Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit updates Electrum's internal CI (continuous integration) script that runs an automated security review using Anthropic's Claude Code tool. It changes the AI model version used for reviews from 'claude-opus-5' to 'claude-opus-5-5…
CI hardening: detects and reports AI model downgrades during automated security reviewNo changes to application code, cryptography, network protocol, or build artifactsNo privilege escalation, injection, or data-exfiltration vectors introduced by the diff
This commit updates Electrum's own CI security-review script. It adds detection and warnings when the automated code reviewer (Claude Code) silently falls back to a different AI model, for example after a content-policy refusal. It does no…
CI-only changeNo modification of wallet, crypto, networking, or build artifactsAdds detection for AI model fallback/downgrade in automated security review
This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptS…
Logic error in transaction completeness detectionNative SegWit witness handling edge casePSBT interoperability issue with Bitcoin Core
This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum …
Logic error in transaction completeness detectionPotential denial of service / user funds stuck due to refusal to broadcast valid finalized transactionInteroperability failure with Bitcoin Core and Sparrow PSBT output
This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…
Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their B…
Documentation-only changeExplicit design tradeoff disclosure: cosigners can derive each other's Nostr secret keys from shared xpubsNo functional code change
This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-rela…
This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct pad…
Stricter BOLT11 amount validation prevents acceptance of zero, negative, sub-millisatoshi, and leading-zero amountsFixed int_to_data5 padding bug that corrupted small timestamp values during invoice round-tripMalformed 'r' routing tags now raise exceptions instead of being silently skipped
Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silent…
Swallowed exception leading to use of attacker-controlled input valuePSBT input consistency check bypassedPotential malicious Electrum server influence on transaction signing
This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no …
This commit tightens how Electrum parses Bitcoin payment requests (BOLT11 lightning invoices and BIP21 URIs). It turns previously uncaught internal errors into proper validation failures, rejects malformed invoice fields that used to be si…
Stricter input validation for externally supplied BOLT11 invoices and BIP21 URIsPreviously uncaught exceptions (ValueError, UnicodeDecodeError, ecc errors) are now wrapped in domain-specific decode exceptionsMalformed fallback addresses are skipped rather than aborting or crashing
This commit tightens how Electrum parses BOLT11 Lightning invoices. It now rejects duplicate 'n' (node pubkey) tags instead of silently keeping only the first one, and it rejects invoice timestamps that are negative or too far in the futur…
Stricter validation of invoice timestamp boundsDuplicate 'n' tag now raises an exception instead of being silently droppedFollow-up to prior PR #10940, indicating a recent area of security-sensitive review
This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…
Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…
Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
This commit only adds new Bitcoin block header checkpoints to Electrum's built-in chain data files. Checkpoints are hardcoded reference points that help the wallet verify it is following the real blockchain and not a fake one. Updating the…
Hardcoded blockchain checkpoints extended for all supported networksNo executable code or cryptographic logic changedNo bug fix, privilege change, or input validation change present
This commit simply refreshes Electrum's built-in list of Bitcoin blockchain checkpoints. Checkpoints are known-good block hashes that help the wallet verify it is following the real chain. The update adds newer checkpoints for mainnet, sig…
This commit fixes cases where Electrum's wallet cache could hold onto outdated information about coins and transactions after blockchain reorganizations or mempool changes. For example, if a transaction was previously thought to be mined b…
stale cached state after reorg/mempool evictionincorrect confirmation metadata displayed to userscache invalidation added at multiple state transitions
This commit is a simple code cleanup: it replaces two repeated lines that set a transaction input's block height and position with a single helper method called set_mined_info. There is no change in behavior, no bug fix, and no security re…
This is a small internal code cleanup in the Electrum Bitcoin wallet. It moves the logic that builds a compact transaction identifier (like '123x4') into one shared helper method, and removes a duplicate helper class. There is no user-faci…
This commit changes how the Electrum AppImage build container first obtains trusted web certificates. Because the build's pinned Debian package sources use HTTPS, the container needs certificates before it can talk to them. The old method …
build pipeline changetemporary downgrade from HTTPS to HTTP for package bootstrappackage integrity still protected by apt GPG signatures
android build: cache p4a recipe downloads even for FRESH_CLONE builds
I propose we cache some downloads even for "fresh clone" builds (that have `ELECBUILD_COMMIT` env var set), with an opt-out reusing the existing `ELECBUILD_NOCACHE` env var. Currently `ELECBUILD_NOCACHE` only opts-out from the docker build cache, now I would reuse it for p4a recipe downloads.
`qt-everywhere-src-6.10.2.tar.xz` [0] is 1.3 GiB, and we download it twice per arch. (once for the qt6 recipe, once for the hostqt6 recipe) It seems to me, download.qt.io is heavily rate-limiting downloads from some IPs.
When doing a release, we build 3 archs, so we download Qt six times. With this patch, we would only download it twice. (note: I see no need to have separate caches per arch atm.)
Also, when doing multiple builds to debug reproducibility, with this patch, only the first attempt needs to download Qt (twice). Subsequent attempts hit the cache.
---
note: the git tag is part of the cache key out of cache-staleness paranoia. It is not the full commit though, as that would kill the reproducibility-debugging use case.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100
This change is a build-system optimization for Electrum's Android release builds. It caches large Qt source downloads between builds so they are not repeatedly downloaded from the internet. There is no security vulnerability here.
android build: patch hostpython3 to not install setuptools
Add a patch to the hostpython3 p4a recipe to prevent it from installing setuptools as part of the ensurepip invocation. Setuptools is later installed from a hash-pinned recipe.
---
NOTE(ghost43): this is a workaround for reproducible-build issues we ran into during the 4.8.0 release. see https://github.com/spesmilo/electrum/pull/10739#issuecomment-4904680121
Since the last p4a rebase, p4a is installing some python packages using "pip install --target". We noticed that hostpython had two different versions of setuptools installed at the same time (two dist-info folders in site-packages/). This is due to the `--target` option for `pip install`. We are calling it with `--upgrade` too, but even then apparently it does not remove old versions. Indeed, when testing locally in a venv it leaves all .dist-infos there hanging. According to https://github.com/pypa/pip/issues/13763#issuecomment-3783977222, `--target` is not suitable or intended for this usecase at all.
Current patch is only focused on setuptools, as a minimal workaround. Ultimately the same issue could arise with any other package. For example, still with ensurepip itself, we could be left with multiple versions of pip installed. Or anything we install via hostpython_prerequisites could have duplicate versions installed...
100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 18/100
This change adjusts how the Electrum Android app is built so that the build process installs only one specific, checked version of a helper library called setuptools, instead of accidentally ending up with two copies. Having two copies could make builds unpredictable from one run to the next. The patch itself is a build-hygiene fix aimed at reproducibility, not a direct fix for an active security flaw.
build: move default FRESH_CLONE location from /tmp to /var/tmp
Apparently many distros these days mount /tmp as RAM-disk. Even debian (starting with 13) does this now. The Android build needs to store dozens of gigs, so RAM is often not sufficiently large.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit simply changes the default temporary directory used during Electrum's build process from /tmp to /var/tmp. The reason is practical: many Linux distributions now put /tmp in memory (RAM disk), and the Android build needs to store tens of gigabytes, which can exceed available RAM. This is a build reliability change, not a security fix.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 29/100
This commit adds a search box to Electrum's mobile-style QML wallet list. It also changes how 'hidden' wallets (those whose filenames begin with a dot) are handled: previously they were blocked entirely, now they are allowed but kept out of the normal list. A user can load a hidden wallet only by typing its exact name into the search box. The change appears to be a deliberate feature, not a fix for an active security bug, but it slightly widens what wallet files the GUI will load.
android build: forbid buildozer to install unversioned deps of p4a
While p4a itself does not need ninja in our usage, to build Qt6, we need ninja. However instead of installing it from PyPI, I think debian main is much more trustworthy.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 20/100
This commit tightens the Android build process for the Electrum Bitcoin wallet. It stops an automated build tool (buildozer) from silently downloading unversioned Python helper packages, and instead installs the 'ninja' build tool from the more carefully reviewed Debian software repository. The change reduces the risk that a compromised or malicious helper package could sneak into the Android app build, but it is a hardening improvement rather than a fix for an active attack.
