chore(deps): bump the production-dependencies group with 3 updates #11

dependabot · 2026-01-20T23:56:13Z

Bumps the production-dependencies group with 3 updates: @noble/ed25519, @noble/hashes and @stellar/stellar-sdk.

Updates @noble/ed25519 from 2.3.0 to 3.0.0

Release notes

Sourced from @noble/ed25519's releases.

3.0.0

v3 brings the package closer to noble-curves v2

Most methods now expect Uint8Array, string hex inputs are prohibited

Add keygen, keygenAsync method

Node v20.19 is now the minimum required version

Various small changes for types and Point class

etc: hashes are now set in hashes object:
// before
ed.etc.sha512Sync = (...m: Uint8Array[]) => sha512(ed.etc.concatBytes(...m));
ed.etc.sha512Async = (...m: Uint8Array[]) => Promise.resolve(sha512(ed.etc.concatBytes(...m)));
// after
ed.hashes.sha512 = sha512;
ed.hashes.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));
New Contributors

@steveluscher made their first contribution in paulmillr/noble-ed25519#110

Full Changelog: paulmillr/noble-ed25519@2.3.0...3.0.0

Commits

ce13b2c Release 3.0.0.
6427ea5 Bump jsbt
7749997 Merge devdeps: should, bmark into jsbt
db61b5d tsconfig: Remove baseUrl
f1fcc52 Release 3.0.0-beta.1.
592f36e Bump jsbt
ab322ca ci: make linting optional, bump jsbt.
88b7955 pkg.json: use standard field order. Use standard gitignore.
a1f7a05 Minor test shufflings
52aec55 Fix lint
Additional commits viewable in compare view

Updates @noble/hashes from 1.8.0 to 2.0.1

Release notes

Sourced from @noble/hashes's releases.

2.0.1

.js extension must be used for all modules

Old: @noble/hashes/sha3

New: @noble/hashes/sha3.js

This simplifies working in browsers natively without transpilers

This was planned for 2.0.0, but was accidentally left out

package.json: specify exported submodules to ensure typescript autocompletion

scrypt: Fix error message for maxmem check by @ChALkeR in paulmillr/noble-hashes#121

scrypt: 4% speed-up by @ChALkeR in paulmillr/noble-hashes#122

Full Changelog: paulmillr/noble-hashes@2.0.0...2.0.1

2.0.0

High-level

The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+

Node v20.19 is now the minimum required version

Package imports now work correctly in bundler-less environments, such as browsers

Reduces npm package size (traffic consumed): 152KB => 136KB

Reduces unpacked npm size (on-disk space): 1.1MB => 669KB

Make bundle sizes smaller, compared to v1.x

.js extension must be used for all modules

Old: @noble/hashes/sha3

New: @noble/hashes/sha3.js

This simplifies working in browsers natively without transpilers

Changes

Only allow Uint8Array as hash inputs, prohibit string

Strict validation checks improve security

To replicate previous behavior, use utils.utf8ToBytes

Rename / remove some modules for consistency. Previously, sha384 resided in sha512, which was weird

sha256, sha512 => sha2.js (consistent with sha3.js)

blake2b, blake2s => blake2.js (consistent with blake3.js, blake1.js)

ripemd160, sha1, md5 => legacy.js (all low-security hashes are there)

_assert => utils.js

crypto internal module got removed: use built-in WebCrypto instead

Improve typescript types & option autocomplete

Upgrade typescript compilation env to ts5.9 and es2022

Massively improve error messages, make them more descriptive

Full Changelog: paulmillr/noble-hashes@1.8.0...2.0.0

Commits

d30e070 Release 2.0.1.
4485505 anumber: fix error msg
dd62b81 pkg.json: add back export maps for text editor autocompletion
59fda2c Merge pull request #122 from ChALkeR/chalker/perf/scrypt/0
90dfe17 adjust comment
e6099ae add a comment
15ee761 perf: tiny improvement in scrypt
30f8780 Merge pull request #121 from ChALkeR/patch-2
f43e04b Fix error message for scrypt maxmem check
b048d14 Release 2.0.0 to JSR.
Additional commits viewable in compare view

Updates @stellar/stellar-sdk from 13.3.0 to 14.4.3

Release notes

Sourced from @stellar/stellar-sdk's releases.

v14.4.3

v14.4.3

Fixed

Upgraded underlying @stellar/stellar-base library to include its fixes (release notes).

v14.4.2

v14.4.2

Fixed

Fixed package installation for Windows environments (#1306)

Full Changelog: stellar/js-stellar-sdk@v14.4.1...v14.4.2

v14.4.1

v14.4.1

Fixed

Set Api.GetEventsRequest.endLedger to be optional to align with RPC behavior (#1304)

Added back Typepoint and marked it deprecated in favor of Timepoint (#1303)

Contributors

@mootz12 , @Ryang-21

Full Changelog: stellar/js-stellar-sdk@v14.4.0...v14.4.1

v14.4.0

v14.4.0

Added

Introduced an rpc.Server.getAssetBalance() helper to fetch asset balances both for contracts and accounts (#1286).

rpc.Api.BalanceResponse now can include a revocable field in its balanceEntry for when trustlines are fetched (#1286).

Added Timepoint and Duration support to Spec (#1288)

Api.GetHealthResponse interface now includes latestLedger, ledgerRetentionWindow, and oldestLedger fields (#1297).

Added publicKey, signTransaction, and signAuthEntry as optional fields to contract.MethodOptions (#1293).

Fixed

Api.RawEventResponse.topics is now optional to reflect topicless events (#1292).

parseRawEvents correctly checks if Api.RawEventResponse.topics is undefined (#1292).

