Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit updates Electrum's internal CI (continuous integration) script that runs an automated security review using Anthropic's Claude Code tool. It changes the AI model version used for reviews from 'claude-opus-5' to 'claude-opus-5-5…
CI hardening: detects and reports AI model downgrades during automated security reviewNo changes to application code, cryptography, network protocol, or build artifactsNo privilege escalation, injection, or data-exfiltration vectors introduced by the diff
This commit updates Electrum's own CI security-review script. It adds detection and warnings when the automated code reviewer (Claude Code) silently falls back to a different AI model, for example after a content-policy refusal. It does no…
CI-only changeNo modification of wallet, crypto, networking, or build artifactsAdds detection for AI model fallback/downgrade in automated security review
This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptS…
Logic error in transaction completeness detectionNative SegWit witness handling edge casePSBT interoperability issue with Bitcoin Core
This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum …
Logic error in transaction completeness detectionPotential denial of service / user funds stuck due to refusal to broadcast valid finalized transactionInteroperability failure with Bitcoin Core and Sparrow PSBT output
This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…
Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their B…
Documentation-only changeExplicit design tradeoff disclosure: cosigners can derive each other's Nostr secret keys from shared xpubsNo functional code change
This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-rela…
This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct pad…
Stricter BOLT11 amount validation prevents acceptance of zero, negative, sub-millisatoshi, and leading-zero amountsFixed int_to_data5 padding bug that corrupted small timestamp values during invoice round-tripMalformed 'r' routing tags now raise exceptions instead of being silently skipped
Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silent…
Swallowed exception leading to use of attacker-controlled input valuePSBT input consistency check bypassedPotential malicious Electrum server influence on transaction signing
This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no …
This commit tightens how Electrum parses Bitcoin payment requests (BOLT11 lightning invoices and BIP21 URIs). It turns previously uncaught internal errors into proper validation failures, rejects malformed invoice fields that used to be si…
Stricter input validation for externally supplied BOLT11 invoices and BIP21 URIsPreviously uncaught exceptions (ValueError, UnicodeDecodeError, ecc errors) are now wrapped in domain-specific decode exceptionsMalformed fallback addresses are skipped rather than aborting or crashing
This commit tightens how Electrum parses BOLT11 Lightning invoices. It now rejects duplicate 'n' (node pubkey) tags instead of silently keeping only the first one, and it rejects invoice timestamps that are negative or too far in the futur…
Stricter validation of invoice timestamp boundsDuplicate 'n' tag now raises an exception instead of being silently droppedFollow-up to prior PR #10940, indicating a recent area of security-sensitive review
This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…
Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…
Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
This commit only adds new Bitcoin block header checkpoints to Electrum's built-in chain data files. Checkpoints are hardcoded reference points that help the wallet verify it is following the real blockchain and not a fake one. Updating the…
Hardcoded blockchain checkpoints extended for all supported networksNo executable code or cryptographic logic changedNo bug fix, privilege change, or input validation change present
This commit simply refreshes Electrum's built-in list of Bitcoin blockchain checkpoints. Checkpoints are known-good block hashes that help the wallet verify it is following the real chain. The update adds newer checkpoints for mainnet, sig…
This commit fixes cases where Electrum's wallet cache could hold onto outdated information about coins and transactions after blockchain reorganizations or mempool changes. For example, if a transaction was previously thought to be mined b…
stale cached state after reorg/mempool evictionincorrect confirmation metadata displayed to userscache invalidation added at multiple state transitions
This commit is a simple code cleanup: it replaces two repeated lines that set a transaction input's block height and position with a single helper method called set_mined_info. There is no change in behavior, no bug fix, and no security re…
This is a small internal code cleanup in the Electrum Bitcoin wallet. It moves the logic that builds a compact transaction identifier (like '123x4') into one shared helper method, and removes a duplicate helper class. There is no user-faci…
This commit changes how the Electrum AppImage build container first obtains trusted web certificates. Because the build's pinned Debian package sources use HTTPS, the container needs certificates before it can talk to them. The old method …
build pipeline changetemporary downgrade from HTTPS to HTTP for package bootstrappackage integrity still protected by apt GPG signatures
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedtest_lnwallet: add unittest for single channel mpp split configby f321x · 14f7fa0b · Jul 28, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · f321x
test_lnwallet: add unittest for single channel mpp split config
Tests that all parts of a multi-part payment over a single channel are constructed using the channel of the split configuration.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds a new automated test to the Electrum project. It does not change any production wallet or Lightning code. The test verifies that when Electrum splits a multi-part payment across a single channel, all payment parts actually use that chosen channel rather than letting the pathfinder pick a different cheaper route. It is purely a test-case addition.
