CommitWatch RSS
EL
← All projectsElectrum

Electrum

Long-running lightweight Bitcoin wallet for desktop and mobile platforms.

BitcoinSoftware walletsNormal
Source repository ↗
Repository coverage

1153 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

92security candidates261second-pass queue1007AI analyses
127commits · 30 days
262commits · 60 days
545commits · 180 days
1002commits · 365 days
Backfill bands
Aug 5 → Feb 6470 seen11 candidatesComplete
Feb 6 → Jun 6346 seen10 candidatesComplete
Jun 6 → Jul 653 seen2 candidatesComplete
Jul 6 → Aug 554 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
220Strong · 80–100
549Adequate · 60–79
340Thin · 40–59
44Opaque · 0–39
2security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
ThomasV137891162
SomberNight39330362063
f321x40325387070
Sander van Grieken10910101057
ghost4342517069
Felix25410072
user323062
ekzyis222053
accumulator613071
Roman Zeyde515053
Sasha Zykov515075
Aaron Fiore414068
Analysis record

Published AI watches

Last scanned 22 minutes ago

Low 29 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10992 from f321x/dedup_is_seed_wizard

This commit simplifies the seed-validation logic in Electrum's Qt wallet wizard by replacing a local copy of the rules with a call to an existing shared validation method. The change appears to be a code-cleanup refactor that removes dupli…

Refactor of seed-validation logic in wallet creation wizardRemoval of duplicated seed-type checks in favor of centralized validationAdded assertion constraining seed type to 'electrum'
554daca6by ghost43+2−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10982 from spesmilo/wizard_2fa_seed_redirect

This commit changes Electrum's wallet creation wizard so that if a user tries to restore a normal 'standard' wallet but pastes a seed phrase that actually belongs to a two-factor authentication (2FA) wallet, the wizard automatically redire…

UX-level safety fix preventing wallet-type/seed mismatchState mutation: wizard_data['wallet_type'] changed from 'standard' to '2fa' based on seed typeNo cryptographic, network, or privilege changes
310c9dd0by Felix+102−133 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qt: wizard: dedup seed validation rules

This commit is a small code cleanup in Electrum's wallet setup wizard. It removes a duplicate copy of the rules used to check whether a recovery seed is valid and instead reuses an existing method. There is no indication this fixes a secur…

89d0de06by f321x+2−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

tests: wizard: cover standard -> 2fa redirection

This commit only adds and reorganizes automated test code for Electrum's wallet creation wizard. It does not change any production wallet logic, cryptography, or network handling. The tests verify that when a user tries to restore a 'stand…

70b4d27cby f321x+68−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10988 from f321x/update_security_review_ci_model

This commit updates Electrum's internal CI (continuous integration) script that runs an automated security review using Anthropic's Claude Code tool. It changes the AI model version used for reviews from 'claude-opus-5' to 'claude-opus-5-5…

CI hardening: detects and reports AI model downgrades during automated security reviewNo changes to application code, cryptography, network protocol, or build artifactsNo privilege escalation, injection, or data-exfiltration vectors introduced by the diff
638fbba8by Felix+75−111 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 90 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

ci: security review: warn if the model got downgraded

This commit updates Electrum's own CI security-review script. It adds detection and warnings when the automated code reviewer (Claude Code) silently falls back to a different AI model, for example after a content-policy refusal. It does no…

CI-only changeNo modification of wallet, crypto, networking, or build artifactsAdds detection for AI model fallback/downgrade in automated security review
ace2ca7aby f321x+74−101 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10987 from spesmilo/fix_10986

This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptS…

Logic error in transaction completeness detectionNative SegWit witness handling edge casePSBT interoperability issue with Bitcoin Core
bef80421by ghost43+11−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 81 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

transaction: treat native segwit input with non-empty witness as complete

This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum …

Logic error in transaction completeness detectionPotential denial of service / user funds stuck due to refusal to broadcast valid finalized transactionInteroperability failure with Bitcoin Core and Sparrow PSBT output
e9bb42e6by ThomasV+11−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10981 from spesmilo/do_not_sign_txin_with_witness

