3.2.0

• verify: ensure recovery id is bound to msg/sig (only for recovered format)
• Added isCompressed to the options for recoverPublicKey() and recoverPublicKeyAsync()
• Made safe generic Point#multiply() execute the full 256-bit ladder regardless of the scalar's leading zero bits
• Made signAsync(), schnorr.sign(), and schnorr.signAsync() snapshot the message at invocation, preventing caller mutation
• Reduce code size by ~10%, rewrite some utils for this purpose

Full Changelog: 3.1.0...3.2.0

3.1.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • General hardening was completed
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

New Contributors

• @Zosoled made their first contribution in #140

Full Changelog: 3.0.0...3.1.0

3.0.0

v3 brings the package closer to noble-curves v2

• Add Schnorr signatures
• Most methods now expect Uint8Array, string hex inputs are prohibited
• Add keygen method
• sign, verify: Switch to prehashed messages. Instead of
  messageHash, the methods now expect unhashed message.
  To bring back old behavior, use option {prehash: false}
• sign, verify: Switch to Uint8Array signatures (format: 'compact') by default.
• verify: recovered format must be explicitly specified in {format: 'recovered'}.
  This reduces malleability
• verify: prohibit Signature-instance signature. User must now always do
  signature.toBytes()
• Node v20.19 is now the minimum required version
• Various small changes for types and Point class
• etc: hashes are now set in hashes object. Also sha256 needs to be set now for prehash: true:

// before
// etc.hmacSha256Sync = (key, ...messages) => hmac(sha256, key, etc.concatBytes(...messages));
// etc.hmacSha256Async = (key, ...messages) => Promise.resolve(etc.hmacSha256Sync(key, ...messages));
// after
hashes.hmacSha256 = (key, msg) => hmac(sha256, key, msg);
hashes.sha256 = sha256;
hashes.hmacSha256Async = async (key, msg) => hmac(sha256, key, msg);
hashes.sha256Async = async (msg) => sha256(msg);

Full Changelog: 2.3.0...3.0.0

2.3.0

• Preparation for v3: rewrite code
• Remove non-erasable typescript syntax. The .ts code can now be ran natively in node.js
• Point: do assertValidity before encoding
• Signature: Freeze on creation
• CI: attest standalone build files
• Fix for Palemoon browser, which doesn't allow argument-less new Uint8Array()
• Bump typescript target from ES2020 to ES2022

Full Changelog: 2.2.3...2.3.0

1.7.2

• Improve is-Uint8Array check. Previously it allowed invalid inputs. Thanks to @ChALkeR for report.

Full Changelog: 1.7.1...1.7.2

2.2.3

Revert requirement for crypto.subtle, introduced in 2.2.0 #123. This ensures synchronous environments work correctly without it.

Full Changelog: 2.2.2...2.2.3

2.2.2

• Improve documentation for public methods. This ensures efficient auto-generated docs on JSR.

Full Changelog: 2.2.1...2.2.2

2.2.1

Same as 2.2.0, but now publishing to JSR without slow-types option.

Full Changelog: 2.2.0...2.2.1

2.2.0

What's Changed

• Allow any size of opts.extraEntropy when signing
• Improve hex and bytes conversion
• Feature detect to avoid self.crypto if subtle isn't available by @gre in #123
• Improve types: use isolatedDeclarations option

New Contributors

• @gre made their first contribution in #123
• @ChALkeR made their first contribution in #129

Full Changelog: 2.1.0...2.2.0

2.1.0

This release comes one year after v2.0.0, following rare update schedule for easy auditability.

• Point.fromAffine: convert ZERO points properly
• au8: improve Uint8Array check to work in extension context
• Signature: add normalizeS method
• Signature: addRecoveryBit should return more precise type, SignatureWithRecovery
• randomPrivateKey: fetch 48 bytes from CSPRNG instead of 40, to reduce bias

New Contributors

• @thejoelw made their first contribution in #100
• @MicahZoltu made their first contribution in #102
• @legobeat made their first contribution in #108
• @Elli610 made their first contribution in #121

Full Changelog: 2.0.0...2.1.0