chore(deps): coordinated upgrade @scure/bip32 + @noble/* + @scure/base to 2.x

[Thorian1te]

Summary

Plan a monorepo-wide upgrade of @scure/bip32 from 1.7.x → 2.x (latest 2.3.0 as of this writing), together with the noble/scure v2 stack it requires.

Do not take single-package Dependabot majors (e.g. closed #1747 dash-only).

---

Why not Dependabot single-package PRs

#1747 proposed:

# packages/xchain-dash/package.json only
- "@scure/bip32": "^1.7.0",
+ "@scure/bip32": "^2.3.0",

Problems:

Issue	Detail
Scope	Dash only; ~13 packages still on ^1.7.0
Lockfile	No yarn.lock update → CI install/build fails
Major, not patch	bip32 2.x is ESM-only, pulls noble/scure v2
Resolution clash	Root pins "@scure/base": "1.1.5" (CosmJS 0.37 / Jest CJS); bip32 2.3 wants @scure/base@2.3
Duplicate majors	Mixing bip32 1.x and 2.x + base 1.x/2.x in one yarn tree is fragile

Same pattern as other closed Dependabot noise (coinselect dash-only, partial CosmJS bumps).

---

What bip32 2.x changes (upstream)

From scure-bip32 releases:

Version	Notes
2.0.0	ESM-only; min Node ≥ 20.19; noble-hashes/curves + scure-base v2; HD depth > 255 rejected (spec); smaller packages
2.0.1	noble-hashes/curves 2.0.1
2.2.0	Self-audit notes; TS 5.6 vs 5.9 Uint8Array typing fixes; TS 6 compile fixes; deps → 2.2.0
2.3.0	Better validation/errors; noble/scure → 2.3.0; smaller on-disk/npm size

bip32@2.3.0 dependencies:

• @scure/base@2.3.0
• @noble/curves@2.3.0
• @noble/hashes@2.3.0

bip32@1.7.0 (current) dependencies:

• @scure/base@~1.2.5 (tree may still be constrained by root resolution 1.1.5)
• @noble/curves@~1.9.0
• @noble/hashes@~1.8.0

---

Current monorepo state (master)

Packages declaring @scure/bip32 ^1.7.0

• xchain-bitcoin, xchain-bitcoincash, xchain-dash, xchain-doge, xchain-litecoin, xchain-zcash
• xchain-cosmos-sdk, xchain-cosmos, xchain-thorchain, xchain-mayachain, xchain-kujira
• xchain-radix, xchain-tron

Typical use: import { HDKey } from '@scure/bip32' (e.g. keystore seed → path derive).

Root constraints

• resolutions: "@scure/base": "1.1.5" — introduced for CosmJS 0.37 / moduleResolution: bundler / Jest CJS compatibility. This is the main blocker for a casual bip32 2.x bump.
• CI build-and-test uses Node 20.x; bip32 2 requires ≥ 20.19 (confirm runner image satisfies this).
• Release workflow already on Node 22.

Explicit exclusions (project policy)

From AGENTS.md / CLAUDE.md:

• xchain-monero: WIP; exclude from monorepo @scure / @noble 2.x alignment. Keep its own pins.
• xchain-kujira: deprecated; prefer not expanding surface; include in dep bump only if required for install consistency, no new features.

---

Implementation plan

Phase 0 — Spike / design

• Confirm Node 20.x in CI is ≥ 20.19 (or bump workflow pin).
• Decide Jest/ESM story: can packages that import @scure/bip32 load ESM-only bip32 under current Jest 30 / ts-jest setup?
• Decide fate of "@scure/base": "1.1.5" resolution:
  • Lift to 2.x and re-test CosmJS + all cosmos packages, or
  • Keep base 1.1.5 only where CosmJS needs it via a narrower override (if Yarn allows) without blocking bip32 2.
• Inventory all @noble/curves / @noble/hashes / @scure/base ranges in the monorepo (exclude monero from forced alignment).

Phase 1 — Coordinated dependency PR

• Bump @scure/bip32 to ^2.3.0 (or exact pin) on all consumers listed above (except monero).
• Align @noble/curves, @noble/hashes, @scure/base to 2.x where required for a single resolved tree.
• Update root resolutions accordingly; re-verify CosmJS imports and cosmos-sdk/thorchain/mayachain tests.
• Full yarn.lock update.
• Changesets (patch/minor as appropriate per package — likely patch if API usage of HDKey is unchanged).

Phase 2 — Verification

• Unit tests: keystore HD derivation for BTC/UTXO + cosmos chains (HDKey.fromMasterSeed / .derive).
• Build all packages + examples.
• Smoke: known test mnemonic address vectors still match for a couple chains (e.g. BTC + one cosmos).
• Confirm monero package.json / lock ranges unchanged.

Phase 3 — Cleanup

• Close any further Dependabot single-package bip32/noble 2.x PRs as superseded by this issue.
• Document Node engine floor in root or package engines if you adopt "Node ≥ 20.19" monorepo-wide.

---

Acceptance criteria

• Single major line of @scure/bip32 2.x (no 1.x left for non-monero packages).
• No conflicting @scure/base 1.x vs 2.x that breaks install or CosmJS.
• CI green (build + tests).
• Monero left independent.
• No dash-only or single-package major merges.

---

Out of scope

• Migrating UTXO selection off coinselect (see chore(utxo): finish migration off coinselect for BCH/LTC/DOGE/DASH #1746).
• Feature work on deprecated kujira.
• Forcing monero onto noble/scure 2.x.

References

• Closed Dependabot: chore(deps): bump @scure/bip32 from 1.7.0 to 2.3.0 in /packages/xchain-dash #1747
• Upstream: https://github.com/paulmillr/scure-bip32
• CosmJS / @scure/base 1.1.5 pin: monorepo cosmjs 0.37 work (chore(deps): bump CosmJS 0.37 + deprecate xchain-kujira #1734 area)