This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…

Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
9da4c342by ThomasV+10−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10974 from SomberNight/202609_nostr_psbt_xpub

This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their B…

Documentation-only changeExplicit design tradeoff disclosure: cosigners can derive each other's Nostr secret keys from shared xpubsNo functional code change
46408a78by ThomasV+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10980 from spesmilo/add_input_from_network_do_not_ignore_exceptions

This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-rela…

Exception swallowing bug fixedNetwork/transaction input enrichment logic changedSilent failure mode removed
bb9d3280by ghost43+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10970 from f321x/fix_bolt11_bugs_2

This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct pad…

Stricter BOLT11 amount validation prevents acceptance of zero, negative, sub-millisatoshi, and leading-zero amountsFixed int_to_data5 padding bug that corrupted small timestamp values during invoice round-tripMalformed 'r' routing tags now raise exceptions instead of being silently skipped
4b92c0f2by ghost43+82−939 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 80 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

add_info_from_network: do not swallow exceptions

Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silent…

Swallowed exception leading to use of attacker-controlled input valuePSBT input consistency check bypassedPotential malicious Electrum server influence on transaction signing
3f67b21bby ThomasV+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

bolt11: remove tag arg from get_routing_info

This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no …

e78fba28by f321x+12−127 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10940 from accumulator/fix_10937

This commit tightens how Electrum parses Bitcoin payment requests (BOLT11 lightning invoices and BIP21 URIs). It turns previously uncaught internal errors into proper validation failures, rejects malformed invoice fields that used to be si…

Stricter input validation for externally supplied BOLT11 invoices and BIP21 URIsPreviously uncaught exceptions (ValueError, UnicodeDecodeError, ecc errors) are now wrapped in domain-specific decode exceptionsMalformed fallback addresses are skipped rather than aborting or crashing
a57ef6e7by Felix+707−9610 files
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 36 · Opaque
EL ElectrumElectrum BitcoinSoftware wallets

bolt11: followup #10940

This commit tightens how Electrum parses BOLT11 Lightning invoices. It now rejects duplicate 'n' (node pubkey) tags instead of silently keeping only the first one, and it rejects invoice timestamps that are negative or too far in the futur…

Stricter validation of invoice timestamp boundsDuplicate 'n' tag now raises an exception instead of being silently droppedFollow-up to prior PR #10940, indicating a recent area of security-sensitive review
3026fbdbby f321x+14−232 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10737 from sashazykov/hw-close-wallet-thread-leak

This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…

Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
5b77ca46by Felix+9−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10958 from SomberNight/202609_deps

This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…

Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
8bd8c3fbby ghost43+57−5612 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10965 from SomberNight/202609_header_checkpoints

This commit only adds new Bitcoin block header checkpoints to Electrum's built-in chain data files. Checkpoints are hardcoded reference points that help the wallet verify it is following the real blockchain and not a fake one. Updating the…

Hardcoded blockchain checkpoints extended for all supported networksNo executable code or cryptographic logic changedNo bug fix, privilege change, or input validation change present
9e0b7e64by ghost43+276−04 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

update block header checkpoints

This commit simply refreshes Electrum's built-in list of Bitcoin blockchain checkpoints. Checkpoints are known-good block hashes that help the wallet verify it is following the real chain. The update adds newer checkpoints for mainnet, sig…

e11c579bby SomberNight+276−04 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedhww: fix crash when disabling keystore for hww (was unimplemented for Hardware_Keystore) also preserve derivation path and root fingerprint for watch-only keystore.by Sander van Grieken · 0a2cd5fd · Aug 13, 2025 · 1 fileMessage 73 · AdequateLow 32Details
Commit message · Sander van Grieken

hww: fix crash when disabling keystore for hww (was unimplemented for Hardware_Keystore)
also preserve derivation path and root fingerprint for watch-only keystore.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 32/100

This commit fixes a crash in the Electrum Bitcoin wallet that occurred when users tried to disable a hardware wallet keystore. It also ensures that important wallet metadata (the derivation path and root fingerprint) is preserved when converting a wallet to watch-only mode. The change is a defensive bug fix rather than a security vulnerability, but the missing metadata could have caused user confusion or wallet recovery issues.

Security candidatewizard: add initial tests for KeystoreWizard for electrum and bip39 seeds, hwwby Sander van Grieken · 0c5403b9 · Aug 13, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Sander van Grieken

wizard: add initial tests for KeystoreWizard for electrum and bip39 seeds, hww

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
secret or key material
AI analysis · Informational 15/100

This commit only adds new automated tests for Electrum's wallet setup wizard. It does not change any production code, fix a bug, or alter security behavior. The tests verify that seed-based and hardware-wallet wizard flows produce the expected wallet keys.

AI review queuedqt: wizard: pass wallet_type to Keystore wizard via initial viewstateby Sander van Grieken · 66c0fec1 · Aug 13, 2025 · 2 filesMessage 50 · ThinInformational 12Details
Commit message · Sander van Grieken

qt: wizard: pass wallet_type to Keystore wizard via initial viewstate

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit is a small internal code cleanup in Electrum's Qt graphical interface. It changes how the 'wallet type' is passed into the keystore wizard, moving it from a direct constructor argument into a structured 'view state' object. There is no indication this fixes a security bug; it appears to be a refactoring or bug-fix for wizard behavior.

AI review queuedwizard: add script and derivation to keystorewizard flow. fixes #10063by Sander van Grieken · 4eccfdaa · Aug 13, 2025 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Sander van Grieken

wizard: add script and derivation to keystorewizard flow. fixes #10063

58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adjusts the wallet setup wizard so that users who enter a seed phrase are also asked to confirm the script type and derivation path before the keystore is finalized. It is a UI flow fix for issue #10063 and does not change any security-critical code, cryptographic operations, or network behavior.

Security candidatefix: psbt_nostr: don't allow to save tx without txidby f321x · 478fb483 · Aug 13, 2025 · 5 filesMessage 85 · StrongLow 34Details
Commit message · f321x

fix: psbt_nostr: don't allow to save tx without txid

Stops the psbt nostr plugin from trying to save transactions without
txid to the wallet history and doesn't give the user the option to do
so.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 34/100

This commit fixes a bug in Electrum's PSBT-over-Nostr plugin. Previously, the plugin could try to save a Bitcoin transaction to the wallet history even when the transaction didn't yet have a transaction ID (txid). Such transactions are incomplete (for example, unsigned legacy transactions). Saving them could cause errors, confusion, or corrupt wallet state. The fix adds a check that prevents saving unless a txid exists, and hides or disables the 'Save to Wallet' button in the user interface when saving isn't allowed.

Lower-prioritytests: wizard: imported addrs: validate each addr with "is_address()"by SomberNight · acc52e39 · Aug 12, 2025 · 2 filesMessage 83 · StrongLow 42Details
Commit message · SomberNight

tests: wizard: imported addrs: validate each addr with "is_address()"

This was already done *in the GUIs*, but the backend should definitely
do at least sanity-check-level validation like this.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Low 42/100

This commit adds a safety check in Electrum's wallet creation wizard to verify that strings entered as 'imported addresses' actually look like valid Bitcoin addresses. Previously, the GUI did this check, but the backend code did not. The change prevents invalid or accidental garbage strings from being accepted as wallet addresses. It is a hardening improvement rather than a fix for a known active attack.

Lower-prioritytests: bitcoin: merge testnet/mainnet address_to_script testsby SomberNight · 19b2567d · Aug 12, 2025 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · SomberNight

tests: bitcoin: merge testnet/mainnet address_to_script tests

and add an extra explicit mixed-case bech32 test case

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes test code. It merges duplicate test cases for Bitcoin mainnet and testnet address parsing, adds a few extra test vectors (including one for mixed-case bech32 addresses), and removes a separate test class. There is no change to the actual wallet or address-handling logic, so it cannot introduce a security vulnerability or fix one in production code.

AI review queuedqml: handle invoice validation errors on saveby Sander van Grieken · 43c6f450 · Aug 12, 2025 · 3 filesMessage 45 · ThinInformational 24Details
Commit message · Sander van Grieken

qml: handle invoice validation errors on save

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 24/100

This commit fixes a bug in Electrum's mobile-style QML user interface where saving an invoice could fail silently. Previously, if the invoice data was invalid, the app would not show an error and might still close the dialog or continue as if the invoice was saved. Now the app checks whether saving succeeded, displays an error message if it failed, and stops the process. This is a user-experience and reliability fix rather than a high-severity security flaw.

Lower-prioritytests: wizard: add test cases for imported walletsby SomberNight · dad18c03 · Aug 12, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · SomberNight

tests: wizard: add test cases for imported wallets

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds new automated test cases for Electrum's wallet creation wizard, specifically covering wallets created from imported addresses and imported private keys. It does not change any production code, user-facing behavior, or security logic.

Lower-prioritytests: wizard: add test cases for multisigby SomberNight · d78782c6 · Aug 12, 2025 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · SomberNight

tests: wizard: add test cases for multisig

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds new automated tests for Electrum's wallet creation wizard, specifically covering multisignature wallet setups. It does not change any production code, user-facing behavior, or security-sensitive logic. There is no indication of a vulnerability or security fix.

Lower-prioritytests: wizard: add test case for "restore from slip39"by SomberNight · fe3ebb31 · Aug 12, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · SomberNight

tests: wizard: add test case for "restore from slip39"

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds new automated tests for restoring a Bitcoin wallet from SLIP39 seed shares in Electrum's wallet creation wizard. It does not change any production code, user-facing behavior, or security-sensitive logic. There is no vulnerability or security fix here.

Lower-prioritytests: wizard: add test case for "restore from xpub"by SomberNight · 30a646f8 · Aug 12, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · SomberNight

tests: wizard: add test case for "restore from xpub"

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only adds a new automated test to Electrum's wallet creation wizard. It checks that restoring a standard wallet from an extended public key ('xpub') produces the expected Bitcoin receiving address. No production code was changed, and there is no security fix or vulnerability introduced here.

Lower-priorityqml: qetxdetails: update mempool depth on fee histogramby Sander van Grieken · 9a7ca749 · Aug 12, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Sander van Grieken

qml: qetxdetails: update mempool depth on fee histogram

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds a small UI improvement to Electrum's mobile/QML interface. When the Bitcoin network's fee histogram changes (showing how busy the mempool is), the transaction details screen now refreshes so the displayed mempool depth stays current. There is no security issue here.

Lower-priorityappimage: bump appimagetool to new version/repoby f321x · b93ffdd7 · Aug 12, 2025 · 4 filesMessage 93 · StrongLow 29Details
Commit message · f321x

appimage: bump appimagetool to new version/repo

Updates the appimage build scripts to use the newer
https://github.com/AppImage/appimagetool tool to bundle the appimage
instead of the discontinued https://github.com/AppImage/AppImageKit.
To prevent the new appimagetool from downloading a random "latest"
appimage runtime (`type2-runtime`) binary this PR also adds
functionality to clone and build
https://github.com/AppImage/type2-runtime from source. This is done
using the build scripts provided in the `type2-runtime` repository,
however the Dockerfile they use for building is replaced by a copy with
pinned package versions to prevent issues with reproducibility.

This should fix the issue of missing libfuse2 which users of the appimage
have on "modern" distributions.
The new `type2-runtime` is statically linked and includes the required
dependencies now instead of relying on the host to provide it.

93/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
AI analysis · Low 29/100

This commit updates Electrum's Linux AppImage packaging scripts. It swaps an old, discontinued AppImage build tool for a newer one, and builds the AppImage runtime from source instead of downloading a pre-built binary from the internet. The goal is to make builds more reproducible and fix a missing system-library problem on newer Linux distributions. There is no direct evidence in the commit of a security vulnerability being patched; it is primarily a build-hygiene and reliability change.

