Skip to content

chore(deps): bump the root-npm group across 1 directory with 8 updates - #38

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/root-npm-33ac22eabf
Open

chore(deps): bump the root-npm group across 1 directory with 8 updates#38
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/root-npm-33ac22eabf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the root-npm group with 8 updates in the / directory:

Package From To
@noble/curves 2.2.0 2.3.0
@noble/hashes 2.2.0 2.3.0
@scure/base 2.2.0 2.3.0
eslint 10.8.0 10.8.1
typescript-eslint 8.66.0 8.67.0
@testing-library/jest-dom 7.0.0 7.0.1
eslint-plugin-react-refresh 0.5.3 0.5.4
vite 8.2.0 8.2.1

Updates @noble/curves from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/curves's releases.

2.3.0

Security & constant-timeness

  • Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
  • General hardening across all modules
  • Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

  • George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
  • Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

  • ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
  • BLS signatures 2x
  • Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
  • Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
  • getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

  • Smaller bundles: improved tree-shaking across modules
  • Better error messages and type checks
  • Upgrade noble-hashes to 2.3.0, with performance boost
  • Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Commits

Updates @noble/hashes from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

  • +10-45% 32b inputs across all hashes
  • +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
  • 2.2x argon
  • +20% pbkdf2 and hkdf

Other changes:

  • Better error messages and stricter type checks everywhere
  • Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
  • blake2.compress renamed to _compress (marked internal).
  • Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Commits

Updates @scure/base from 2.2.0 to 2.3.0

Release notes

Sourced from @​scure/base's releases.

2.3.0

  • Massive speed-up of all algorithms. 1 MB speed:
    • base64 encode: 18x, 22mb/s => 395 mb/s
    • base32 encode: 23x, 16mb/s => 367 mb/s
    • base16 encode: 20x, 15mb/s => 294 mb/s
    • bech32 toWords: 8x, 38mb/s => 296 mb/s
    • base58 decode: 8x, 8mb/s => 67.2 mb/s
  • -3.4% reduce of minified bundle size.
  • Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
  • Better error messages and stricter type checks
  • Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Full Changelog: paulmillr/scure-base@2.2.0...2.3.0

Commits
  • 5b846f5 Release 2.3.0.
  • 27c9e1a Update jsbt
  • 5e98800 test: use new syntax
  • 655728b base58: limit decode to 64kb
  • ff17fbe Small fixes
  • e480812 Speed-up base58 15x. Speed-up bech32 2x. Remove utils, bytes, str, bytesToStr...
  • 3b06771 Massive speed-up. Up to: 15x base16, 14x base32, 14x base64, 6x bech32.toWords.
  • b009c91 Move benchmark directory
  • acab2cb Update jsbt
  • cc09895 Update jsbt. Improve error messages and type checks.
  • See full diff in compare view

Updates eslint from 10.8.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
  • 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
  • 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
  • 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
  • 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
  • eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
  • 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
  • f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
  • d086293 test: add error locations to no-undef (#21147) (JIYEON)
  • cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
  • 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
  • 7c1e175 test: add error locations to require-await (#21145) (Grit)
  • 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
  • 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
  • 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)
Commits

Updates typescript-eslint from 8.66.0 to 8.67.0

Release notes

Sourced from typescript-eslint's releases.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates @testing-library/jest-dom from 7.0.0 to 7.0.1

Release notes

Sourced from @​testing-library/jest-dom's releases.

v7.0.1

7.0.1 (2026-08-09)

Bug Fixes

  • declare vitest as an optional peer dependency (#733) (3782c78)
Commits

Updates eslint-plugin-react-refresh from 0.5.3 to 0.5.4

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.4

  • Add instant to allowExportNames in Next config #112
Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.4

  • Add instant to allowExportNames in Next config #112
Commits

Updates vite from 8.2.0 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
  • css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
  • deps: update all non-major dependencies (#23136) (14454fd)
  • deps: update rolldown-related dependencies (#23070) (7ac6f7f)
  • don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
  • handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
  • server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

Documentation

  • build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

  • deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
  • deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

  • bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
  • bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

Commits
  • 4216158 release: v8.2.1
  • fddf4ea fix(server): use a random port when port is 0 (#23158)
  • de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
  • 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
  • c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
  • ef02435 docs(build): fix incomplete @default for build.minify (#23177)
  • eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
  • 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
  • e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
  • 14454fd fix(deps): update all non-major dependencies (#23136)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the root-npm group across 1 directory with 8 updates
4f7877c 
Bumps the root-npm group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@noble/curves](https://github.com/paulmillr/noble-curves) | `2.2.0` | `2.3.0` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.2.0` | `2.3.0` |
| [@scure/base](https://github.com/paulmillr/scure-base) | `2.2.0` | `2.3.0` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` |
| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `7.0.0` | `7.0.1` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.1` |



Updates `@noble/curves` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/noble-curves/releases)
- [Commits](paulmillr/noble-curves@2.2.0...2.3.0)

Updates `@noble/hashes` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Commits](paulmillr/noble-hashes@2.2.0...2.3.0)

Updates `@scure/base` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/scure-base/releases)
- [Commits](paulmillr/scure-base@2.2.0...2.3.0)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `typescript-eslint` from 8.66.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint)

Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](testing-library/jest-dom@v7.0.0...v7.0.1)

Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.4)

Updates `vite` from 8.2.0 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: "@noble/curves"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: root-npm
- dependency-name: "@noble/hashes"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: root-npm
- dependency-name: "@scure/base"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: root-npm
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-npm
- dependency-name: typescript-eslint
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-npm
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 7.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-npm
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-npm
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 cumulusvpn-landing 4f7877c Commit Preview URL

Branch Preview URL		 Aug 14 2026, 03:08 PM

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 cumulusvpn 4f7877c Commit Preview URL

Branch Preview URL		 Aug 14 2026, 03:08 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants