Electrum

This commit only adds new unit tests for an existing fee-budget allocation function used in Lightning trampoline routing. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly.

This commit fixes how Electrum calculates fees for trampoline Lightning payments when some route edges have known fees and others are unknown placeholders. Previously, the code ignored known fees and split the entire budget evenly among placeholder edges, which could either overpay or exceed the intended fee budget. The new code solves a small linear equation so the final total fee stays within budget. This is a correctness and fee-budget safety improvement, not a direct theft-of-funds bug, but getting it wrong could cause payments to fail or users to pay more than expected.

This is a small user-experience improvement in the Electrum Bitcoin wallet's Qt desktop interface. It changes how certain wallet-loading errors are handled: instead of showing some unexpected errors to the user as a warning dialog, they are now sent to Electrum's crash reporter. It does not change how funds are stored, signed, or transmitted, and there is no indication it fixes a security vulnerability.

This commit simply bumps the pinned version of the ledger-bitcoin Python package from 0.4.0 to 0.4.1 in Electrum's deterministic build requirements file. It updates the package hash fingerprints accordingly. There is no code change, no disclosed security fix, and no independent security analysis provided. On its own, this is a routine dependency maintenance patch with no identifiable security relevance.

This commit is a small internal code cleanup in Electrum's Lightning onion-message handling. It moves the 'round-robin' destination selection logic into its own helper method and ensures a single destination is treated as a list earlier. There is no visible security fix or behavior change beyond slightly cleaner code organization.

This commit replaces a shaky way of shuffling lists with a proper utility function. The old code sorted items by random numbers, which can produce biased or predictable ordering and is generally considered bad practice. The change itself is a small code-quality improvement, not a clear-cut security fix, but it removes a weak randomness pattern used when selecting Lightning Network channels and peers for routing private messages.

This commit simplifies how Electrum prepares encrypted data for onion messages. It removes a redundant encryption step and reuses an existing helper function. The change is described by the developer as a no-op cleanup, not a security fix. There is no direct evidence in the commit or supplied references that this addresses a vulnerability.

This commit simply raises the minimum required version of the ledger_bitcoin library that Electrum uses to talk to Ledger hardware wallets. It does not by itself fix any specific bug; it is a dependency version bump that may be a follow-up to a security fix in the upstream library, but the commit message gives no details.

This commit cleans up duplicate wallet-name checking code in Electrum's mobile-style QML interface and moves the validation into one shared place. It also slightly changes when the 'rename' button is enabled. The changes look like a defensive hardening/refactoring rather than a fix for a known active attack, but they do strengthen checks against path-traversal-style wallet names.

This commit simply removes one debug log message that was considered too noisy. It does not change any program logic, data handling, or security behavior. There is no security issue here.

This commit only changes test scripts used in regression testing. It increases how long the tests wait for certain Bitcoin/Lightning operations to complete, from 30 seconds to 120 seconds. There is no change to the actual Electrum wallet software that users run, and no security issue is present.

This commit tightens when Electrum's Lightning code accepts a 'channel_reestablish' message from a peer. Previously, the message was dropped only if the channel was already CLOSED or later; now it is also dropped while the channel is in the process of force-closing (FORCE_CLOSING, REQUESTED_FCLOSE, WE_ARE_TOXIC). The change is defensive: it reduces the chance a peer could probe or confuse Electrum during a force-close. The patch is a one-line threshold change and does not by itself fix a known exploit.

This commit fixes a flaky automated test in Electrum's Lightning regtest suite. It replaces a hard-coded 5-second wait with a polling helper that waits up to 30 seconds for a test condition to become true. There is no change to production wallet or Lightning code, and no security issue is present.

This commit updates version numbers for build dependencies inside a patch file used to create reproducible AppImage builds. It is a routine maintenance change with no visible security bug or vulnerability fix.

This commit simply deletes an unused helper script that downloaded an Android NDK build artifact during continuous integration. There is no security-relevant change, no vulnerability fix, and no indication the script was ever part of shipped Electrum software.

This commit simply updates a reference to a specific version (commit hash) of the python-for-android build tool used to create Electrum's Android app. There is no indication in the commit itself that this is a security fix, vulnerability, or malicious change. It is a routine dependency/build-tool pointer update.

This commit strengthens the security of Electrum's Android build process by adding cryptographic hash checks for two helper Python packages (setuptools and packaging) used when compiling parts of the app. Before this change, those helper packages could have been downloaded without verification, potentially allowing a compromised or malicious package to tamper with the Android build. The change is a hardening improvement, not a fix for a known active attack.

This commit is a user-interface polish change for Electrum's mobile/QML layout. It stops adding extra bottom padding when the on-screen keyboard is visible, and lets individual pages set the background color of the navigation-bar area so the screen looks consistent. There is no security issue visible in the changes.

This commit adds a small visual progress bar to buttons in Electrum's mobile-style QML interface that have a hidden 'press and hold' action. It is purely a user-experience change to help users discover that long-pressing certain buttons does something extra. There is no security-relevant change in the code.

This commit simply bumps the Android build's Qt6 and PyQt6 libraries from version 6.10.1 to 6.10.2, along with the matching python-for-android checkout. It updates pinned version assertions and SHA-512 checksums. There is no indication in the commit itself that this fixes a security vulnerability.

This commit is a purely cosmetic restyling of a user-interface dialog in Electrum's mobile/QML app. It rearranges the text box, buttons, and labels used when opening a Lightning payment channel, but does not change any security logic, validation, or data handling.

This commit simply raises the minimum Android version required to run the Electrum app from Android 6.0 (API 23) to Android 8.0 (API 26). The change is needed because the newer Qt 6.10 library used by the app no longer supports older Android versions. This is a routine compatibility/configuration update, not a security fix.

This commit only changes icon images and removes a visual scaling setting in the mobile/QML user interface. It fixes a minor cosmetic issue where icons would appear to resize when highlighted. There is no security relevance.

This commit is purely a user-interface styling update. It changes the background color of informational message boxes in several Electrum mobile/QML dialogs and wraps one button in a layout container. There is no security relevance.

This is a compatibility fix for Electrum's Android app. It stops loading the QtMultimedia camera module on Android because it causes crashes on older Android versions (Android 8). The QR-code scanner is still available on desktop. There is no direct security vulnerability being patched here; it is primarily a stability/compatibility change.