deps(deps): bump @noble/hashes from 1.8.0 to 2.2.0#741
Conversation
Bumps [@noble/hashes](https://github.com/paulmillr/noble-hashes) from 1.8.0 to 2.2.0. - [Release notes](https://github.com/paulmillr/noble-hashes/releases) - [Commits](paulmillr/noble-hashes@1.8.0...2.2.0) --- updated-dependencies: - dependency-name: "@noble/hashes" dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ab71aac1a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "dependencies": { | ||
| "@gridplus/chain-core": "workspace:*", | ||
| "@noble/hashes": "^1.8.0", | ||
| "@noble/hashes": "^2.2.0", |
There was a problem hiding this comment.
This upgrade introduces a breaking module-path change for @noble/hashes v2 while the code still imports v1-style paths (@noble/hashes/ripemd160 and @noble/hashes/sha256) in packages/chains/cosmos/src/chain.ts and packages/chains/xrp/src/chain.ts. With v2, those legacy subpaths are no longer compatible, so these packages can fail to build or load at runtime when address/hash code paths are executed unless the imports are migrated to the new .js subpath format.
Useful? React with 👍 / 👎.
|
|
||
| '@noble/hashes@2.2.0': | ||
| resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==} | ||
| engines: {node: '>= 20.19.0'} |
There was a problem hiding this comment.
The lockfile now records @noble/hashes@2.2.0 with engines: {node: '>= 20.19.0'}, but the affected packages still declare "engines": { "node": ">=20" }. That means users on Node 20.0–20.18 satisfy your package metadata yet can hit install/runtime incompatibilities after this bump, so the package engine declarations should be raised (or the dependency version constrained) to avoid a misleading compatibility contract.
Useful? React with 👍 / 👎.
Bumps @noble/hashes from 1.8.0 to 2.2.0.
Release notes
Sourced from @noble/hashes's releases.
... (truncated)
Commits
81983c2Release 2.2.0.8883d32Minor syntax fixese5fedbaRun prettier format on tests72e2083Changes related to March 2026 audit (new tests)fd9f580Changes related to March 2026 audit (typed arrays)9a216b5Changes related to March 2026 audit85e35d5Clarify sha3.cc8ea40Merge pull request #126 from ChALkeR/chalker/unroll/sha3/0/chi46c3129Bump typescript to 6.0.2ca90465Bump devdeps.Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@noble/hashessince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)