build(deps): bump @scure/bip32 from 2.0.1 to 2.4.0

[dependabot]

Bumps @scure/bip32 from 2.0.1 to 2.4.0.

Release notes

Sourced from @​scure/bip32's releases.

2.4.0

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

Full Changelog: paulmillr/scure-bip32@2.3.0...2.4.0

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

2.2.0

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Upgrade dependencies to self-audited 2.2.0

(We're skipping v2.1, to align with other noble / scure packages)

Full Changelog: paulmillr/scure-bip32@2.0.1...2.2.0

Changelog

Sourced from @​scure/bip32's changelog.

2.4.0 (2026-08-28)

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

2.3.0 (2026-08-08)

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

2.2.0 (2026-04-21)

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Upgrade dependencies to self-audited 2.2.0

(We're skipping v2.1, to align with other noble / scure packages)

Commits

• ab00d7f Release 2.4.0.
• d76c8e7 Upgrade deps, add changelog
• 06aeff3 Bump jsbt
• facbdf2 Harden: use nullish check; and prohibit second internal arg in deriveChild
• ba6e898 Use getters to ensure outputs cannot be mutated
• 09a0a15 Bump devdeps
• 23a2339 Harden. Improve deriveChild logic: do not blindly try-catch.
• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scure/bip32 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.