Remove WebAssembly usage in favor of manual wasm parsing (#1300).

Fixed URL contamination in Horizon.Server methods (#1296).

Contributors

@chadoh, @corymsmith, @Shaptic, @Ryang-2, @mootz12 made their first contribution in stellar/js-stellar-sdk#1288

Full Changelog: stellar/js-stellar-sdk@v14.3.3...v14.4.0

v14.3.3

v14.3.3

Added

... (truncated)

Changelog

Sourced from @stellar/stellar-sdk's changelog.

v14.4.3

Fixed

Upgraded underlying @stellar/stellar-base library to include its fixes (release notes).

v14.4.2

Fixed

Fixed package installation for Windows environments (#1306)

v14.4.1

Fixed

Set Api.GetEventsRequest.endLedger to be optional to align with RPC behavior (#1304)

Added back Typepoint and marked it deprecated in favor of Timepoint (#1303)

v14.4.0

Added

Introduced an rpc.Server.getAssetBalance() helper to fetch asset balances both for contracts and accounts (#1286).

rpc.Api.BalanceResponse now can include a revocable field in its balanceEntry for when trustlines are fetched (#1286).

Added Timepoint and Duration support to Spec (#1288)

Api.GetHealthResponse interface now includes latestLedger, ledgerRetentionWindow, and oldestLedger fields (#1297).

Added publicKey, signTransaction, and signAuthEntry as optional fields to contract.MethodOptions (#1293).

Fixed

Api.RawEventResponse.topics is now optional to reflect topicless events (#1292).

parseRawEvents correctly checks if Api.RawEventResponse.topics is undefined (#1292).

Remove WebAssembly usage in favor of manual wasm parsing (#1300).

Fixed URL contamination in Horizon.Server methods (#1296).

v14.3.3

Added

Spec.nativeToScVal supports parsing Muxed Address(#1274),

v14.3.2

Added

AssembledTransaction.sign() throws an error if publicKey was not provided when instantiated (#1269).

v14.3.1

Added

Added optional server: rpc.Server field to ClientOption for HttpClient reuse. (#1234).

Fixed

Replaced global HttpClient with per-instance clients in horizon.Server and rpc.Server to prevent cross-instance header contamination (#1234).

... (truncated)

Commits

1a9a39e Release v14.4.3 (#1311)
4de8c70 release v14.4.2 (#1307)
fefcf84 remove postinstall script and run setup in prepare script (#1306)
be48c9e release v14.4.1 (#1305)
0291f34 Make GetEventsRequest.endLedger optional to align with RPC behavior (#1304)
d543018 deprecate typepoint type for timepoint (#1303)
a81ccfe Release v14.4.0 (#1302)
715144a Fix parseRawEvents crash when topic field is undefined (#1292)
0920562 fix(client#MethodOptions): add overrideable params (#1293)
571700d remove WebAssembly for wasm parsing in favor of manual parsing (#1300)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

dependabot · 2026-01-20T23:56:13Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Bumps the production-dependencies group with 3 updates: [@noble/ed25519](https://github.com/paulmillr/noble-ed25519), [@noble/hashes](https://github.com/paulmillr/noble-hashes) and [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk). Updates `@noble/ed25519` from 2.3.0 to 3.0.0 - [Release notes](https://github.com/paulmillr/noble-ed25519/releases) - [Commits](paulmillr/noble-ed25519@2.3.0...3.0.0) Updates `@noble/hashes` from 1.8.0 to 2.0.1 - [Release notes](https://github.com/paulmillr/noble-hashes/releases) - [Commits](paulmillr/noble-hashes@1.8.0...2.0.1) Updates `@stellar/stellar-sdk` from 13.3.0 to 14.4.3 - [Release notes](https://github.com/stellar/js-stellar-sdk/releases) - [Changelog](https://github.com/stellar/js-stellar-sdk/blob/master/CHANGELOG.md) - [Commits](stellar/js-stellar-sdk@v13.3.0...v14.4.3) --- updated-dependencies: - dependency-name: "@noble/ed25519" dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@noble/hashes" dependency-version: 2.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@stellar/stellar-sdk" dependency-version: 14.4.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

This was referenced Jan 20, 2026

Bump @noble/ed25519 from 2.3.0 to 3.0.0 #7

Closed

Bump @noble/hashes from 1.8.0 to 2.0.1 #8

Closed

Bump @stellar/stellar-sdk from 13.3.0 to 14.4.3 #9

Closed

dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-29046be7ea branch from e49c25e to 91845b6 Compare January 21, 2026 08:54

dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-29046be7ea branch from 91845b6 to 66bd62f Compare February 1, 2026 08:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the production-dependencies group with 3 updates #11

chore(deps): bump the production-dependencies group with 3 updates #11

Uh oh!

dependabot bot commented on behalf of github Jan 20, 2026 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Jan 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chore(deps): bump the production-dependencies group with 3 updates #11

Are you sure you want to change the base?

chore(deps): bump the production-dependencies group with 3 updates #11

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.0.0

v3 brings the package closer to noble-curves v2

New Contributors

2.0.1

2.0.0

High-level

Changes

v14.4.3

Fixed

v14.4.2

Fixed

v14.4.1

Fixed

Contributors

v14.4.0

Added

Fixed

Contributors

v14.3.3

Added

Fixed

Fixed

Fixed

Added

Fixed

Added

Added

Added

Fixed

Uh oh!

dependabot bot commented on behalf of github Jan 20, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 20, 2026 •

edited

Loading