Bump valibot, bip32, bitcoinjs-lib and ecpair

[dependabot]

Bumps valibot to 1.4.2 and updates ancestor dependencies valibot, bip32, bitcoinjs-lib and ecpair. These dependencies need to be updated together.

Updates valibot from 0.38.0 to 1.4.2

Release notes

Sourced from valibot's releases.

v1.4.2

Many thanks to @​Faze-up and @​chatman-media for contributing to this release.

• Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #1521)
• Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #1522)
• Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #1522)

v1.4.1

• Fix intersect schema to infer correct input and output types for non-tuple array options instead of never (pull request #1478)

v1.4.0

Many thanks to @​ksaurav24, @​heiwen, @​compulim, @​ysknsid25, @​alaycock-stripe, @​IlyaSemenov, @​wszgrcy, @​LMGO, @​yslpn, @​EltonLobo07 and @​Eronmmer for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add isoDateTimeSecond validation action to validate ISO date times with seconds (pull request #1418)
• Add toCamelCase, toKebabCase, toPascalCase and toSnakeCase transformation actions to convert strings between common naming conventions (pull request #1457)
• Change internal ReadonlyOutputKeys and OutputWithReadonly types of object schemas and WithReadonly type of record schemas to improve TypeScript type performance (pull request #1442)
• Change hot paths to reduce object allocations and improve runtime performance (pull request #1437)
• Change build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax (pull request #1455)
• Change internal _LruCache to use a TypeScript private method instead of a #private class field to avoid runtime helpers in the transpiled output (pull request #1455)
• Change internal _isValidObjectKey to use Object.prototype.hasOwnProperty.call instead of Object.hasOwn so the distributed output stays compatible with runtimes that lack the ES2022 Object.hasOwn builtin (pull request #1421)
• Change flatten method to accept readonly issue arrays (pull request #1269)
• Fix potential RangeError caused by spreading large issue arrays (pull request #1437)
• Fix creditCard validation action to reject Mastercard numbers with invalid lengths (pull request #1462)
• Fix intersect schema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #1463)

v1.4.0 (to-json-schema)

Many thanks to @​stefanprobst, @​sruenwg and @​cruzdanilo for contributing to this release.

• Add support for examples action
• Add support for integer when used with minValue and maxValue actions (pull request #1367)
• Change Valibot peer dependency to v1.2.0
• Fix conversion of exactOptional object properties (pull request #1220)
• Fix conversion of variant to use oneOf instead of anyOf (pull request #1193)

v1.3.1

• Change MAC48_REGEX, MAC64_REGEX and MAC_REGEX to drop the i flag for better JSON Schema compatibility (pull request #1430)
• Change hash action to use case-expanded character classes instead of the i flag (pull request #1430)

v1.3.0

Many thanks to @​EskiMojo14, @​yslpn, @​alexilyaev, @​idleberg, @​BerkliumBirb and @​frenzzy for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add guard transformation action to narrow types using type predicates (pull request #1204)
• Add parseBoolean transformation action to parse boolean values from strings and other types (pull request #1251)
• Add isrc validation action to validate ISRC codes (pull request #1373)
• Add cache method for caching schema output by input (pull request #1170)
• Add domain validation action to validate domain names (pull request #1284)

... (truncated)

Commits

• 0dc26ea Bump library version to 1.4.2
• 1bd01c3 fix: handle keys that collide with Object.prototype in flatten and merge (#1522)
• 752c636 docs: clarify string length semantics (#1505)
• a3beff9 fix: cache word-count segmenter for non-primitive locales (#1521)
• 1f9b183 Update FUNDING.yml in fabvor of Open Collective
• 2c63b2a Update logos of partners in README
• 09616b2 Add CodeRabbit as partner and remove Stainless
• 92bcf55 Add Cloudflare to privacy policy page
• 9bb6617 Add Cloudflare as a deploy target to our website (#1508)
• c05bf95 Bump to-json-schema version to 1.7.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for valibot since your current version.

Updates bip32 from 5.0.0-rc.0 to 5.0.1

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by jl.landabaso, a new releaser for bip32 since your current version.

Updates bitcoinjs-lib from 7.0.0-rc.0 to 7.0.1

Changelog

Sourced from bitcoinjs-lib's changelog.

