fix(deps): update dependency @noble/hashes to v2.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/hashes (source)	2.0.1 → 2.4.0

---

Release Notes

paulmillr/noble-hashes (@​noble/hashes)

v2.4.0

Compare Source

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

v2.3.0

Compare Source

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #​134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #​135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

v2.2.0

Compare Source

• March 2026 self-audit (all files): no major issues found.
  • Audited for specification compliance and security.
  • Fixed dkLen=0 handling in pbkdf2, blake2, turboshake, and kt.
  • Fixed parallelHash with blockLen=0.
  • Made the argon2 progress callback reach 100%.
  • Changed digestInto to return no value for better performance.
  • Added support for non-four-divisible dkLen values in argon2 and blake2.
• Fixed all byte-array types for compatibility with both TypeScript 5.6 and TypeScript 5.9+.
  • TypeScript 5.6 uses Uint8Array, while TypeScript 5.9+ made it generic as Uint8Array<ArrayBuffer>.
  • This previously caused incompatibilities and errors such as TS2345.
  • See TypeScript issue #​62240 for more context.
• Sped up SHA-3 by as much as 50%, contributed by @​ChALkeR in pull request #​126.
• Fixed compilation issues on TypeScript 6.
• Added big-endian support; all tests pass on s390x.
• Improved tree-shaking and reduced bundle sizes.
• Added extensive documentation throughout the package.
• Skipped version 2.1 to align with the other noble packages.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.