build(deps): bump the npm-minor-and-patch group with 2 updates

[dependabot]

Bumps the npm-minor-and-patch group with 2 updates: @noble/ciphers and @noble/curves.

Updates @noble/ciphers from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/ciphers's releases.

2.4.0

• ChaCha / Salsa: reject output buffers that partially overlap unread input
• PRG: using after clean now throws
• Webcrypto: snapshot keys and params
• FF1: sizing for very large domains

Full Changelog: paulmillr/noble-ciphers@2.3.0...2.4.0

Changelog

Sourced from @​noble/ciphers's changelog.

2.4.0 (2026-08-27)

• ChaCha / Salsa: reject output buffers that partially overlap unread input
• PRG: using after clean now throws
• Webcrypto: snapshot keys and params
• FF1: sizing for very large domains

Commits

• d9e8a6a Release 2.4.0.
• 457f440 Add changelog
• 15fdd4a Bump vectors
• 654f9cc README and benchmarks
• 7ce57c6 Bump ci workflows
• 6c0f6bd Add fuzzing
• 5053f90 Fix slow test
• 3557d07 Fix ff1 on bun
• 53466fa Format
• 5d97c84 FF1: do not use fp
• Additional commits viewable in compare view

Updates @noble/curves from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/curves's releases.

2.4.0

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Commits

• 656c436 Release 2.4.0.
• ca081f6 Add changelog
• 783fa9b Upgrade noble-hashes to 2.4.0
• 3becb84 readme
• bb52c57 readme
• 41f44d2 Restructure benchmarks. Update README
• 3587575 Bump vectors
• ae43344 Bump ci workflows
• 5c1aa39 Add fuzzing
• d5b95e4 test: add more hardening-related tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions