to 3.2.0.

Release notes

Sourced from @​noble/ed25519's releases.

3.2.0

• sign, signAsync: snapshot inputs to ensure they're not mutable
• verify, verifyAsync: reject null options
• Standardize utils with other noble packages
• Added an actionable error when WebCrypto randomness is unavailable, centralized configurable SHA-512 backend validation, and hardened the public etc.invert() helper to reject modulus one as well as zero and non-invertible values.
• Reduce code size by ~10%, rewrite some utils for this purpose

Full Changelog: paulmillr/noble-ed25519@3.1.0...3.2.0

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Minor code hardening in different places
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix sign() in Firefox WebExtension context. Closes gh-120
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

Full Changelog: paulmillr/noble-ed25519@3.0.1...3.1.0

3.0.1

• Fix a low-severity issue affecting verify
  • An attacker with an access to secret key was able to produce signatures, which were valid for all messages for their secret key
  • Impact: low, primarily systems which rely on non-repudiation
  • Special thanks to folks who've reported the issue: Yituo He (a.k.a. @​HaveYouTall) and @​sunyxedu
• Speed-up everything 1.5x using new modP with HAC 14.47, HAC 14.50.
  • Contributed by @​georg95 in paulmillr/noble-ed25519#117.
  • keygen x 10,594 ops/sec @ 94μs/op => 14,610 ops/sec @ 68μs/op
  • sign x 5,267 ops/sec @ 189μs/op => 7,225 ops/sec @ 138μs/op
  • verify x 1,203 ops/sec @ 830μs/op => 1,972 ops/sec @ 506μs/op

Full Changelog: paulmillr/noble-ed25519@3.0.0...3.0.1

Changelog

Sourced from @​noble/ed25519's changelog.

3.2.0 (2026-08-27)

• sign, signAsync: snapshot inputs to ensure they're not mutable
• verify, verifyAsync: reject null options
• Standardize utils with other noble packages
• Added an actionable error when WebCrypto randomness is unavailable, centralized configurable SHA-512 backend validation, and hardened the public etc.invert() helper to reject modulus one as well as zero and non-invertible values.
• Reduce code size by ~10%, rewrite some utils for this purpose

3.1.0 (2026-04-11)

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Applied minor hardening in several places.
• Fixed all byte-array types for compatibility with both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 uses Uint8Array, while TypeScript 5.9+ made it generic as Uint8Array<ArrayBuffer>.
  • This previously caused incompatibilities and errors such as TS2345.
  • See [TypeScript issue #62240](microsoft/TypeScript#62240) for more context.
• Fixed sign() in Firefox WebExtension contexts, closing issue #120.
• Fixed compilation issues on TypeScript 6.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the package.

3.0.1 (2026-03-17)

• Fixed a low-severity issue affecting verify.
  • An attacker with access to the secret key could produce signatures valid for all messages for that secret key.
  • Impact was low and primarily affected systems relying on non-repudiation.
  • Special thanks to Yituo He (@​HaveYouTall) and @​sunyxedu for reporting the issue.
• Sped up operations by roughly 1.5× using new modular arithmetic based on HAC 14.47 and HAC 14.50.
  • Contributed by @​georg95 in [pull request #117](paulmillr/noble-ed25519#117).
  • Key generation: 10,594 ops/sec at 94μs/op → 14,610 ops/sec at 68μs/op.
  • Signing: 5,267 ops/sec at 189μs/op → 7,225 ops/sec at 138μs/op.
  • Verification: 1,203 ops/sec at 830μs/op → 1,972 ops/sec at 506μs/op.

Commits

• f3790a0 Release 3.2.0.
• 02c1ec4 Update devdeps
• 2e6c8a5 Reuse wnaf ladder from secp
• c240b17 Update changelog
• 26fc856 Reduce code size by ~10%
• ac7cc55 Add changelog
• 6a3a6bf Add fuzzing
• 43e8563 Refactor package, bring closer to secp256k1 / curves
• 5bc4be5 Remove build artifacts
• 6535214 Upgrade devdeps, sync tests with noble-curves
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/ed25519 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.