Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 4, 2025

This PR contains the following updates:

Package Change Age Confidence
@noble/hashes (source) ^1.8.0 -> ^2.0.0 age confidence

Release Notes

paulmillr/noble-hashes (@​noble/hashes)

v2.0.0

Compare Source

High-level
  • The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
    • Node v20.19 is now the minimum required version
    • Package imports now work correctly in bundler-less environments, such as browsers
    • Reduces npm package size (traffic consumed): 152KB => 136KB
    • Reduces unpacked npm size (on-disk space): 1.1MB => 669KB
  • Make bundle sizes smaller, compared to v1.x
  • .js extension must be used for all modules
    • Old: @noble/hashes/sha3
    • New: @noble/hashes/sha3.js
    • This simplifies working in browsers natively without transpilers
Changes
  • Only allow Uint8Array as hash inputs, prohibit string
    • Strict validation checks improve security
    • To replicate previous behavior, use utils.utf8ToBytes
  • Rename / remove some modules for consistency. Previously, sha384 resided in sha512, which was weird
    • sha256, sha512 => sha2.js (consistent with sha3.js)
    • blake2b, blake2s => blake2.js (consistent with blake3.js, blake1.js)
    • ripemd160, sha1, md5 => legacy.js (all low-security hashes are there)
    • _assert => utils.js
    • crypto internal module got removed: use built-in WebCrypto instead
  • Improve typescript types & option autocomplete
  • Upgrade typescript compilation env to ts5.9 and es2022
  • Massively improve error messages, make them more descriptive

Full Changelog: paulmillr/noble-hashes@1.8.0...2.0.0


Configuration

📅 Schedule: Branch creation - "before 4am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Sep 4, 2025
Copy link
Contributor

github-actions bot commented Sep 4, 2025

Extension builds preview

Name Link
Latest commit ce72e11
Latest job logs Run #17456826761
Chrome (997.56KB)Download
Firefox (997.58KB)Download
Safari (1.92MB)Download

Copy link
Member

@sidvishnoi sidvishnoi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test-e2e

Copy link
Member

@sidvishnoi sidvishnoi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will check why we don't get bundle size benefits from it yet. But this continues to work, so LGTM.

@sidvishnoi sidvishnoi changed the title fix(deps): update dependency @noble/hashes to v2 chore(deps): update dependency @noble/hashes to v2 Sep 4, 2025
@sidvishnoi sidvishnoi merged commit a6c37c7 into main Sep 4, 2025
15 of 17 checks passed
@sidvishnoi sidvishnoi deleted the renovate/noble-hashes-2.x branch September 4, 2025 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant