Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit updates Electrum's internal CI (continuous integration) script that runs an automated security review using Anthropic's Claude Code tool. It changes the AI model version used for reviews from 'claude-opus-5' to 'claude-opus-5-5…
CI hardening: detects and reports AI model downgrades during automated security reviewNo changes to application code, cryptography, network protocol, or build artifactsNo privilege escalation, injection, or data-exfiltration vectors introduced by the diff
This commit updates Electrum's own CI security-review script. It adds detection and warnings when the automated code reviewer (Claude Code) silently falls back to a different AI model, for example after a content-policy refusal. It does no…
CI-only changeNo modification of wallet, crypto, networking, or build artifactsAdds detection for AI model fallback/downgrade in automated security review
This commit fixes a bug where Electrum failed to recognize certain already-signed Bitcoin transactions as complete. Specifically, for native SegWit inputs, Bitcoin Core can produce a finalized PSBT with a valid witness but an empty scriptS…
Logic error in transaction completeness detectionNative SegWit witness handling edge casePSBT interoperability issue with Bitcoin Core
This commit fixes a bug where Electrum incorrectly treated finalized Bitcoin transactions as incomplete. Some wallet software (like Bitcoin Core and Sparrow) creates native SegWit transactions that omit an empty placeholder field Electrum …
Logic error in transaction completeness detectionPotential denial of service / user funds stuck due to refusal to broadcast valid finalized transactionInteroperability failure with Bitcoin Core and Sparrow PSBT output
This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…
Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
This commit only adds a long code comment explaining a design choice in Electrum's PSBT-over-Nostr plugin. It does not change any program behavior. The comment documents that the plugin derives each cosigner's Nostr secret key from their B…
Documentation-only changeExplicit design tradeoff disclosure: cosigners can derive each other's Nostr secret keys from shared xpubsNo functional code change
This is a one-line bugfix in Electrum's transaction handling. Previously, the code accidentally swallowed (hid) almost all exceptions when fetching extra transaction data from the network, only re-raising errors that were both network-rela…
This commit fixes several bugs in Electrum's handling of BOLT11 Lightning invoices. The most user-visible fixes are: stricter validation of invoice amounts (rejecting zero, negative, sub-millisatoshi, and leading-zero amounts), correct pad…
Stricter BOLT11 amount validation prevents acceptance of zero, negative, sub-millisatoshi, and leading-zero amountsFixed int_to_data5 padding bug that corrupted small timestamp values during invoice round-tripMalformed 'r' routing tags now raise exceptions instead of being silently skipped
Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silent…
Swallowed exception leading to use of attacker-controlled input valuePSBT input consistency check bypassedPotential malicious Electrum server influence on transaction signing
This is a small code cleanup change. A function that reads routing hints from Lightning invoices no longer takes a tag argument because only one type of routing hint ('r') is now supported. All callers are updated accordingly. There is no …
This commit tightens how Electrum parses Bitcoin payment requests (BOLT11 lightning invoices and BIP21 URIs). It turns previously uncaught internal errors into proper validation failures, rejects malformed invoice fields that used to be si…
Stricter input validation for externally supplied BOLT11 invoices and BIP21 URIsPreviously uncaught exceptions (ValueError, UnicodeDecodeError, ecc errors) are now wrapped in domain-specific decode exceptionsMalformed fallback addresses are skipped rather than aborting or crashing
This commit tightens how Electrum parses BOLT11 Lightning invoices. It now rejects duplicate 'n' (node pubkey) tags instead of silently keeping only the first one, and it rejects invoice timestamps that are negative or too far in the futur…
Stricter validation of invoice timestamp boundsDuplicate 'n' tag now raises an exception instead of being silently droppedFollow-up to prior PR #10940, indicating a recent area of security-sensitive review
This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…
Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…
Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
This commit only adds new Bitcoin block header checkpoints to Electrum's built-in chain data files. Checkpoints are hardcoded reference points that help the wallet verify it is following the real blockchain and not a fake one. Updating the…
Hardcoded blockchain checkpoints extended for all supported networksNo executable code or cryptographic logic changedNo bug fix, privilege change, or input validation change present
This commit simply refreshes Electrum's built-in list of Bitcoin blockchain checkpoints. Checkpoints are known-good block hashes that help the wallet verify it is following the real chain. The update adds newer checkpoints for mainnet, sig…
This commit fixes cases where Electrum's wallet cache could hold onto outdated information about coins and transactions after blockchain reorganizations or mempool changes. For example, if a transaction was previously thought to be mined b…
stale cached state after reorg/mempool evictionincorrect confirmation metadata displayed to userscache invalidation added at multiple state transitions
This commit is a simple code cleanup: it replaces two repeated lines that set a transaction input's block height and position with a single helper method called set_mined_info. There is no change in behavior, no bug fix, and no security re…
This is a small internal code cleanup in the Electrum Bitcoin wallet. It moves the logic that builds a compact transaction identifier (like '123x4') into one shared helper method, and removes a duplicate helper class. There is no user-faci…
This commit changes how the Electrum AppImage build container first obtains trusted web certificates. Because the build's pinned Debian package sources use HTTPS, the container needs certificates before it can talk to them. The old method …
build pipeline changetemporary downgrade from HTTPS to HTTP for package bootstrappackage integrity still protected by apt GPG signatures
During synchronization, new_transaction fires for every incoming tx and each balanceChanged emit makes QML recompute the balance on the GUI thread. The balance isn't shown anyway during sync.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This commit is a performance optimization for Electrum's mobile/QML user interface. It prevents the wallet balance from being recalculated and redrawn on every incoming transaction during synchronization, because the balance isn't shown during sync anyway. It is not a security fix and does not change how transactions are validated or stored.