7.0.1

added

• crypto: Restore ripemd160, sha1, and sha256 hash helpers (#2248)
• p2ms: Support up to 20 public keys for n-of-20 multisig (previously capped at 16). This is relevant for P2WSH-wrapped multisig where the P2SH script-size limit does not apply. (#2297)

fixed

• psbt: Remove unnecessary tapInternalKey check for signature validation of taproot inputs (#2270)
• Bump valibot dependency (#2308)

7.0.0

breaking

• Buffer → Uint8Array: All public APIs now use standard Uint8Array instead of Node.js Buffer. This affects all payment types, Transaction, Psbt, Block, and script modules. Buffer (a Uint8Array subclass) is still accepted as input, but return types are now Uint8Array. (#2161)
• Transaction values: number → bigint: Transaction.Output.value changed from number to bigint. Psbt output values, Psbt.getFee(), and witnessUtxo.value are all bigint now. Update your code: value: 10000 → value: BigInt(10000) or value: 10000n.
• typeforce → valibot: Runtime type validation switched from typeforce to valibot. All typeforce re-exports removed (Buffer256bit, Hash160bit, Hash256bit, Number, Array, Boolean, String, Buffer, Hex, UInt8, UInt32, BufferN, Null, oneOf, maybe, tuple, Function, Satoshi). Replaced by valibot schemas (Buffer256bitSchema, Hash160bitSchema, Hash256bitSchema, BufferSchema, HexSchema, UInt8Schema, UInt32Schema, SatoshiSchema, NBufferSchemaFactory).
• ESM support: Package is now dual CJS/ESM. Added "type": "module" and exports field in package.json. CJS files use .cjs extension. Internal import paths now require .js extension.
• Node.js ≥ 18 required: Minimum Node.js version bumped from 8 to 18.
• Dependency major bumps: bip174 2.x → 3.x, bs58check 3.x → 4.x, varuint-bitcoin 1.x → 2.x.

added

• uint8array-tools dependency for cross-platform Uint8Array utilities
• valibot dependency for runtime type validation
• toXOnly exported from psbt/bip371
• Taproot multisig with verified unspendable internalPubkey example
• Better error message when signing a transaction without outputs

changed

• Coverage tooling switched from nyc to c8
• TypeScript execution switched from ts-node to tsx
• Fix tx version read/write to use uint32 instead of int32

fixed

• Fix multisig taproot example's provable nonce calculation
• Various typo fixes

6.1.7

added

• skip ecc library verification via DANGER_DO_NOT_VERIFY_ECCLIB flag

6.1.6

fixed

• Fix sighash treatment when signing taproot script sign scripts using Psbt (#2104)
• Fix error for invalid scripts in toASM (#2097)
• Fix mutation of input to addOutput method on Psbt (#2091)

6.1.5

fixed

• Updated bip174 dependency to fix issue with unknownKeyVals. (#1979)

6.1.4

changed

... (truncated)

Commits

• dc7f067 7.0.1
• 3619e35 Bump valibot
• e4280e2 Merge pull request #2248 from landabaso/feat/restore-hash-helpers
• dc1dbc6 Merge branch 'master' into feat/restore-hash-helpers
• 99bb080 Merge pull request #2297 from landabaso/feat/p2ms-20-keys
• 48d1e53 feat(crypto): restore ripemd160, sha1 and sha256 hash helpers
• 16f1bac p2ms: support up to 20 keys
• 13aea8c Removed unnecessary check for tapInternalKey for signature validations of tap...
• c151d53 Merge pull request #2264 from bitcoinjs/bump-ver
• 18b1c22 7.0.0
• Additional commits viewable in compare view

Updates ecpair from 3.0.0 to 3.0.1

Commits

• 0550de7 Merge pull request #34 from bitcoinjs/chore-release-3.0.1
• 7ff1fcd 3.0.1
• f4aeb72 Merge pull request #31 from niteshbalusu11/migrate-to-latest-valibot
• f9e5b1e fix: Migrate valibot to latest version
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jl.landabaso, a new releaser for ecpair since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ecpair@​3.0.0 ⏵ 3.0.1
	bip32@​5.0.0-rc.0 ⏵ 5.0.1			+1
	bitcoinjs-lib@​7.0.0-rc.0 ⏵ 7.0.1	+1		+1

View full report