chore(deps): bump @scure/bip32 from 2.2.0 to 2.4.0

[dependabot]

Bumps @scure/bip32 from 2.2.0 to 2.4.0.

Release notes

Sourced from @​scure/bip32's releases.

2.4.0

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

Full Changelog: paulmillr/scure-bip32@2.3.0...2.4.0

2.3.0

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Full Changelog: paulmillr/scure-bip32@2.2.0...2.3.0

Changelog

Sourced from @​scure/bip32's changelog.

2.4.0 (2026-08-28)

Hardening:

• The privateKey, publicKey, chainCode, identifier, pubKeyHash now return copies instead of live buffers
• deriveChild no longer blindly try-catches. Use proper filtered-by-kind error handling. Retries will stop at last valid index instead of overflowing with error
• fromExtendedKey now rejects checksum-valid payloads that are not exactly 78 bytes
• Stricter HDKey constructor validation: depth must be an integer in 0..255 (throws RangeError), index and parentFingerprint must be valid uint32 values, and chainCode must be exactly 32 bytes
• derive(path) now rejects paths up front that would exceed the maximum serializable depth of 255
• Added toPrivateJSON() for explicit private (xpriv + xpub) export; toJSON() currently still includes xpriv for backwards compatibility (planned to become public-only in v3, so migrate to toPrivateJSON() for private round-trips)
• fromJSON now also accepts { xpub } to restore a public-only key
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.4.0.

2.3.0 (2026-08-08)

• Improve validation and error messages.
• Upgrade deps: noble-hashes, noble-curves and scure-base to 2.3.0.
• Reduce on-disk package size: 47.5kb → 35.7kb (-11.8kb), by disabling source maps (they became less relevant).
• Reduce npm package size: 13.3kb → 8.63kb (-4.68kb)

Commits

• ab00d7f Release 2.4.0.
• d76c8e7 Upgrade deps, add changelog
• 06aeff3 Bump jsbt
• facbdf2 Harden: use nullish check; and prohibit second internal arg in deriveChild
• ba6e898 Use getters to ensure outputs cannot be mutated
• 09a0a15 Bump devdeps
• 23a2339 Harden. Improve deriveChild logic: do not blindly try-catch.
• 7ee63a3 Release 2.3.0.
• 6a869f5 Upgrade deps
• 1d0a505 Improve validation and error messages
• See full diff in compare view