tests: move ln graph definitions and prepare_invoice to lnhelpers.py
This makes them reusable from test files other than test_lnpeer and removes the deferred test_lnpeer import in prepare_chans_and_peers_in_graph.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100
This commit is purely a test-code refactoring: it moves Lightning Network test helpers (graph definitions and an invoice preparation function) from one test file to another shared helper file. There is no change to production code, no security fix, and no vulnerability introduced.
Lower-prioritylnwallet: use split config channel for single channel mppby f321x · bf1b4a1b · Jul 28, 2026 · 1 fileMessage 85 · StrongLow 30Details
Commit message · f321x
lnwallet: use split config channel for single channel mpp
Use the channel returned by the split config when sending a single channel mpp (multiple parts on a single channel), instead of allowing the pathfinding to use any channel. Otherwise it can happen that we have a good split config fitting a specific channel, but the pathfinding then tries to put both parts on another channel that cannot handle the sum of the parts, raising at _assert_can_add_htlc later on and failing the payment.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 30/100
This commit fixes a bug in Electrum's Lightning payment logic. When sending a payment split into multiple parts over a single channel, the app could previously ignore the intended channel and route all parts through a different channel that lacked enough capacity. That caused the payment to fail with an internal assertion error. The fix ensures the chosen channel from the split configuration is actually used.
Lower-prioritytests: check liquidity hints are updated for all htlcsby f321x · 2f82eca1 · Jul 27, 2026 · 2 filesMessage 60 · AdequateInformational 12Details
Commit message · f321x
tests: check liquidity hints are updated for all htlcs
60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 12/100
This commit only adds new automated tests for Electrum's Lightning payment routing code. It checks that internal 'liquidity hints' correctly track in-flight payment parts and are cleaned up after multipart payments succeed or time out. There are no changes to production wallet code, so users are not directly affected by this patch.
lnworker/lnrouter: update liquidity hints in htlc callbacks
Update the channel liquidity hints in the `htlc_fulfilled`/`htlc_failed` callbacks instead of the htlc log handler (`_process_htlc_log()`). `_process_htlc_log()` would raise `PaymentSuccess()` on the first fulfilled htlc, removing the inflight htlcs counted in `LiquidityHintMgr` only for this htlc's route. All other htlcs that arrive later would leak and not get removed anywhere, so the inflight htlc counter didn't get decreased and successful routes would be punished by the penalty.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 34/100
This commit fixes a bug in Electrum's Lightning payment routing. Previously, when a multi-part payment succeeded, only the first successful payment chunk properly updated the wallet's internal channel-liquidity bookkeeping. Later chunks were never cleaned up, so the wallet kept treating those routes as if they still had money in flight. Over time this could make the wallet wrongly avoid or penalize channels that had actually worked fine, degrading payment reliability. The fix moves the cleanup into the proper success/failure callbacks so every chunk is accounted for.
test_lnpeer: add unittest for mpp fee budget check
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100
This commit only adds a new automated test to Electrum's Lightning code. It checks that when a payment is split into multiple parts (MPP), the fee budget is correctly shared across all parts so total fees cannot exceed the budget. There is no change to production code, no bug fix, and no security patch in this commit itself.
The fee budget during local pathfinding route creation incorrectly compared the full payment amount against the full budget on every route instead of the partial amount against its fraction of the budget. This is a regression introduced by df5c8c4c9 and makes it possible for a payment to exceed the budget or a route to be incorrectly considered too expensive.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Moderate 63/100
This commit fixes a bug in Electrum's Lightning Network payment routing. When splitting a payment into multiple parts, the app was checking each partial route's fees against the entire payment's fee budget instead of that part's fair share. This could cause a payment to silently overspend on fees, or wrongly reject a valid route as too expensive. The fix makes each partial route responsible only for its proportional share of the fee budget.
Lower-priorityci: bump security review ci model to opus 5by Felix · 1334146d · Jul 27, 2026 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Felix
ci: bump security review ci model to opus 5
Bump the LLM used by the security review CI script from Claude Opus 4.8 to Claude Opus 5
77/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
AI analysis · Informational 15/100
This commit simply changes the version string of an AI model used by an internal continuous-integration (CI) security-review script. It does not modify Electrum wallet code, cryptography, networking, or any user-facing behavior. There is no indication this introduces or fixes a security vulnerability.
Lower-priorityqt: rename color themes (the user-visible names of the themes)by SomberNight · 1408d6d4 · Jul 23, 2026 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · SomberNight
qt: rename color themes (the user-visible names of the themes)
"Light" is actually the Platform-dependent system theme, where we let Qt define the palette and it leave it alone. Qt in turn mostly defers to the OS. On modern windows/macos/gnome/kde/etc, if the OS is set to "dark mode", Electrum will end up using a system-specific dark mode. Hence the name "Light" is confusing.
"Dark" is the qdarkstyle theme, which is largely platform-independent.
I think it's fine if these names are not completely "user-friendly".
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100
This commit simply renames two color theme labels shown in Electrum's settings window. 'Light' is renamed to 'System' and 'Dark' is renamed to 'qdarkstyle' to better describe what each option actually does. There are no code logic changes, no security fixes, and no behavior changes beyond the visible text.
Set the JsonDB modified after `maybe_load_incomplete_data` removed a corrupted patch. Otherwise we might not override the file on disk, append more patches and lose them all again on the next reload.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 47/100
This commit fixes a bug in Electrum's wallet storage recovery. If a wallet file was partially corrupted (a 'patch' was cut off mid-write), the app could recover the old data but then fail to mark the wallet as changed. As a result, later updates might be appended to the still-corrupted file instead of replacing it, and those updates could be lost the next time the wallet was opened. The fix marks the wallet as modified after recovery so it gets rewritten cleanly. This is a data-loss bug, not a remote attack.
> Because the characters '~' (%x7E) and '/' (%x2F) have special meanings in JSON Pointer, '~' needs to be encoded as '~0' and '/' needs to be encoded as '~1' when these characters appear in a reference token.
https://www.rfc-editor.org/info/rfc6901/
88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
AI analysis · Moderate 59/100
This commit fixes a bug in how Electrum builds JSON Patch pointers when wallet data contains special characters like '/' or '~' in keys. Before the fix, these characters were not escaped, which could cause patch operations to target the wrong location in the wallet database or fail. The fix follows RFC 6901 by escaping '~' as '~0' and '/' as '~1'. This is a data-integrity bug in wallet storage synchronization, but the commit itself does not describe it as a security vulnerability.
`Channel.onion_keys` had no registered converter for hex -> bytes, causing `pop_onion_key()` to return a hex str instead of bytes after the keys got loaded from db following a restart.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 44/100
This commit fixes a bug in Electrum's Lightning wallet database handling. After a wallet restart, a specific type of encryption key used in Lightning payments was being loaded as a text string instead of raw bytes. This mismatch could cause payment error decoding to fail or behave incorrectly, potentially leading to misleading error reports or degraded handling of failed Lightning transactions. The patch registers a proper converter so the keys are loaded as bytes, and adds a warning log when decoding fails.
Commit 2de11eac923d51befe44dcc748505714196a7f2c gated the ConfirmTxDialog amount behind `finalizer.valid`. When sweeping private keys from the sweep view the resulting `ConfirmTxDialog` is not valid in the beginning, and after it turns valid nothing causes it to update. This results in the amount being displayed as `0` even after it finished fetching the keys balances.
This is a small user-interface fix for the Electrum mobile/QML app. When sweeping private keys, the confirmation dialog that shows how much money will be moved initially displayed an amount of 0 because it did not refresh after the transaction became valid. The patch makes the dialog refresh its amount display when validity changes, so users see the correct amount before confirming. There is no security vulnerability here.
swaps: destroy swap transport on failed initialization
Call `swap_transport.destroy()` when the swap transport initialization task fails, otherwise the task will keep the swap transport tasks alive, leaking a swap transport for each failed connection attempt.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 26/100
This commit fixes a resource leak in Electrum's submarine-swap feature. When a connection to a swap server failed to start, the program was not properly cleaning up the connection object, so each failed attempt could leave behind leftover background tasks and memory. The patch now explicitly destroys the failed transport object before discarding it. This is a reliability bug rather than an active security vulnerability, though resource leaks can in some cases contribute to denial-of-service conditions.
lntransport: wrap connection errors in send_bytes_and_drain
LightningPeerConnectionClosed is handled in Peer.handle_disconnect.
``` 162.39 | E | lnpeer.Peer.[LNGossip, 02ab5336d0-d8be58cb] | Exception in main_loop: ConnectionResetError('Connection lost') Traceback (most recent call last): File "/home/user/wspace/electrum/electrum/util.py", line 1218, in wrapper return await func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/user/wspace/electrum/electrum/lnpeer.py", line 544, in wrapper_func return await func(self, *args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/user/wspace/electrum/electrum/lnpeer.py", line 558, in main_loop async with self.taskgroup as group: ^^^^^^^^^^^^^^ File "/home/user/wspace/aiorpcX/aiorpcx/curio.py", line 304, in __aexit__ await self.join() File "/home/user/wspace/electrum/electrum/util.py", line 1423, in join task.result() ~~~~~~~~~~~^^ File "/home/user/wspace/electrum/electrum/lnpeer.py", line 897, in _message_loop await self._process_message(msg) File "/home/user/wspace/electrum/electrum/lnpeer.py", line 277, in _process_message await f(*args) File "/home/user/wspace/electrum/electrum/lnpeer.py", line 389, in on_ping await self.transport.send_bytes_and_drain(raw_msg) File "/home/user/wspace/electrum/electrum/lntransport.py", line 238, in send_bytes_and_drain await self.writer.drain() File "/usr/lib/python3.13/asyncio/streams.py", line 386, in drain await self._protocol._drain_helper() File "/usr/lib/python3.13/asyncio/streams.py", line 166, in _drain_helper raise ConnectionResetError('Connection lost') ConnectionResetError: Connection lost ```
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 25/100
This commit fixes a minor error-handling bug in Electrum's Lightning network code. When the program tried to send data over a peer connection that had already dropped, a low-level 'Connection lost' error was escaping instead of being converted into the expected 'peer disconnected' exception. The patch wraps the connection error so the rest of the program handles the disconnect cleanly. There is no indication this is a security vulnerability or that it can be exploited by an attacker.
Lower-priorityandroid build: fix prev: chown fresh_clone base dir before git cloneby SomberNight · 7785865c · Jul 13, 2026 · 1 fileMessage 50 · ThinInformational 11Details
Commit message · SomberNight
android build: fix prev: chown fresh_clone base dir before git clone
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 11/100
This is a build script fix for Electrum's Android build process. It changes how a temporary directory is cleaned up before a fresh git clone. The change adds a `chown` command so the build user can remove files owned by root, preventing build failures. There is no indication this is a security vulnerability fix.
AI review queuedqml: emit a single dataChanged when updating blockchain heightby f321x · fbe9e2d8 · Jul 13, 2026 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · f321x
qml: emit a single dataChanged when updating blockchain height
emit a single dataChanged signal over the whole model index range once in `QETransactionListModel.updateBlockchainHeight()` instead of emitting a separate signal for each transaction.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This change is a performance cleanup in Electrum's mobile/QML user interface. When the wallet learns that the Bitcoin blockchain has grown taller, it now refreshes the transaction list with a single 'everything changed' signal instead of sending one signal per transaction. That reduces UI lag and log noise, but it does not fix a security vulnerability.
AI review queuedqml: don't compute notification balance delta for large tx batchesby f321x · 7b4759c5 · Jul 13, 2026 · 1 fileMessage 85 · StrongInformational 20Details
Commit message · f321x
qml: don't compute notification balance delta for large tx batches
Don't compute the wallet balance delta for the new tx notification shown after synchronizing the wallet if the notification batch exceeds 10 txs. Otherwise the calculation will block the UI, especially for large wallets with many new txs after initial sync.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100
This commit is a performance fix, not a security patch. It stops the Electrum mobile/QML wallet from calculating the total balance change when more than 20 new transactions arrive at once, because that calculation could freeze the user interface for several seconds. The change simply shows a generic message like '25 new transactions' instead of a detailed balance delta.
Change per-tx event callback logs to debug, might make the process a bit less clogged if there are many txs.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply changes two logging messages from 'info' level to 'debug' level in the mobile/QML wallet interface. It reduces routine log output when many transactions occur. There is no security-relevant change.
AI review queuedqml: don't force-build address model from tx event handlersby f321x · 35fc4a13 · Jul 13, 2026 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · f321x
qml: don't force-build address model from tx event handlers
The addressCoinModel property getter lazily constructs QEAddressCoinListModel, whose __init__ runs a full (slow) initModel(). Instead of initializing it on a new transaction, blocking the UI, just initialize it lazily when the user actually opens it. Same pattern as importAddresses/importPrivateKeys.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This is a performance and responsiveness fix for the Electrum mobile/QML wallet. It stops the app from doing heavy work (building the address coin list) every time a new transaction arrives, which was causing the user interface to freeze. Instead, the list is only built when the user actually opens it. There is no security vulnerability being fixed here.
During synchronization, new_transaction fires for every incoming tx and each balanceChanged emit makes QML recompute the balance on the GUI thread. The balance isn't shown anyway during sync.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This commit is a performance optimization for Electrum's mobile/QML user interface. It prevents the wallet balance from being recalculated and redrawn on every incoming transaction during synchronization, because the balance isn't shown during sync anyway. It is not a security fix and does not change how transactions are validated or stored.
Add a txid -> model row index dict to `QETransactionListModel` instead of re-iterating the `tx_history` list on each event to find the tx item. This noticeably unblocks the UI during sync of a large wallet.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100
This commit is a performance improvement for the Electrum mobile/QML wallet. It replaces repeated scanning of the transaction history list with a simple dictionary lookup (txid -> row index). There is no security-relevant change visible in the diff.
not sure why this was not an issue before(?) perhaps due to python version differences ``` $ ./contrib/make_download /home/user/wspace/electrum-web Traceback (most recent call last): File "/home/user/wspace/electrum/./contrib/make_download", line 17, in <module> version_spec = importlib.util.spec_from_file_location('version', 'electrum/version.py') ^^^^^^^^^^^^^^ AttributeError: module 'importlib' has no attribute 'util' ```
This is a trivial bug fix in a helper script used to build Electrum's download web page. The script was missing an import statement needed to access a Python utility module. Without the import, the script crashed immediately with an AttributeError. The change adds the missing import and has no security relevance.
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This commit tweaks the Android on-screen keyboard behavior in Electrum's QML wallet search screen. It sets the Enter key to 'Done' and hides the 'Create Wallet' button while the user is typing a search. There is no clear security problem here; it appears to be a minor user-interface fix to prevent accidental wallet creation while searching.
Lower-priorityrelease notes: bump 4.8.0 date for second attemptby SomberNight · 8c0adcda · Jul 8, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · SomberNight
release notes: bump 4.8.0 date for second attempt
We failed to get a full quorum to reproduce the prior git tag. The android apks were problematic to reproducibly build. should be fixed by https://github.com/spesmilo/electrum/pull/10739
here we go again
76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100
This commit only changes a release date in the RELEASE-NOTES file from July 2, 2026 to July 8, 2026. It is a documentation-only update explaining that the previous release attempt did not achieve full reproducible-build quorum, particularly for Android APKs. There are no code changes and no security fix or vulnerability introduced in this commit.
