Electrum

This commit updates the Android build environment from Debian 12 (bookworm) to Debian 13 (trixie). It changes the Docker base image, package sources, Java version, and some library package names to match the new Debian release. There is no indication of a security fix or vulnerability being addressed.

This commit fixes a typo in a single test file. The test was accidentally running the same helper function twice (p1.htlc_switch() called twice) instead of running it once for each of two simulated participants (p1 and p2). The change makes the test more realistic but does not alter any production code, so it cannot affect real users or wallets.

This commit simply moves an internal data template from inside a class constructor to the top of the same file. No behavior, logic, or security properties change. It is a routine code cleanup with no user-facing or security impact.

This commit cleans up how Electrum stores initial Bitcoin transaction fee information for Lightning payment channels. Previously, both sides of a channel got a starting fee entry in the internal log, even though only the channel initiator is allowed to change fees later. The patch now records the initial fee only for the initiator and includes a database upgrade routine to remove the duplicate entry from existing wallets. The change is described by the developer as a cleanup, not a security fix, but it touches code that decides which fee rate is used in commitment transactions, which matters for channel safety.

This commit is a small internal code cleanup in Electrum's Lightning message parser. It changes how the parser chooses which CSV specification file to load, switching from a true/false flag to a filename string. There is no security-relevant change: the same two files are still loaded in the same way, and no new attacker-controlled input is introduced.

This commit changes Electrum's Lightning networking code so that, when no Tor/proxy is enabled, it simply skips over '.onion' peer addresses instead of trying to connect to them. The goal is to avoid wasting connection attempts on addresses that cannot be reached without a proxy. It is a performance and reliability improvement, not a fix for an exploitable security vulnerability.

This commit fixes a bug in Electrum's Lightning Network peer manager. Previously, the code thought a proxy was always configured because the proxy object always existed, even when disabled. As a result, it skipped DNS resolution and could behave incorrectly when connecting to peers, especially for .onion addresses which require a proxy. The fix checks whether the proxy is actually enabled, not just present.

This change fixes a small user-experience bug in Electrum's first-run network setup wizard. Previously, if a user chose to manually configure a server but then closed the wizard without finishing, the wallet would remember that choice and skip the wizard on the next launch, silently connecting to a random server instead. Now the wizard will reappear until the user completes or explicitly accepts the setup. There is no direct theft-of-funds or remote-code-execution vulnerability here.

This commit fixes a small bug in Electrum's setup wizard where, if a user chose to manually configure a server but left the field empty or invalid, the wizard would pass an empty string as the server address. That could cause a crash (traceback). The fix falls back to the default server instead of an empty string and logs a warning rather than silently returning. It is a stability fix, not a security vulnerability.

This commit adds a user-interface check in Electrum's newer QML (mobile-style) interface to make sure a server address typed by the user looks valid before allowing them to continue. It mirrors a similar check that already existed in the older Qt desktop interface. The change prevents users from accidentally saving or connecting to a clearly malformed server address, which could otherwise lead to connection failures or, in worst-case scenarios, being tricked into connecting to an attacker-controlled server.

This commit fixes a user-interface bug in the Electrum Bitcoin wallet's setup wizard. Previously, a user could type a malformed custom server address, click 'Next', and the wallet would silently ignore it and automatically pick a server instead. Now the wizard blocks the 'Next' button and highlights the bad address in red so the user notices.

This commit adds a standard extension point (a 'hook') to the right-click menu of the UTXO list in Electrum's Qt wallet interface. It lets third-party plugins add their own menu items when a user right-clicks on unspent transaction outputs. The change itself is a neutral feature addition; it does not contain any vulnerability or unsafe behavior.

This commit is a minor shell-script cleanup. It removes an unnecessary 'ls' call in a loop and adds missing double quotes around variables. These are best-practice hygiene changes that prevent filename-word-splitting bugs, but they do not introduce or fix any active security vulnerability in the shipped Electrum wallet software itself.

This is a trivial compatibility fix for a helper script. In Python 3.13, using importlib.util requires explicitly importing importlib.util. The change adds that missing import so the script can load a version file again. There is no security issue here.

This commit fixes a bug where the 'Addresses' tab in Electrum's Qt GUI would crash or fail to display for a specific type of wallet: imported watch-only wallets. These wallets contain addresses you are monitoring but do not own the private keys for. The crash happened because the code assumed every address had an associated public key/index, but watch-only imported addresses do not. The fix makes the sorting function safely handle a missing index by treating it as an empty string. There is no security vulnerability here—just a user-interface regression.

This commit simply adds a new 'Changelog' menu item to Electrum's Help menu. When clicked, it opens the project's RELEASE-NOTES file on GitHub in the user's web browser. There is no security issue visible in this change.

This commit fixes a build script bug in Electrum's Linux AppImage packaging. When developers set a specific commit to build from (ELECBUILD_COMMIT), the script looked for a helper file in the wrong directory and the build would fail. The fix simply points the script to the correct location. There is no security issue here—just a broken build path being corrected.

This commit only changes the software version number from 4.6.2 to 4.7.0 in a single file. It does not modify any program logic, security checks, or user-facing behavior. There is no security relevance in this change itself.

This commit only reformats the project's RELEASE-NOTES file. It rewords bullet points, moves a few entries into different sections, and fixes punctuation. No program code was changed, so it cannot affect wallet security, funds, or network behavior.

This commit simply adds new Bitcoin block header checkpoints to Electrum's data files for mainnet, signet, testnet, and testnet4. Checkpoints are hardcoded reference points that help the wallet verify it is following the correct blockchain. There is no code change, no bug fix, and no security vulnerability visible in this commit.

This commit is a routine update to Electrum's locale (translation/language) files. There is no indication of any security-related change, and the actual code diff is unavailable. It appears to be a normal maintenance update for translations.

This commit only adds the release notes for Electrum version 4.7.0. It contains no code changes, only documentation describing new features, changes, and fixes included in the release.

This commit only changes the order and formatting of user-facing warning messages in the Electrum Qt transaction confirmation dialog. It does not alter any security logic, calculations, or transaction handling. There is no security issue here.

This commit moves the code that requests a 'swap invoice' from the send tab into the transaction editor dialog. It also disables the Preview button when a transaction will send leftover change into a Lightning swap. The goal is to make sure the swap is requested over the already-open connection and to stop users from saving or exporting a swap transaction and broadcasting it later, because the swap server needs to be told about the transaction right before it is broadcast. The change is a defensive hardening measure rather than a fix for an active exploit.

This commit is a user-interface improvement for Electrum's transaction editor. It makes the fee display update automatically when a 'send change to Lightning' swap connection is being set up, so the user isn't left waiting with a frozen window. There is no direct evidence in the commit of a security vulnerability being fixed.