Lower-prioritycontrib/make_download: invert GPG name trickeryby SomberNight · db43e0c7 · Aug 12, 2025 · 1 fileMessage 68 · AdequateInformational 18Details
Commit message · SomberNight

contrib/make_download: invert GPG name trickery

if I ran the script with the *.sombernight_releasekey.asc sigs present in dist/,
"SomberNight" and "sombernight_releasekey" were both included as signers

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 18/100

This commit fixes a small script that builds Electrum's download webpage. Previously, the script could list the same person twice under slightly different names if certain signature files were present. The change makes the script consistently use the key file name internally while still showing the friendly display name to users. It is a cosmetic/integrity cleanup, not a fix for an exploitable vulnerability.

Security candidatefix: wizard: qml: call checkIfLast in WCHaveSeedby f321x · e6f73522 · Aug 11, 2025 · 1 fileMessage 100 · StrongInformational 22Details
Commit message · f321x

fix: wizard: qml: call checkIfLast in WCHaveSeed

When the user has already loaded a wallet in QML and tries to restore a
new wallet `WCHaveSeed.qml` incorrectly shows a `Finish` button instead
of a `Next` button and raises a KeyError if the user clicks on Finish
instead of resolving the passphrase input view (regression from
https://github.com/spesmilo/electrum/pull/10016).

This happens because `last` of `have_seed` depends on
`NewWalletWizard.is_single_password()` and NewWalletWizard.wants_ext(wizard_data).
`is_single_password()` is true if a wallet is already loaded,
while `wants_ext(wizard_data)` is false as `wants_ext()` depends on `seed_extend: True` in
`wizard_data` which only gets set after `apply()` of `WCHaveSeed` gets
called, however the evaluation of `WCHaveSeed` being the last view
happens before the view is shown.
By calling `checkIsLast()` in the validation timer of `WCHaveSeed` the
`last` property gets set again after `apply()` has been called, so
the view is guaranteed to correctly show either the `Finish` or `Next` button
after a seed has been entered.

100/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
access controlseed or entropy path
AI analysis · Informational 22/100

This is a small UI bug fix in Electrum's mobile-style (QML) wallet setup wizard. When restoring a wallet from a seed phrase while another wallet was already open, the wizard wrongly showed a 'Finish' button instead of 'Next'. Clicking it could trigger a crash (KeyError). The fix makes the wizard recalculate which button to show after the seed details are processed. It is not a security vulnerability in the cryptographic sense, just a user-experience regression that could confuse or crash the app.

AI review queuedtests: set low wallet.gap_limit_for_change to speed up testsby SomberNight · 4f1cc8b9 · Aug 8, 2025 · 9 filesMessage 60 · AdequateInformational 15Details
Commit message · SomberNight

tests: set low wallet.gap_limit_for_change to speed up tests

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes the test suite of the Electrum Bitcoin wallet. It introduces a helper function that creates test wallets with smaller 'gap limits' (fewer pre-generated addresses) so unit tests run faster. There is no change to the actual wallet software that end users run, and nothing in the commit affects real funds, transaction signing, or network security.

AI review queuedwallet: follow-up prev: always set wallet.gap_limit_for_changeby SomberNight · 4800a2d9 · Aug 8, 2025 · 1 fileMessage 50 · ThinLow 33Details
Commit message · SomberNight

wallet: follow-up prev: always set wallet.gap_limit_for_change

even for Imported_Wallet

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 33/100

This commit fixes a crash or incorrect behavior in Electrum wallets when creating change addresses. Previously, the code assumed every wallet had a numeric 'gap_limit_for_change' setting, but imported wallets did not set one, leaving it as None. When the code tried to use that None value as a number, it could fail. The patch gives all wallets a default value and safely falls back to zero if it is still unset, ensuring imported wallets can create change outputs without crashing.

AI review queuedwallet: make gap limit for change configurableby Filiprogrammer · 3e8af981 · Aug 8, 2025 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · Filiprogrammer

wallet: make gap limit for change configurable

Add the ability to configure the gap limit for change addresses while
retaining that value in the wallet database.

