Update @scure/bip39 1.6.0 → 2.2.0 (major)

[depfu]

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​scure/bip39 (1.6.0 → 2.2.0) · Repo

Release Notes

2.2.0

• April 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• Fix compilation issues on TypeScript v6
• Improve tree-shaking, reduce bundle sizes
• Fix wordlists/traditional-chinese.js: it was exported incorrectly
• Wordlists: add PURE annotations to improve tree-shaking
• Wordlists: freeze the arrays to improve security

New Contributors

• @Yvem made their first contribution in #26
• @rikublock made their first contribution in #29

(We're skipping v2.1, to align with other noble / scure packages)

Full Changelog: 2.0.1...2.2.0

2.0.1

• .js extension must be used for all modules
  • Old: @scure/bip39/wordlists/english
  • New: @scure/bip39/wordlists/english.js
  • This simplifies working in browsers natively without transpilers
  • This was planned for 2.0.0, but was accidentally left out
• Improve typescript autocompletion for imported submodules
• Upgrade noble-hashes to 2.0.1
• Upgrade noble-curves to 2.0.1

Full Changelog: 2.0.0...2.0.1

2.0.0

• The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
  • Node v20.19 is now the minimum required version
  • Package imports now work correctly in bundler-less environments, such as browsers
  • Reduces npm package size (traffic consumed): 92KB => 78KB
  • Reduces unpacked npm size (on-disk space): 384KB => 201KB
• Make bundle sizes smaller, compared to v1.x
• Upgrade to noble v2
• Add mnemonicToSeedWebcrypto, which uses built-in / native / WebCrypto method - useful for React Native and similar slow environments

Full Changelog: 1.6.0...2.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 32 commits:

• Release 2.2.0.
• Changes related to April 2026 audit
• Improve wordlist tree-shaking
• Bump typescripts to 6.0.2
• Fix tests
• Bump devdeps.
• Upgrade to ts 6.0-rc, jsbt 0.5. Add code quality scripts to pkg.json.
• Add more docs everywhere
• readme
• Merge pull request #29 from rikublock/riku/fix-export-chinese
• fix: typo in package.json exports
• Merge pull request #26 from Yvem/patch-2
• doc(README): document the strength parameter
• ci: Update jsbt
• Release 2.0.1.
• Bump hashes to 2.0.1
• pkg.json: add back export maps for text editor autocompletion
• Release 2.0.0.
• Bump jsbt
• Fix node:24 tests
• Add test:node20. Merge devdeps: should, bmark into jsbt
• Remove comment heading from module.
• Release 2.0.0-beta.1.
• Bump deps
• pkg.json: use standard field order. Use standard gitignore. Adjust test code style for u8a.
• Bump deps
• Bump deps
• Add native wrapper: mnemonicToSeedWebcrypto.
• Add benchmark
• pkg.json: harden build:release script
• Remove old ci script
• ESM-only. Rewrite tests in ts. Update to noble-hashes v2 beta

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​scure/​bip39@​1.6.0 ⏵ 2.2.0	+1

View full report