android build: build p4a recipes with --no-isolation
the core change is https://github.com/spesmilo/python-for-android/commit/8c0fcc9ef2e559918ca96ecde6e09fe521bb1427 the rest here just follow that
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 16/100
This commit updates the Android build system for the Electrum Bitcoin wallet. It changes which version of a build tool (python-for-android) is used and adjusts the exact pinned versions of helper Python packages used during the build. The changes are about making the build process more reproducible and compatible with newer packaging tools, not about fixing a vulnerability in the wallet app itself. There is no direct evidence in the commit that this fixes a security flaw.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 20/100
This commit only updates release notes and documentation to state that Electrum's Android app now requires Android 8.0 instead of Android 6.0. There are no code changes, no bug fixes, and no security patches in the diff.
AI review queuedhw_wallet: fix crash on exit if device unpairing failsby Sasha Zykov · b0ae14a5 · Jul 3, 2026 · 2 filesMessage 73 · AdequateLow 29Details
Commit message · Sasha Zykov
hw_wallet: fix crash on exit if device unpairing fails
On wallet close, the close_wallet hook unpaired the device before stopping the keystore TaskThread. Unpairing does device I/O and can raise, e.g. if the device was unplugged while the wallet was open:
Plugin error. plugin: trezor, hook: close_wallet Traceback (most recent call last): File "electrum/plugin.py", line 833, in run_hook r = f(*args) File "electrum/hw_wallet/plugin.py", line 89, in close_wallet self.device_manager().unpair_pairing_code(keystore.pairing_code()) File "electrum/plugin.py", line 1118, in unpair_pairing_code self._close_client(_id) File "electrum/plugin.py", line 1134, in _close_client client.close() ... File "electrum/plugins/trezor/clientbase.py", line 286, in close self.client.lock() ... trezorlib.transport.bridge.BridgeException: trezord: acquire/62/null failed with code 400: device not found
run_hook() swallows the exception, so the thread was never stopped. A still-running QThread (child of the wallet window) at interpreter shutdown then makes Qt abort the process:
QThread: Destroyed while thread '' is still running
Stop the thread before unpairing, and make DeviceMgr._close_client treat client.close() as best-effort, as closing a missing device is a normal condition during cleanup.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 29/100
This commit fixes a crash that could happen when closing an Electrum wallet that uses a hardware device (like a Trezor). If the device was unplugged before closing, the wallet's cleanup step could fail and leave a background Qt thread running. At shutdown, Qt would then forcefully abort the whole program. The fix stops the thread first and treats device-close failures as harmless during cleanup.
Lower-priorityqml: add myself to About pageby f321x · d24c91e8 · Jul 2, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · f321x
qml: add myself to About page
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply adds a person's name to the About page in Electrum's QML (mobile-style) user interface. It is a routine contributor-credit update with no security relevance.
This commit is a routine update to Electrum's language translation files (locale). It changes one line in one translation file. There is no indication of any security relevance.
util.make_aiohttp_session: wrap aiohttp-socks 0.11+ excs to ClientError
older versions of aiohttp-socks and python-socks used to raise - ProxyConnectionError(OSError) - ProxyTimeoutError(TimeoutError) - ProxyError(Exception)
now they raise: - ProxyConnectionError(Exception) - ProxyTimeoutError(Exception) - ProxyError(Exception)
In many call sites, we currently handle OSError and TimeoutError, usually by simply logging the error or showing it to the user. Another exceptions our call sites handle similarly is aiohttp.ClientError, which is the aiohttp base class for any client connection error.
A simple "fix" for us to restore the old behaviour is converting the new aiohttp_socks exception types to aiohttp.ClientError.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 37/100
This commit fixes a compatibility issue with newer versions of a proxy library used by Electrum. The newer library changed which error types it raises when proxy connections fail. Because Electrum's code was written to catch the old error types, unexpected proxy errors could slip through, potentially causing crashes or confusing error messages instead of being handled gracefully. The fix converts the new proxy errors into a standard network error type that Electrum already knows how to handle.
