# What changed in @noble/hashes

> 30 changes in @noble/hashes 2 from its official release notes, upgrade guides and advisories: 3 breaking, 4 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@noble/hashes/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @noble/hashes 2

### Breaking changes

- Fails until entropy is added. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- blake2.compress was renamed to _compress and marked internal. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- No longer returns a value, improving performance. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)

### Security

- Use rejection cleanup to wipe work state if scheduling is aborted. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Passed options are protected against mutation and pollution. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Rejects output sizes that caused the engine to crash. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Improves zeroization. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)

### Performance

- Argon2 is 20% faster. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Argon performance improves by 2.2x. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- 32-bit inputs are 10–45% faster across all hashes. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- kmac is 20% faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- 1 MB inputs are 50% faster for KT128, KT256, and TurboSHAKE. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- pbkdf2 and hkdf are 20% faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- SHA-3 and SHAKE are 40% faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- Runs up to 50% faster. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Improved tree-shaking reduces bundle sizes. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)

### Behavior and default changes

- Cost options are optional, with defaults t: 3, m: 1024 ** 2 KiB, p: 1, and dkLen: 32; calls using more memory must set maxmem explicitly, whose default limit is 1 GiB. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Yields through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress; accepts optional rejection cleanup. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Yields through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress; accepts optional rejection cleanup. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Corrects the default maxmem to work with N: 2 ** 20, r: 8, and p: 1. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- Error messages are improved and type checks are stricter throughout the library. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)

### Fixes and other changes

- Fixes tree merging for multi-terabyte streams. (2.4.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.4.0)
- HMAC _cloneInto now preserves canXOF. (2.3.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.3.0)
- The package is now Big Endian friendly, with tests passing on s390x. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Fixes handling of dkLen=0. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Fixes behavior when blockLen=0. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Fixes handling of dkLen=0. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Fixes handling of dkLen=0. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Fixes compilation issues on TypeScript v6. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)
- Byte Array types are fixed for compatibility with TypeScript 5.6 and TypeScript 5.9+. (2.2.0) — [release notes](https://github.com/paulmillr/noble-hashes/releases/tag/2.2.0)