build(deps): Bump @noble/hashes from 2.2.0 to 2.4.0

[dependabot]

Bumps @noble/hashes from 2.2.0 to 2.4.0.

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

2.3.0 (2026-08-06)

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	kuda	09e2562	Sep 05 2026, 09:54 AM