Lower-priorityqetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.by Sander van Grieken · 11155fdf · Jul 2, 2026 · 1 fileMessage 58 · ThinLow 36Details
Commit message · Sander van Grieken
qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.
fixes #10714
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
AI analysis · Low 36/100
This commit fixes a crash in Electrum's mobile/QML fee slider. When a user typed a fee rate that the input regex allowed but Python's Decimal parser rejected, the app would crash with an 'InvalidOperation' exception instead of gracefully falling back to zero. The fix catches that exception and treats the bad value as 0, preventing the app from freezing or closing unexpectedly.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply changes a version number string from 4.7.2 to 4.8.0 in a single file. It does not modify any security-related code, fix any bug, or change any behavior of the Electrum wallet software. There is no security issue here.
Lower-priorityadd release notes for version 4.8.0by f321x · 78e2fcc7 · Jul 2, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · f321x
add release notes for version 4.8.0
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only adds the written release notes for Electrum version 4.8.0. It is documentation: it lists what changed in the new version, including one security fix, but it does not change any program code. By itself, this commit does not introduce or fix a vulnerability in the software.
wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran
Sighash warnings/errors might in theory not be triggered for inputs owned by the wallet but which are beyond the gap limit. tx.add_info_from_wallet(wallet) side-effects the wallet state so that wallet.is_mine() learns derivation paths for beyond-gap-limit addresses.
In practice both GUIs currently call tx.add_info_from_wallet before check_sighash runs, so this was not exploitable.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
explicit security languagesigning or wallet path
AI analysis · Low 42/100
This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was that this safety check could be skipped for wallet addresses that were beyond the user's configured gap limit, because the wallet had not yet learned those addresses belonged to it. The fix makes the check self-contained by first asking the transaction to teach the wallet about any relevant addresses, using a copy so the original transaction is not changed. The commit message says the current graphical interfaces already performed this step, so the bug was not exploitable in practice through normal use.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply adds newer Bitcoin block checkpoints to Electrum's built-in chain data files. Checkpoints are pre-recorded block hashes that help the wallet verify it is following the correct blockchain. There is no code change and no indication of a security vulnerability.
cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 diff --git a/contrib/requirements/requirements-binaries.txt b/contrib/requirements/requirements-binaries.txt index b41089680..5771aef24 100644 --- a/contrib/requirements/requirements-binaries.txt +++ b/contrib/requirements/requirements-binaries.txt @@ -3,3 +3,12 @@ PyQt6 # we need at least cryptography>=2.1 for electrum.crypto, # and at least cryptography>=2.6 for dnspython[DNSSEC] cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +PyQt6==6.9.1 diff --git a/contrib/requirements/requirements-build-android.txt b/contrib/requirements/requirements-build-android.txt index e9d272837..4bf6cc1fc 100644 --- a/contrib/requirements/requirements-build-android.txt +++ b/contrib/requirements/requirements-build-android.txt @@ -20,3 +20,10 @@ toml # needed for the Qt/QML Android GUI: # TODO double-check this typing-extensions + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +sh==2.2.2 diff --git a/contrib/requirements/requirements-build-appimage.txt b/contrib/requirements/requirements-build-appimage.txt index ee8b4aa89..d79cd93b6 100644 --- a/contrib/requirements/requirements-build-appimage.txt +++ b/contrib/requirements/requirements-build-appimage.txt @@ -7,4 +7,11 @@ wheel # The pinned Cython must be installed before hidapi is built; # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 -Cython>=0.27 \ No newline at end of file +Cython>=0.27 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 diff --git a/contrib/requirements/requirements-build-base.txt b/contrib/requirements/requirements-build-base.txt index 5bfea96fe..6cc7d303c 100644 --- a/contrib/requirements/requirements-build-base.txt +++ b/contrib/requirements/requirements-build-base.txt @@ -28,3 +28,12 @@ flit_core>=3.4,<4 # aio-libs/frozenlist and aio-libs/propcache needs: # https://github.com/aio-libs/frozenlist/blob/c28f32d6816ca0fa56a5876e84831c46084bb85d/pyproject.toml#L6 