Bump the dev-dependencies group in /hofmann-typescript with 3 updates

[dependabot]

Bumps the dev-dependencies group in /hofmann-typescript with 3 updates: @noble/curves, @noble/hashes and @types/node.

Updates @noble/curves from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/curves's releases.

2.4.0

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Commits

• 656c436 Release 2.4.0.
• ca081f6 Add changelog
• 783fa9b Upgrade noble-hashes to 2.4.0
• 3becb84 readme
• bb52c57 readme
• 41f44d2 Restructure benchmarks. Update README
• 3587575 Bump vectors
• ae43344 Bump ci workflows
• 5c1aa39 Add fuzzing
• d5b95e4 test: add more hardening-related tests
• Additional commits viewable in compare view

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions