[dependabot]

Bumps @scure/base from 1.2.6 to 2.4.0.

Release notes

Sourced from @​scure/base's releases.

2.4.0

• Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
• Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
• bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
• bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
• base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected

Full Changelog: paulmillr/scure-base@2.3.0...2.4.0

2.3.0

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

Full Changelog: paulmillr/scure-base@2.2.0...2.3.0

2.2.0

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• utf8: make decoder strict, use isWellFormed (polyfilled in some envs)
• Add strict ascii decoder (char range 0..127)
• Bech32 examples in the docs by @​davay42 in paulmillr/scure-base#44
• Add overload to Bech32.decode to handle arbitrary string input by @​webmaster128 in paulmillr/scure-base#45
• perf: trust Uint8Array.fromBase64 to check non-whitespace chars by @​ChALkeR in paulmillr/scure-base#47

New Contributors

• @​davay42 made their first contribution in paulmillr/scure-base#44
• @​webmaster128 made their first contribution in paulmillr/scure-base#45
• @​ChALkeR made their first contribution in paulmillr/scure-base#47

(We're skipping v2.1, to align with other noble / scure packages)

Full Changelog: paulmillr/scure-base@2.0.0...2.2.0

2.0.0

... (truncated)

Changelog

Sourced from @​scure/base's changelog.

2.4.0 (2026-08-28)

• Added base36 coder (lowercase alphanumeric, multibase k payload as used by IPFS/IPNS addresses)
• Limit base58 and base36 to 2048 bytes due to quadratic complexity. Real-world inputs are less than that.
• bech32.decodeToBytes / bech32m.decodeToBytes now enforce the 90-char BIP-173 length limit by default (previously unbounded); pass limit: false or a number to override
• bech32/bech32m: encode rejects non-printable-ASCII prefixes, and decode rejects non-printable-ASCII input instead of letting case folding normalize non-ASCII characters into valid strings
• base32crockford.decode: non-ASCII input that only becomes valid via case folding is now rejected

2.3.0 (2026-08-08)

• Massive speed-up of all algorithms. 1 MB speed:
  • base64 encode: 18x, 22mb/s => 395 mb/s
  • base32 encode: 23x, 16mb/s => 367 mb/s
  • base16 encode: 20x, 15mb/s => 294 mb/s
  • bech32 toWords: 8x, 38mb/s => 296 mb/s
  • base58 decode: 8x, 8mb/s => 67.2 mb/s
• -3.4% reduce of minified bundle size.
• Reduce on-disk package size: 163kb → 136kb (-27.4kb), by disabling source maps (they became less relevant).
• Better error messages and stricter type checks
• Breaking: we've removed internal utils: utils, bytesToString / str, stringToBytes / bytes, and the SomeCoders type. Those were always internal. The coders (base16, base64, …) are unaffected.

2.2.0 (2026-04-21)

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• utf8: make decoder strict, use isWellFormed (polyfilled in some envs)
• Add strict ascii decoder (char range 0..127)
• Bech32 examples in the docs by @​davay42 in paulmillr/scure-base#44
• Add overload to Bech32.decode to handle arbitrary string input by @​webmaster128 in paulmillr/scure-base#45
• perf: trust Uint8Array.fromBase64 to check non-whitespace chars by @​ChALkeR in paulmillr/scure-base#47

New Contributors

• @​davay42 made their first contribution in paulmillr/scure-base#44
• @​webmaster128 made their first contribution in paulmillr/scure-base#45
• @​ChALkeR made their first contribution in paulmillr/scure-base#47

(We're skipping v2.1, to align with other noble / scure packages)

2.0.0 (2025-08-25)

• The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
  • Node v20.19 is now the minimum required version

... (truncated)

Commits

• d93da4f Release 2.4.0.
• ce220f1 Upgrade devdeps. Add changelog.
• 90de919 Harden: prohibit bech32/base_crockford non-printable; limit base58 to 4K
• c92f2d4 Bump devdeps
• 389e6bd Add base36 for ipfs; limit quadratic base encode length; add parity tests for...
• 5b846f5 Release 2.3.0.
• 27c9e1a Update jsbt
• 5e98800 test: use new syntax
• 655728b base58: limit decode to 64kb
• ff17fbe Small fixes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scure/base since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)