The ranges ^1.3 resolve to @noble/curves 1.9 and @noble/hashes 1.8 for
everyone who installs this package, and those mark the calls used here
deprecated: the sha256/sha512/blake2b module paths, ProjectivePoint,
toRawBytes, px/py, Signature.fromCompact.
- hashes from @noble/hashes/sha2 and @noble/hashes/blake2
- secp256k1.Point with toBytes(true) for compression
- expand reads the affine x/y (toAffine) instead of the projective fields
- recover builds the signature with Signature.fromBytes(sig, 'compact') and
returns toBytes() (compressed, as toRawBytes() did). Its method form of
recoverPublicKey stays, with the reason on the line: the replacement is not
in @noble/curves 1.9's types, and 2.x, which types it, is ESM-only.
The minimum versions rise with this (package.json, next commit).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The header rule takes the current year as the end of the range, as upstream's
does; 581 sources still ended at 2025, which failed lint. Lint never ran to
completion here, so this went unseen.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
