chore(deps): bump @cosmjs/encoding from 0.37.0 to 0.39.0 in /packages/xchain-cosmos-sdk

[dependabot]

Bumps @cosmjs/encoding from 0.37.0 to 0.39.0.

Release notes

Sourced from @​cosmjs/encoding's releases.

0.39.0

Changed

• all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @​scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.
• @​cosmjs/crypto: Upgrade dependencies @​noble/ciphers, @​noble/curves, @​noble/hashes and @​scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)
• @​cosmjs/crypto: Use pure-JS implementation of Argon2id from @​noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)
• @​cosmjs/amino, @​cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.
• all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)
• @​cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)
• @​cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)
• @​cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.
• @​cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)
• @​cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Changelog

Sourced from @​cosmjs/encoding's changelog.

[0.39.0] - 2026-05-04

Changed

• all: Drop support for Node.js < 22. Node.js 20 reached end-of-life on 2025-04 and the crypto stack (@noble/*, @​scure/bip39 v2) relies on APIs that only ship in Node 22+. If you are still on an older Node, upgrade before taking this release.
• @​cosmjs/crypto: Upgrade dependencies @​noble/ciphers, @​noble/curves, @​noble/hashes and @​scure/bip39 to v2. These upgrades are otherwise transparent to users of the high-level @cosmjs/crypto API, but direct consumers of the underlying libraries should consult their respective migration notes. (#1935)
• @​cosmjs/crypto: Use pure-JS implementation of Argon2id from @​noble/hashes instead of the WASM-based hash-wasm implementation. This removes the hash-wasm runtime dependency and makes Argon2id.execute fully synchronous-capable without requiring a WASM instantiation. (#1938)
• @​cosmjs/amino, @​cosmjs/proto-signing: Remove scream test around argon2 call in wallet serialization/deserialization which is not needed anymore after #1938.
• all: Bring back the classic main/types fields in package.json alongside the exports field so tools like bundlephobia that do not understand exports can still resolve the package entry points. (#1944)
• @​cosmjs/stargate: Change Account.accountNumber from number to bigint. Cosmos SDK 0.53+ can assign account numbers via GenerateID() that exceed Number.MAX_SAFE_INTEGER (2^53 − 1), which would silently lose precision when represented as a JavaScript number. Using bigint preserves the full 64-bit range. Breaking change for anyone reading accountNumber off Account (e.g. from StargateClient.getAccount()): you will typically need to either coerce back with Number(account.accountNumber) where you know the value is safe, or keep using bigint end-to-end. (#1956)
• @​cosmjs/amino: makeSignDoc now accepts number | string | bigint for accountNumber (previously number | string) and encodes the value via Uint64 instead of Uint53 so large account numbers no longer overflow when building a sign doc. (#1956)
• @​cosmjs/crypto: Deprecate Argon2id/Argon2idOptions/isArgon2idOptions because it will likely be removed when wallet serialization/deserialization is removed.
• @​cosmjs/faucet: Upgrade koa to ^3.1.2 to address the host header injection advisory GHSA-7gcc-r8m5-44qm. Same-major bump, no API changes. (#1959)
• @​cosmjs/proto-signing: Upgrade protobufjs to ^7.5.5 to address the arbitrary code execution advisory GHSA-xq3m-2v4x-88gg. Same-major bump, no API changes. (#1959)

#1935: cosmos/cosmjs#1935 #1938: cosmos/cosmjs#1938 #1944: cosmos/cosmjs#1944 #1956: cosmos/cosmjs#1956 #1959: cosmos/cosmjs#1959

... (truncated)

Commits

• ec55c66 Set version: 0.39.0
• e39b5ff Convert account Number to bigint (#1956)
• 45156aa Merge pull request #1960 from codingki/rename-evmd-to-evmd051
• 6536a4b Mirror evmd051Enabled pattern for slow variant
• 20a429b Rename evmd scripts to versioned name (evmd051)
• 0fedbb2 Merge pull request #1959 from codingki/chore/security-audit-fixes
• 6cfedd5 chore(deps): Fix security vulnerabilities reported by yarn audit
• 2338a7e Merge pull request #1958 from cosmos/fix/yarn-node25-ebadf
• c21c737 [autofix.ci] apply automated fixes
• e664c60 fix(ci): Drop accidental .yarnrc.yml security relaxations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)