Electrum

This commit is purely a user-interface styling refresh. It changes how the History screen, Nostr relay settings dialog, and proxy configuration panel look in Electrum's QML (mobile-style) GUI. There are no changes to security logic, network handling, cryptography, or data processing.

This commit is a user-interface cleanup in Electrum's mobile/QML app. It replaces custom-styled button wrappers with the standard Button component in three screens: channel freeze controls, swap provider selection, and wallet recovery. There is no security change—only visual consistency and simpler code.

This commit updates the Android build setup for the Electrum Bitcoin wallet. It switches to a newer version of the python-for-android build tool, starts building two PyQt-related packages (pyqt_builder and sip) from source instead of relying on pre-built wheels, and adds cryptographic hash checks for build-time Python tools like setuptools and pip. These are supply-chain hardening changes: they make it harder for a malicious or compromised upstream package to sneak bad code into Electrum's Android app during compilation.

This commit tightens the Android build process for the Electrum Bitcoin wallet by pinning exact versions of build tools (like Cython, pip, setuptools) and their cryptographic hashes. It also updates the version of python-for-android used. There is no direct vulnerability fix in the application code; instead, it is a supply-chain hardening change to make the build more reproducible and prevent unexpected or malicious tool updates during compilation.

This commit updates how Electrum's Android build system installs Python packaging tools. It switches from a feature-rich 'build[virtualenv]' dependency to a simpler 'build' dependency, removes a custom pinned recipe for setuptools, and moves setuptools into a new 'hostpython_prerequisites' mechanism for some recipes. It also updates version assertions for packaging, pyqt6sip, sip, and pyqt_builder to match a newer python-for-android version. There is no direct security fix visible in the diff; it appears to be build-system maintenance.

This commit simply bumps the Android build's Qt6 and PyQt6 libraries from version 6.10.1 to 6.10.2, along with the matching python-for-android checkout. It updates pinned version assertions and SHA-512 checksums. There is no indication in the commit itself that this fixes a security vulnerability.

This commit is purely a user-interface styling update for Electrum's QML (mobile-style) screens. It changes how password prompts and wallet setup wizards look—moving labels into placeholder text, adjusting margins, and making buttons a consistent touch-friendly height. There is no change to security logic, cryptography, or how passwords/seeds are handled.

This commit changes the version of OpenSSL used in Electrum's Android build from 3.3.1 to 3.0.18. It also removes a safety check that ensured the expected version was being used. The change appears to be a downgrade to an older OpenSSL version, which could reintroduce known security vulnerabilities that were fixed in newer releases. However, the commit message gives no explanation, and no security advisory or vendor statement is supplied.

This commit makes small visual styling changes to three QML user-interface files in Electrum's mobile-style GUI. It adds a navigation bar background color property and sets background colors on two info text areas, plus adjusts spacing in a dialog. There is no indication these changes affect security, data handling, cryptography, or network behavior.

This commit only adds Python type hints (annotations like `-> QEWallet` and `-> QEAmount`) to existing QML GUI property getter and setter methods. It does not change any runtime behavior, logic, or security checks. There is no security issue here.

This is a compatibility fix for Electrum's Android app. It stops loading the QtMultimedia camera module on Android because it causes crashes on older Android versions (Android 8). The QR-code scanner is still available on desktop. There is no direct security vulnerability being patched here; it is primarily a stability/compatibility change.

This commit is purely a user-interface styling update. It changes the background color of informational message boxes in several Electrum mobile/QML dialogs and wraps one button in a layout container. There is no security relevance.

This commit only changes icon images and removes a visual scaling setting in the mobile/QML user interface. It fixes a minor cosmetic issue where icons would appear to resize when highlighted. There is no security relevance.

This commit simply raises the minimum Android version required to run the Electrum app from Android 6.0 (API 23) to Android 8.0 (API 26). The change is needed because the newer Qt 6.10 library used by the app no longer supports older Android versions. This is a routine compatibility/configuration update, not a security fix.

This commit adds a small visual progress bar to buttons in Electrum's mobile-style QML interface that have a hidden 'press and hold' action. It is purely a user-experience change to help users discover that long-pressing certain buttons does something extra. There is no security-relevant change in the code.

This commit is a user-interface polish change for Electrum's mobile/QML layout. It stops adding extra bottom padding when the on-screen keyboard is visible, and lets individual pages set the background color of the navigation-bar area so the screen looks consistent. There is no security issue visible in the changes.

This commit simply updates the version number of an AI code-review tool used in Electrum's continuous integration (CI) pipeline from Claude Opus 4.6 to 4.7. It does not change any wallet, networking, or cryptographic code that end users rely on. There is no indication of a security fix or vulnerability.

This commit is a privacy improvement, not a security fix for an attack. It adds a small helper that truncates Bitcoin addresses before putting them into error messages. The goal is to protect users if those error messages are sent to a crash reporter or shown in logs, so that full addresses (which could identify transactions or balances) are not leaked. No vulnerability is being patched.

This commit improves Electrum so that when a user accidentally opens a wallet created for one Bitcoin network (mainnet) while running Electrum configured for another (testnet), they get a clear error message instead of confusing crashes. It stores the network's genesis block hash inside the wallet file and checks it on load. It is a defensive hardening change, not a fix for an active security vulnerability or exploit.

This commit fixes a bug in Electrum's Bitcoin wallet where combining a new payment with an existing unconfirmed transaction (a feature called RBF batching) could fail or compute fees incorrectly. The root cause was that the code tried to read the existing transaction's fee before it had loaded all the necessary wallet information about that transaction's inputs. The fix reorders the code so the wallet enriches the transaction first, then reads its fee. It also adds a safety check to skip transactions whose confirmation status is unknown when looking for batching candidates.

This commit fixes a timing problem in a single automated test for the Lightning Network peer code. It does not change any production code, wallet behavior, or network handling. The fix makes the test wait for a callback event instead of polling every 0.1 seconds, which removes a race condition that could cause the test to fail randomly. There is no security impact for Electrum users.

This commit tightens how Electrum's Lightning node handles a peer that reconnects after a disconnect and claims to be ahead on channel state. Previously, a single 'they_are_ahead' flag was used for two different counters, which could let a peer claim it was ahead on one counter without providing cryptographic proof on the other. The patch splits that into 'ahead with proof' (which triggers a safe data-loss-recovery path) and 'ahead without proof' (which now force-closes the channel instead of trusting the claim). It also schedules a force-close when data-loss-protect fields are invalid. In short, it reduces the chance a malicious or buggy peer can trick your node into a state where funds could be lost.

This is a one-line correction to a code comment (type hint) in Electrum's Lightning channel code. It does not change any actual program behavior, so it has no security effect.

This commit changes how Electrum's Ledger hardware wallet plugin obtains the wallet's master fingerprint. It adds a new, more direct command (GET_MASTER_FINGERPRINT) for older Ledger devices, while keeping a fallback to the previous method. The change appears intended to avoid requiring a special device permission (DERIVE_MASTER) when only the fingerprint is needed. There is no clear security bug in the patch itself, but it touches sensitive key-handling code and the commit message does not explain whether this fixes a vulnerability or is just a compatibility improvement.

This is a small code cleanup in Electrum's Lightning Network peer handling. The change replaces a fake but valid-looking public key (derived from the number 42) with a clearer, well-known valid public key (the standard generator point) when sending a 'channel_reestablish' message. The comment now explicitly says this value is ignored by modern nodes because they use a feature called option_static_remotekey. There is no obvious security vulnerability being fixed here; it is mainly a clarification and minor hardening against future confusion.