----

extracted from https://github.com/spesmilo/electrum/pull/8726

Co-authored-by: SomberNight <somber.night@protonmail.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a user-configurable setting for how many unused 'change' addresses Electrum keeps ready in a wallet, and stores that setting in the wallet file. It is a routine feature addition with no security relevance visible in the code or commit message.

AI review queuedwallet: refactor get_change_addresses_for_new_transactionby SomberNight · 302ee244 · Aug 8, 2025 · 1 fileMessage 40 · ThinInformational 12Details
Commit message · SomberNight

wallet: refactor get_change_addresses_for_new_transaction

40/100 · ThinMessage clarity
✓ Specific, descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit is a straightforward code cleanup: it extracts a repeated block of address-selection logic into a new helper method and reuses it in two places. There is no indication of a security fix, behavior change, or vulnerability being patched.

Lower-prioritytests: interface: more aggressive clean-upby SomberNight · 98c4c970 · Aug 8, 2025 · 2 filesMessage 55 · ThinInformational 15Details
Commit message · SomberNight

tests: interface: more aggressive clean-up

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes test files to clean up network connections more thoroughly after unit tests finish. It does not affect the actual Electrum wallet software that users run, and there is no security issue being fixed here.

Lower-prioritytests: don't block forever if a prior unit test raised during setUpby SomberNight · cd8bbcd2 · Aug 8, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · SomberNight

tests: don't block forever if a prior unit test raised during setUp

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This is a test-only change that prevents unit tests from hanging forever if an earlier test crashes during setup. It adds a short timeout to a test lock and raises a clear error instead of blocking indefinitely. It does not affect the Electrum wallet software that users run.

Lower-priorityinterface: don't request same tx from server that we just broadcast to itby SomberNight · 05da5017 · Aug 8, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · SomberNight

interface: don't request same tx from server that we just broadcast to it

Often when the wallet creates a tx, the flow is:
- create unsigned tx
- sign tx
- broadcast tx, but don't save it in history
- server sends notification that status of a subscribed address changed
- client calls scripthash.get_history
- client sees txid in scripthash.get_history response
- client calls blockchain.transaction.get to request missing tx

Instead, now when we broadcast a tx on an interface, we cache that tx *for that interface*,
and just before calling blockchain.transaction.get, we lookup in the cache.
Hence this will often save a network request.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This change is a performance optimization, not a security fix. Electrum used to ask a server for transaction details even when it had just sent that same transaction to the server moments earlier. Now it remembers the transaction locally for that server connection, avoiding an unnecessary network request. There is no security problem being fixed here.

AI review queuedlrucache: add type hintsby SomberNight · 427b0d42 · Aug 8, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · SomberNight

lrucache: add type hints

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds Python type hints to a cache utility file. It does not change any actual program behavior, logic, or security controls. There is no security issue here.

Lower-priorityadd "lrucache" module, extracted from the 3rd-party tkem/cachetools libraryby SomberNight · 138e2f6b · Aug 8, 2025 · 1 fileMessage 81 · StrongInformational 15Details
Commit message · SomberNight

add "lrucache" module, extracted from the 3rd-party tkem/cachetools library

functools.lru_cache in the stdlib is not generic enough. That can be used to cache the results of a single pure function,
however I have usecases where one function is supposed to populate the cache, while another function consumes it.
https://docs.python.org/3/library/functools.html#functools.lru_cache

This is stripped down and extracts just the LRUCache from tkem/cachetools. It is relatively short, and very mature code.
I don't expect that we have to "follow" upstream, etc. There likely won't be relevant changes upstream.
Effectively, we are forking and bundling this code.

similar to https://github.com/spesmilo/electrumx/commit/04582cc353b45721e2461176cfce1768003dd5ae

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100

This commit adds a new internal helper module that provides a simple least-recently-used (LRU) cache. It is a copy of well-known, mature third-party code with no user-facing behavior changes. There is no indication this introduces a security problem.