expandvars + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 +setuptools-scm<9 + +expandvars==1.0.0 +poetry-core==2.1.3 diff --git a/contrib/requirements/requirements-build-mac.txt b/contrib/requirements/requirements-build-mac.txt index 5504223d3..583c91170 100644 --- a/contrib/requirements/requirements-build-mac.txt +++ b/contrib/requirements/requirements-build-mac.txt @@ -15,3 +15,12 @@ packaging>=22.0 # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 Cython>=0.27 + + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-build-wine.txt b/contrib/requirements/requirements-build-wine.txt index 80cccba33..647a90acb 100644 --- a/contrib/requirements/requirements-build-wine.txt +++ b/contrib/requirements/requirements-build-wine.txt @@ -9,3 +9,10 @@ altgraph pywin32-ctypes>=0.2.1 pyinstaller-hooks-contrib>=2025.2 packaging>=22.0 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-hw.txt b/contrib/requirements/requirements-hw.txt index 5dfb0290e..3c4955eb6 100644 --- a/contrib/requirements/requirements-hw.txt +++ b/contrib/requirements/requirements-hw.txt @@ -30,3 +30,13 @@ pyserial>=3.5.0,<4.0.0 # prefer older urllib3 to avoid needing hatchling # (pulled in via trezor -> requests -> urllib3) urllib3<2 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +libusb1<3.4 +protobuf==3.20.3 diff --git a/contrib/requirements/requirements.txt b/contrib/requirements/requirements.txt index e9963c12c..da9ab8cde 100644 --- a/contrib/requirements/requirements.txt +++ b/contrib/requirements/requirements.txt @@ -18,3 +18,15 @@ attrs>=20.1.0,<23 # - upper limit to avoid needing hatchling at build-time :/ # (however newer versions should work at runtime) dnspython>=2.2,<2.5 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +aiohappyeyeballs<2.7 +jsonpatch==1.33 +jsonpointer==3.0.0 +propcache==0.3.1 +protobuf==3.20.3 +python-socks==2.8.1 ```
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Low 36/100
This commit updates Electrum's frozen dependency lists to newer versions of many Python packages used to build and run the wallet. The author describes it as 'somewhat conservative and paranoid.' It is a routine dependency refresh, not a code fix for a known vulnerability. Updating pinned dependencies can improve security by moving to newer, patched versions, but the commit itself does not describe any specific security issue, and a large dependency bump always carries some risk of introducing new bugs or build problems.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 47/100
This commit updates the version of OpenSSL used when building the Electrum Android app from 3.0.18 to 3.0.21, along with the matching cryptographic fingerprint (SHA-512 hash). OpenSSL is a widely used library that provides encrypted connections. Newer patch releases typically fix security bugs in the older version, so this is likely a routine dependency update to address known vulnerabilities in OpenSSL 3.0.18. However, the commit message does not say which specific bugs are being fixed, and no separate security advisory was supplied.
note: 3.12 is in security-only status, so can't bump win/mac binaries without switching to 3.13 (as we don't compile our own cpython for those) we should bump those to at least 3.13...
85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
AI analysis · Informational 19/100
This commit updates the Python versions used to build Electrum's Android, Linux AppImage, and host Python components. It moves Android and host Python from 3.11.14 to 3.11.15, and the Linux AppImage from 3.12.11 to 3.12.13. It also switches Android builds to download Python from the official python.org source instead of GitHub auto-generated archives. The commit message notes that Python 3.12 is now in 'security-only' status and Windows/Mac binaries should ideally move to 3.13. This is a routine maintenance/security-hardening build change, not a fix for an active exploit.
AI review queuedqt: fix crash through stale pi resolveby f321x · 299be410 · Jul 1, 2026 · 1 fileMessage 76 · AdequateInformational 24Details
Commit message · f321x
qt: fix crash through stale pi resolve
When multiple PIs get resolved consecutively through repeated editing of the PI field, and the `on_resolve_done` callback tries to access a PI that has been cleared by a previous, failed callback an exception is raised.
I was able to reproduce this somehow by adding a sleep to `PaymentIdentifier._do_resolve()` and entering lightning addresses.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 24/100
This commit fixes a bug in Electrum's Qt send tab where the app could crash if a user edited the payment recipient field quickly while previous lookups were still finishing. The fix ignores results from outdated lookups instead of letting them trigger an error.
