[metamask-ci]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/hashes (source)	^1.8.0 → ^2.4.0

---

Release Notes

paulmillr/noble-hashes (@​noble/hashes)

v2.4.0

Compare Source

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

v2.3.0

Compare Source

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #​134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #​135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

v2.2.0

Compare Source

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Fixed dkLen=0 handling in pbkdf2, blake2, turboshake, and kt.
  • Fixed parallelHash with blockLen=0.
  • Made the argon2 progress callback reach 100%.
  • Changed digestInto to return no value for better performance.
  • Added support for non-four-divisible dkLen values in argon2 and blake2.
• Fixed all byte-array types for compatibility with both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 uses Uint8Array, while TypeScript 5.9+ made it generic as Uint8Array<ArrayBuffer>.
  • This previously caused incompatibilities and errors such as TS2345.
  • See TypeScript issue #​62240 for more context.
• Sped up SHA-3 by as much as 50%, contributed by @​ChALkeR in pull request #​126.
• Fixed compilation issues on TypeScript 6.
• Added big-endian support; all tests pass on s390x.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the package.
• Skipped version 2.1 to align with the other noble packages.

v2.0.1

Compare Source

• Required the .js extension for all module imports.
  • Old: @noble/hashes/sha3.
  • New: @noble/hashes/sha3.js.
  • This simplifies native browser use without transpilers.
  • The change was planned for 2.0.0 but accidentally omitted.
• Declared exported submodules in package.json to support TypeScript autocompletion.
• Fixed the scrypt maxmem error message, contributed by @​ChALkeR in pull request #​121.
• Sped up scrypt by 4%, contributed by @​ChALkeR in pull request #​122.

v2.0.0

Compare Source

High-level changes

• Made the package ESM-only. ESM can be loaded from CommonJS on Node.js 20.19 and later.
  • Node.js 20.19 is now the minimum required version.
  • Package imports now work correctly in bundler-free environments such as browsers.
  • Reduced npm package download size from 152 KB to 136 KB.
  • Reduced unpacked on-disk size from 1.1 MB to 669 KB.
• Reduced bundle sizes compared with version 1.
• Required the .js extension for all module imports.
  • Old: @noble/hashes/sha3.
  • New: @noble/hashes/sha3.js.
  • This simplifies native browser use without transpilers.

API changes

• Restricted hash inputs to Uint8Array and prohibited string inputs.
  • Strict validation improves security.
  • Use utils.utf8ToBytes to reproduce the previous behavior.
• Renamed or removed modules for consistency.
  • sha256 and sha512 → sha2.js.
  • blake2b and blake2s → blake2.js.
  • ripemd160, sha1, and md5 → legacy.js.
  • _assert → utils.js.
  • Removed the internal crypto module in favor of built-in WebCrypto.
• Improved TypeScript types and option autocompletion.
• Upgraded the TypeScript compilation environment to TypeScript 5.9 and ES2022.
• Made error messages substantially more descriptive.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​noble/​hashes@​2.2.0 ⏵ 2.4.0

View full report

[metamask-ci]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a01c25. Configure here.}

[github-actions]

🛑 Files requiring codeowner review

To merge this PR, you'll need to get approvals from the following owner groups.
For files with multiple owners, approval from one owner is sufficient.

@MetaMask/accounts-engineers (2 files)

• packages/profile-sync-controller/CHANGELOG.md
• packages/profile-sync-controller/package.json

@MetaMask/core-platform (4 files)

• packages/key-tree/CHANGELOG.md
• packages/key-tree/package.json
• packages/utils/CHANGELOG.md
• packages/utils/package.json

@MetaMask/delegation or @MetaMask/earn (2 files)

• packages/money-account-upgrade-controller/CHANGELOG.md
• packages/money-account-upgrade-controller/package.json

@MetaMask/earn (2 files)

• packages/money-account-mfa-whitelist/CHANGELOG.md
• packages/money-account-mfa-whitelist/package.json

@MetaMask/product-safety (2 files)

• packages/phishing-controller/CHANGELOG.md
• packages/phishing-controller/package.json

@MetaMask/universal-kyc (1 file)

• packages/kyc-controller/package.json

@MetaMask/web3auth (4 files)

• packages/passkey-controller/CHANGELOG.md
• packages/passkey-controller/package.json
• packages/seedless-onboarding-controller/CHANGELOG.md
• packages/seedless-onboarding-controller/package.json

ℹ️ Files co-owned by @MetaMask/core-platform (expand for more)

[!NOTE]
For convenience in maintaining this repo, @MetaMask/core-platform co-owns
the following files. It is not required to seek approval from
@MetaMask/core-platform to change these files. This section is purely
informational.

• packages/kyc-controller/package.json
• packages/money-account-mfa-whitelist/CHANGELOG.md
• packages/money-account-mfa-whitelist/package.json
• packages/money-account-upgrade-controller/CHANGELOG.md
• packages/money-account-upgrade-controller/package.json
• packages/passkey-controller/CHANGELOG.md
• packages/passkey-controller/package.json
• packages/phishing-controller/CHANGELOG.md
• packages/phishing-controller/package.json
• packages/profile-sync-controller/CHANGELOG.md
• packages/profile-sync-controller/package.json
• packages/seedless-onboarding-controller/CHANGELOG.md
• packages/seedless-onboarding-controller/package.json