Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit updates Electrum's internal CI (continuous integration) script that runs an automated security review using Anthropic's Claude Code tool. It changes the AI model version used for reviews from 'claude-opus-5' to 'claude-opus-5-5…
CI hardening: detects and reports AI model downgrades during automated security reviewNo changes to application code, cryptography, network protocol, or build artifactsNo privilege escalation, injection, or data-exfiltration vectors introduced by the diff
This commit updates Electrum's own CI security-review script. It adds detection and warnings when the automated code reviewer (Claude Code) silently falls back to a different AI model, for example after a content-policy refusal. It does no…
CI-only changeNo modification of wallet, crypto, networking, or build artifactsAdds detection for AI model fallback/downgrade in automated security review
This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptS…
Logic error in transaction completeness detectionNative SegWit witness handling edge casePSBT interoperability issue with Bitcoin Core
This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum …
Logic error in transaction completeness detectionPotential denial of service / user funds stuck due to refusal to broadcast valid finalized transactionInteroperability failure with Bitcoin Core and Sparrow PSBT output
This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…
Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their B…
Documentation-only changeExplicit design tradeoff disclosure: cosigners can derive each other's Nostr secret keys from shared xpubsNo functional code change
This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-rela…
This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct pad…
Stricter BOLT11 amount validation prevents acceptance of zero, negative, sub-millisatoshi, and leading-zero amountsFixed int_to_data5 padding bug that corrupted small timestamp values during invoice round-tripMalformed 'r' routing tags now raise exceptions instead of being silently skipped
Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silent…
Swallowed exception leading to use of attacker-controlled input valuePSBT input consistency check bypassedPotential malicious Electrum server influence on transaction signing
This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no …
This commit tightens how Electrum parses Bitcoin payment requests (BOLT11 lightning invoices and BIP21 URIs). It turns previously uncaught internal errors into proper validation failures, rejects malformed invoice fields that used to be si…
Stricter input validation for externally supplied BOLT11 invoices and BIP21 URIsPreviously uncaught exceptions (ValueError, UnicodeDecodeError, ecc errors) are now wrapped in domain-specific decode exceptionsMalformed fallback addresses are skipped rather than aborting or crashing
This commit tightens how Electrum parses BOLT11 Lightning invoices. It now rejects duplicate 'n' (node pubkey) tags instead of silently keeping only the first one, and it rejects invoice timestamps that are negative or too far in the futur…
Stricter validation of invoice timestamp boundsDuplicate 'n' tag now raises an exception instead of being silently droppedFollow-up to prior PR #10940, indicating a recent area of security-sensitive review
This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…
Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…
Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
This commit only adds new Bitcoin block header checkpoints to Electrum's built-in chain data files. Checkpoints are hardcoded reference points that help the wallet verify it is following the real blockchain and not a fake one. Updating the…
Hardcoded blockchain checkpoints extended for all supported networksNo executable code or cryptographic logic changedNo bug fix, privilege change, or input validation change present
This commit simply refreshes Electrum's built-in list of Bitcoin blockchain checkpoints. Checkpoints are known-good block hashes that help the wallet verify it is following the real chain. The update adds newer checkpoints for mainnet, sig…
This commit fixes cases where Electrum's wallet cache could hold onto outdated information about coins and transactions after blockchain reorganizations or mempool changes. For example, if a transaction was previously thought to be mined b…
stale cached state after reorg/mempool evictionincorrect confirmation metadata displayed to userscache invalidation added at multiple state transitions
This commit is a simple code cleanup: it replaces two repeated lines that set a transaction input's block height and position with a single helper method called set_mined_info. There is no change in behavior, no bug fix, and no security re…
This is a small internal code cleanup in the Electrum Bitcoin wallet. It moves the logic that builds a compact transaction identifier (like '123x4') into one shared helper method, and removes a duplicate helper class. There is no user-faci…
This commit changes how the Electrum AppImage build container first obtains trusted web certificates. Because the build's pinned Debian package sources use HTTPS, the container needs certificates before it can talk to them. The old method …
build pipeline changetemporary downgrade from HTTPS to HTTP for package bootstrappackage integrity still protected by apt GPG signatures
This commit only updates a macOS build documentation file (README.md). It adds troubleshooting instructions for developers who are code-signing Electrum app bundles, including how to fix private-key access control and certificate trust settings. There is no code change, no wallet behavior change, and no security vulnerability being fixed.
Merge pull request #10845 from f321x/hide_passphrase_entry
qml: wizard: hide passphrase input if disabled
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlmerge-commit duplicate discount
AI analysis · Informational 20/100
This change tweaks a mobile-style setup wizard so that the optional passphrase text box is hidden when its checkbox is not selected, instead of merely grayed out. The commit message says this was done because users were confusing the passphrase field with the seed re-entry field. It is a usability fix, not a security bug fix.
Security candidaterelease notes: add pre-notification of security fixes for 4.8.1by SomberNight · c4cc40fd · Aug 12, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · SomberNight
release notes: add pre-notification of security fixes for 4.8.1
55/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
explicit security language
AI analysis · Informational 15/100
This commit only edits the project's release notes to add a vague pre-notification that version 4.8.1 will contain undisclosed security fixes. It does not include any actual code changes, patches, or details about what the security issues are.
Lower-priorityMerge pull request #10843 from Alwoch/interface_test_macos_disconnectby Felix · 342bca3a · Aug 12, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Felix
Merge pull request #10843 from Alwoch/interface_test_macos_disconnect
test: test_we_disconnect_on_incoming_notification_spam fails on Macos
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-prioritytests: interface: wait for server-side disconnectby Alwoch · d5b7e743 · Aug 12, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · Alwoch
tests: interface: wait for server-side disconnect
55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityMerge pull request #10841 from SomberNight/202608_release_481by ghost43 · 1bfee7d1 · Aug 10, 2026 · 2 filesMessage 58 · ThinTriage 0Details
Commit message · ghost43
Merge pull request #10841 from SomberNight/202608_release_481
prepare release 4.8.1
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
merge-commit duplicate discount
AI review queuedprepare release 4.8.1by SomberNight · 59d1b201 · Aug 10, 2026 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · SomberNight
prepare release 4.8.1
38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit is a routine version bump and release-notes update for Electrum 4.8.1. It does not change any executable code, only the version string and the changelog. The changelog itself lists many fixes from prior commits, but this specific commit only packages those notes for release.
Lower-priorityMerge pull request #10836 from spesmilo/swaps_max_cltvby ThomasV · ad208f93 · Aug 10, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10836 from spesmilo/swaps_max_cltv
reverse swaps: lower acceptable cltv_delta value
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge pull request #10837 from SomberNight/202608_warn_on_ln_forwardingby ThomasV · 41daa2ab · Aug 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10837 from SomberNight/202608_warn_on_ln_forwarding
config: log warnings if using experimental features on mainnet
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge pull request #10838 from SomberNight/202608_lnworker_rm_dupl_loggerby ThomasV · 8ad1e917 · Aug 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10838 from SomberNight/202608_lnworker_rm_dupl_logger
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityconfig: log warnings if using experimental features on mainnetby SomberNight · b199abba · Aug 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · SomberNight
config: log warnings if using experimental features on mainnet
Users who discover experimental settings in the first place should already be kind of aware of the risks anyway. However we now log a warning to raise more awareness.
Alternatively we could raise an exception to trigger a runtime exit. This is a bit less extreme and should already be seen even without verbose logging enabled.
In the case of LN forwarding, people should really not use it on mainnet yet.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityMerge pull request #10827 from f321x/swap_improvement_2by ThomasV · 7448037e · Aug 10, 2026 · 13 filesMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10827 from f321x/swap_improvement_2
swaps: introduce unittest suite for submarine swaps
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
AI review queuedqml: styling OTP dialogby Sander van Grieken · b7f124fc · Aug 10, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Sander van Grieken
qml: styling OTP dialog
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit is purely a user-interface styling tweak for the one-time password (OTP) dialog in Electrum's QML (mobile-style) GUI. It sets the character used to calculate the input field width to '8', adds left/right padding to that width calculation, and changes how an error label is horizontally centered. There is no security-relevant change.
Lower-priorityMerge pull request #10832 from accumulator/p4a_no_autodownload_platformtoolsby accumulator · a6125ff4 · Aug 10, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · accumulator
Merge pull request #10832 from accumulator/p4a_no_autodownload_platformtools
android: no autodownload platform-tools
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Merge pull request #10829 from nrobi144/coldcard-firmware-range-fix
docs: correct Coldcard firmware range in seed-entropy notice
78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomnessdocumentation-only discountmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit only updates a documentation file (a README) to correct the range of Coldcard hardware wallet firmware versions affected by a previously disclosed security issue. It does not change any executable code, cryptographic logic, or wallet behavior in Electrum itself. The underlying security problem exists in Coldcard firmware, not in Electrum.
