build(deps): bump @scure/bip32 from 1.7.0 to 2.3.0

[dependabot]

Bumps @scure/bip32 from 1.7.0 to 2.3.0.

Release notes

Sourced from @​scure/bip32's releases.

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

2.2.0

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Upgrade dependencies to self-audited 2.2.0

(We're skipping v2.1, to align with other noble / scure packages)

Full Changelog: paulmillr/scure-bip32@2.0.1...2.2.0

2.0.1

• Upgrade noble-hashes to v2.0.1 and noble-curves to v2.0.1
• Upgrade noble-hashes to 2.0.1
• Upgrade noble-curves to 2.0.1

Full Changelog: paulmillr/scure-bip32@2.0.0...2.0.1

2.0.0

• The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
  • Node v20.19 is now the minimum required version
  • Package imports now work correctly in bundler-less environments, such as browsers
  • Reduces npm package size (traffic consumed): 15KB => 11.7KB
  • Reduces unpacked npm size (on-disk space): 67KB => 43KB
• Make bundle sizes smaller, compared to v1.x
• Upgrade to noble-hashes, noble-curves & scure-base v2
• Prohibit HD key depths over 255 to match spec
• Upgrade typescript compilation env to ts5.9 and es2022

Full Changelog: paulmillr/scure-bip32@1.7.0...2.0.0

Commits

• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• 1ff8a0b Release 2.2.0.
• f914026 Changes related to April 2026 audit
• 5f9d856 Bump typescripts to 6.0.2
• fd929d5 Bump devdeps.
• 89d756c Upgrade to ts 6.0-rc, jsbt 0.5. Add code quality scripts to pkg.json.
• 21c4bea Add lots of docs everywhere.
• 9a4cd14 readme
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scure/bip32 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Comp0te]

Holding @scure/bip32 at v1 deliberately (see //dependencyNotes in package.json, WALLET-1330). v2 is ESM-only and pulls @noble/curves@2/@noble/hashes@2, which would run a second copy of the curve and hash primitives alongside the @noble/curves ^1.9.7 that casper-js-sdk pins — a wrong-address risk with no upside. The failing build (22.x) check shows the first half of that already: src/libs/crypto/bip32.test.ts dies with SyntaxError: Cannot use import statement outside a module, 8 tests across 6 suites.

We will move @Scure to v2 in lockstep once the SDK/core drop @noble ^1.

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 2.x.x again, unless you re-open this PR.