Cake Wallet / Monero.com

This commit removes the CI/CD workflow path that handled Android build tests for pull requests coming from external forks. It only deletes a GitHub Actions job and does not change any application code, cryptography, wallet logic, or user-facing behavior. There is no direct security vulnerability in the diff itself.

This commit only edits a GitHub Actions workflow file used for testing pull requests. It renames comments, reformats YAML syntax, and changes the runner label from 'ubuntu-latest' to a custom label '[Linux, amd64, forlinux]'. There is no change to application code, wallet logic, cryptography, or user data handling.

This commit removes a single comment line in a GitHub Actions workflow file used to test Android builds for pull requests. It makes no functional change to the build process, app code, or security controls.

This commit changes a GitHub Actions workflow file. It adds triggers for pull requests and pull_request_target events, switches the runner label, and adds spacing. The pull_request_target trigger is notable because it can run workflows in the context of the base repository when a pull request comes from a fork, which can be risky if secrets or write permissions are exposed to untrusted code. However, this commit also adds a guard limiting that trigger to fork PRs and routes it through an 'external_contributors' environment, which suggests an attempt to isolate untrusted builds. There is no direct evidence in the diff of a vulnerability being introduced or fixed.

This commit only moves a 'use bash shell' setting from the top of a GitHub Actions workflow file into a specific job block. It does not change any app code, secrets, permissions, or security behavior. There is no security relevance visible in the diff.

This commit changes a GitHub Actions workflow so it runs on every code push instead of only on pull requests. There is no direct security vulnerability in the change itself. It is a CI/CD configuration tweak, likely for debugging build issues.

This commit is a routine GitHub Actions workflow tweak. It simplifies when the Android test build runs (only on pull_request events) and changes the runner label to a custom label. There is no user-facing app change, no wallet code change, and no security-relevant behavior visible in the diff.

This commit adds a temporary debugging step to an Android build workflow. It prints out details about the GitHub environment and pull request, such as repository name, fork status, and commit ID. This is a diagnostic change and does not appear to introduce a security vulnerability on its own, though it does expose some repository metadata in build logs.

This commit is a test change to a GitHub Actions workflow file. It tweaks how pull requests from internal branches versus external forks are detected and triggered, but it does not introduce any obvious security vulnerability. The change appears to be routine CI/CD maintenance with no clear malicious or risky intent.

This commit only reformats the YAML syntax that controls when an Android build test runs in GitHub. It changes one line into three lines with the exact same meaning: the workflow still triggers on both 'pull_request' and 'pull_request_target' events. There is no functional or security change.

This commit only adds a default shell setting ('bash') to a GitHub Actions workflow file used for building Android apps on pull requests. It does not change application code, handle secrets, alter permissions, or modify how user data is processed. There is no apparent security relevance.

This commit only changes a GitHub Actions workflow file. It simplifies how the workflow is triggered, switching from explicit event types to a shorthand syntax. There is no change to application code, no fix for a security flaw, and no indication of malicious intent in the diff itself.

This commit changes the Android CI workflow so that pull requests from outside contributors run using 'pull_request_target' and a dedicated 'external_contributors' environment. That combination is a well-known GitHub Actions anti-pattern: it can let a malicious pull request steal repository secrets or modify the repository, because the workflow runs in the context of the base repository with access to its secrets, while still processing code from the pull request. The change itself is small, but the security risk is real if the workflow later checks out or runs untrusted PR code.

This is a small user-interface fix for the desktop version of Cake Wallet. After switching wallets, the dropdown list of wallets is now refreshed so the displayed name stays correct. There is no indication this change addresses a security problem.

This is a routine version bump from 5.6.1 to 5.6.2 for the Cake Wallet/Monero.com apps. The release notes say it fixes QR scanning and includes UI enhancements and bug fixes. The code changes include a safer way to handle socket write errors, showing the 'scan secret' field only for Litecoin wallet restores, and a small Flutter widget-state fix. There is no clear security vulnerability being patched in the diff itself, and no external security advisory or researcher credit is provided.

This commit is a purely cosmetic redesign of the on-screen guide that explains how to connect a hardware wallet. It swaps text step labels for new SVG icons and updates the layout, colors, and scroll behavior of the help sheet. There is no security-relevant change.

This commit removes an extra counter advance in the hardware-wallet account discovery screen. Previously, after loading a batch of accounts from a hardware wallet, the app advanced its internal index twice, which could cause some accounts to be skipped when the user scrolled to load more. The fix makes account listing more complete and predictable, but it is a UI/logic bug rather than a direct security vulnerability.

This is a routine version bump to 5.6.1. The only functional change is that one third-party exchange integration, SwapsXyzExchangeProvider, has been commented out and is no longer offered to users. The rest of the patch only updates version and build numbers across Android, iOS, Linux, macOS, and Windows. There is no explicit security explanation in the commit, but removing an exchange provider could be a response to a trust, reliability, or security concern.

This update improves how Cake Wallet handles Litecoin's optional privacy feature (MWEB). It fixes a bug where the wallet might accidentally try to spend MWEB coins even when MWEB was turned off, which could cause failed or confusing transactions. It also makes the wallet more precise about detecting MWEB addresses and adds a link to a MWEB block explorer in transaction details. There is no clear evidence this is a security emergency, but it does fix a functional bug that could affect user funds or transaction reliability.

This commit contains only cosmetic and build-version housekeeping changes. It updates release notes wording, adjusts a button padding, updates an internal line-number reference in an exception ignore-list, and bumps build numbers across Android, iOS, Linux, and macOS. There is no visible security-relevant code change.

This commit makes two small changes to the Litecoin wallet code. First, it replaces a calculation that added up all transaction output amounts with a fixed value of 0, because the amount field is not shown to users anyway and the old code could crash when a transaction had no outputs. Second, it removes a leftover debug print statement. There is no clear security vulnerability here; it appears to be a bug-fix and cleanup change.

This commit simply changes the text of an error message shown when a user cancels QR code scanning. It does not alter security behavior, fix a vulnerability, or introduce any new risk.

This commit is a release-candidate version bump for Cake Wallet/Monero.com v5.6.0. The only functional code change is a guard added to the wallet-creation screen to stop the create button from being triggered multiple times if a user taps it rapidly. The rest of the diff updates release notes and build version numbers. The repeated-creation guard fixes a minor reliability/UX bug, but it is not a clear-cut security vulnerability on its own.

This commit fixes Litecoin wallet syncing and address-generation problems in Cake Wallet. It swaps the MWEB helper service from a Unix-domain socket to a TCP loopback socket, regenerates the matching protobuf bindings, and hardens Dart code so that missing or empty MWEB secrets no longer crash the app. It also filters out empty addresses when fetching balances and makes script-hash failures return an empty string instead of throwing. The changes are framed by the vendor as a bug fix, not a security fix.

This commit changes how Cake Wallet creates a unique, privacy-protecting identifier for a wallet. Previously, the identifier was based only on the wallet's secret seed phrase. Now, if no seed is available, it falls back to using the wallet's main public receiving address. The change is described as a simplification/refactor, but it alters the privacy assumptions of the identifier: a public address is less sensitive than a seed, but it is still wallet-specific information. There is no direct evidence this introduces a security vulnerability, but it changes what data feeds into the hash and could affect how wallets are grouped or recognized across backups/restores.