Lower-priorityMerge pull request #10835 from f321x/rm_protobufby ghost43 · 6d921036 · Aug 10, 2026 · 4 filesMessage 53 · ThinTriage 0Details
Commit message · ghost43
Merge pull request #10835 from f321x/rm_protobuf
contrib: drop protobuf requirement
53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge pull request #10831 from SomberNight/202608_nwc_plugin_handle_unsupported_encby ThomasV · bf5f0860 · Aug 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10831 from SomberNight/202608_nwc_plugin_handle_unsupported_enc
plugins: nwc: don't try to decrypt event with "UNSUPPORTED_ENCRYPTION"
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
AI review queuedMerge pull request #10833 from SomberNight/202608_swaps_dm_repliesby ThomasV · cb4fe3a3 · Aug 10, 2026 · 1 fileMessage 73 · AdequateLow 46Details
Commit message · ThomasV
Merge pull request #10833 from SomberNight/202608_swaps_dm_replies
swaps: nostr: check_dms: duplicate replies from server could crash transport
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
This patch fixes a crash in Electrum's submarine swap feature when using Nostr direct messages. If a Nostr server sent the same reply twice, the code tried to complete an already-completed 'future' object, which raises an exception in Python's asyncio. The fix ignores duplicate or unknown replies instead of crashing. A malicious or misbehaving swap server could potentially trigger this to disrupt a user's swap transport/connection.
AI review queuedcontrib: drop protobuf requirementby f321x · 5f6e9102 · Aug 10, 2026 · 4 filesMessage 66 · AdequateInformational 15Details
Commit message · f321x
contrib: drop protobuf requirement
The protobuf dependency was introduced with bip 70 payment requests in commits 4120678df / c44427d33e but not removed with the bip 70 removal in https://github.com/spesmilo/electrum/pull/10535
Currently it fails the installation of the deterministic requirements as newer setuptools doesn't seem to have the `pkg_resources` module anymore: ``` Collecting protobuf==3.20.3 (from -r /tmp/requirements.txt (line 39)) Downloading protobuf-3.20.3.tar.gz (216 kB) Installing build dependencies: started Installing build dependencies: finished with status 'done' Getting requirements to build wheel: started Getting requirements to build wheel: finished with status 'error' error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully. │ exit code: 1 ╰─> [23 lines of output] Traceback (most recent call last): File "/usr/local/lib/python3.14/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 389, in <module> main() ~~~~^^ File "/usr/local/lib/python3.14/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 373, in main json_out["return_val"] = hook(**hook_input["kwargs"]) ~~~~^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 143, in get_requires_for_build_wheel return hook(config_settings) File "/tmp/pip-build-env-b04pv17_/overlay/lib/python3.14/site-packages/setuptools/build_meta.py", line 333, in get_requires_for_build_wheel return self._get_build_requires(config_settings, requirements=[]) ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/tmp/pip-build-env-b04pv17_/overlay/lib/python3.14/site-packages/setuptools/build_meta.py", line 301, in _get_build_requires self.run_setup() ~~~~~~~~~~~~~~^^ File "/tmp/pip-build-env-b04pv17_/overlay/lib/python3.14/site-packages/setuptools/build_meta.py", line 520, in run_setup super().run_setup(setup_script=setup_script) ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/tmp/pip-build-env-b04pv17_/overlay/lib/python3.14/site-packages/setuptools/build_meta.py", line 317, in run_setup exec(code, locals()) ~~~~^^^^^^^^^^^^^^^^ File "<string>", line 11, in <module> ModuleNotFoundError: No module named 'pkg_resources' [end of output] ```
66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100
This commit removes an unused software dependency called protobuf. The dependency was originally added years ago to support a Bitcoin payment protocol feature (BIP 70) that has since been removed from Electrum. Keeping protobuf in the requirements list was causing installation failures on newer systems because an old version of protobuf cannot build with current Python packaging tools. There is no security vulnerability here—this is a cleanup fix for a broken build/install process.
Lower-priorityMerge pull request #10828 from accumulator/lnurl_validationby ghost43 · 2ca4ec9a · Aug 10, 2026 · 2 filesMessage 58 · ThinTriage 0Details
Commit message · ghost43
Merge pull request #10828 from accumulator/lnurl_validation
LNURL validation improvements
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge pull request #10820 from f321x/anchor_off_by_one_bugby ThomasV · 52766d27 · Aug 10, 2026 · 3 filesMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10820 from f321x/anchor_off_by_one_bug
lnutil: don't trim htlcs equal to dust level
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-priorityMerge pull request #10818 from accumulator/qml_trustedcoin_loggingby ThomasV · 537653ad · Aug 10, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · ThomasV
Merge pull request #10818 from accumulator/qml_trustedcoin_logging
qml: trustedcoin: add type hints, reduce excessive logging
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