When opening the 2fa app on an android phone the Electrum app gets killed, causing the user to lose the wizard state. This is quite annoying, so we should prevent this until there is a proper mechanism to keep the app alive.
76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 19/100
This commit changes the Android two-factor authentication setup flow in Electrum's mobile app. Previously, tapping the QR code would open an external authenticator app directly, but on Android this caused Electrum to be killed by the system, losing the user's progress in the setup wizard. The fix simply copies the secret code to the clipboard instead and tells the user to enter or scan it manually. This is a usability/reliability fix, not a security vulnerability patch.
AI review queued(trivial) wallet: fix stale comment on on_event_invoice_statusby Sasha Zykov · 95317f4b · Jun 30, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Sasha Zykov
(trivial) wallet: fix stale comment on on_event_invoice_status
The followup rename (_paid_invoice_keys -> _paid_invoice_keys_cache) and the de-sloppify left this comment referring to the old name and claiming the listener only tracks LN-driven changes; it is now the population path for onchain invoices too.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only updates a stale code comment to match a recent variable rename and to correctly describe what the function now does. No actual code behavior was changed, so there is no security impact.
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 35/100
This commit is a cleanup of a previous change that added a cache for paid invoices. The developer admits the earlier code was sloppy ('arghhhhhh'). The patch removes redundant logic that tried to update the paid-invoice cache in multiple places and instead lets a single method, get_invoice_status, decide whether an invoice is paid. The risk is that if the cache is not updated correctly, Electrum might wrongly report an invoice as paid or unpaid, which could mislead users or merchants about whether money was actually received. There is no direct evidence this is exploitable by an attacker, but it is a correctness fix in payment handling.
Lower-priorityregtest: make extract_preimage less flakyby f321x · 2a321f08 · Jun 30, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · f321x
regtest: make extract_preimage less flaky
Wait until the lnpay screen commands in the `extract_preimage` regtest return before checking their log output to prevent a race where the preimage becomes available but the log doesn't yet contain the success string.
``` ***** test_extract_preimage ****** initializing alice funding alice a6f8f660a3bab3c4af636849dae55f4c7d5d483289a5812c7efce19f4c701753 initializing bob funding bob b51eae095f875c7a796e74d87d6e4c21d42348272159ee30bd81ce7d9f18defe mining 1 blocks starting daemon (PID 5040) /tmp/alice/regtest/wallets/default_wallet true starting daemon (PID 5060) /tmp/bob/regtest/wallets/default_wallet true
alice opens channel 7cde6dcba2a0d033ecd40c1c7cb8eec4c554acb1a09099eb1206ba39a93728ae:1 mining 3 blocks wait until alice sees channel open. wait until alice sees channel open.. wait until alice sees channel open... 0caecfe64e319771d60f6f1e488f28d64667783432a15fccab534dfffb2096a4 mining 1 blocks wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728. wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728.. wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728... wait until bob has preimage for c53556db6fcffcb2dd7c6b215e94d1af9c96e42c7170ae11e47b03a929917f28. bob payment failed Daemon stopped Daemon stopped ......F ====================================================================== FAIL: test_extract_preimage (tests.regtest.TestLightningAB) ```
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 15/100
This commit fixes a flaky automated test, not a security bug in the Electrum wallet. It adds a wait step so the test script doesn't check log files before background payment commands have finished writing to them. There is no change to production code or user-facing behavior.
Lower-prioritytest_storage_upgrade: add upgrade from client_4_6_0_with_unfulfilled_htlcsby ThomasV · eff48a2d · Jun 30, 2026 · 3 filesMessage 50 · ThinInformational 15Details
Commit message · ThomasV
test_storage_upgrade: add upgrade from client_4_6_0_with_unfulfilled_htlcs
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only adds a new test case and a test helper. It does not change any production wallet code. The test checks that Electrum can correctly upgrade an old wallet database that contains unfinished Lightning payment data ('unfulfilled HTLCs') from version 4.6.0 to the current format. There is no security fix or vulnerability being patched here.