Add a txid -> model row index dict to `QETransactionListModel` instead of re-iterating the `tx_history` list on each event to find the tx item. This noticeably unblocks the UI during sync of a large wallet.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100
This commit is a performance improvement for the Electrum mobile/QML wallet. It replaces repeated scanning of the transaction history list with a simple dictionary lookup (txid -> row index). There is no security-relevant change visible in the diff.
not sure why this was not an issue before(?) perhaps due to python version differences ``` $ ./contrib/make_download /home/user/wspace/electrum-web Traceback (most recent call last): File "/home/user/wspace/electrum/./contrib/make_download", line 17, in <module> version_spec = importlib.util.spec_from_file_location('version', 'electrum/version.py') ^^^^^^^^^^^^^^ AttributeError: module 'importlib' has no attribute 'util' ```
This is a trivial bug fix in a helper script used to build Electrum's download web page. The script was missing an import statement needed to access a Python utility module. Without the import, the script crashed immediately with an AttributeError. The change adds the missing import and has no security relevance.
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This commit tweaks the Android on-screen keyboard behavior in Electrum's QML wallet search screen. It sets the Enter key to 'Done' and hides the 'Create Wallet' button while the user is typing a search. There is no clear security problem here; it appears to be a minor user-interface fix to prevent accidental wallet creation while searching.
Lower-priorityrelease notes: bump 4.8.0 date for second attemptby SomberNight · 8c0adcda · Jul 8, 2026 · 1 fileMessage 76 · AdequateInformational 15Details
Commit message · SomberNight
release notes: bump 4.8.0 date for second attempt
We failed to get a full quorum to reproduce the prior git tag. The android apks were problematic to reproducibly build. should be fixed by https://github.com/spesmilo/electrum/pull/10739
here we go again
76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100
This commit only changes a release date in the RELEASE-NOTES file from July 2, 2026 to July 8, 2026. It is a documentation-only update explaining that the previous release attempt did not achieve full reproducible-build quorum, particularly for Android APKs. There are no code changes and no security fix or vulnerability introduced in this commit.
android build: cache p4a recipe downloads even for FRESH_CLONE builds
I propose we cache some downloads even for "fresh clone" builds (that have `ELECBUILD_COMMIT` env var set), with an opt-out reusing the existing `ELECBUILD_NOCACHE` env var. Currently `ELECBUILD_NOCACHE` only opts-out from the docker build cache, now I would reuse it for p4a recipe downloads.
`qt-everywhere-src-6.10.2.tar.xz` [0] is 1.3 GiB, and we download it twice per arch. (once for the qt6 recipe, once for the hostqt6 recipe) It seems to me, download.qt.io is heavily rate-limiting downloads from some IPs.
When doing a release, we build 3 archs, so we download Qt six times. With this patch, we would only download it twice. (note: I see no need to have separate caches per arch atm.)
Also, when doing multiple builds to debug reproducibility, with this patch, only the first attempt needs to download Qt (twice). Subsequent attempts hit the cache.
---
note: the git tag is part of the cache key out of cache-staleness paranoia. It is not the full commit though, as that would kill the reproducibility-debugging use case.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 15/100
This change is a build-system optimization for Electrum's Android release builds. It caches large Qt source downloads between builds so they are not repeatedly downloaded from the internet. There is no security vulnerability here.
android build: patch hostpython3 to not install setuptools
Add a patch to the hostpython3 p4a recipe to prevent it from installing setuptools as part of the ensurepip invocation. Setuptools is later installed from a hash-pinned recipe.
---
NOTE(ghost43): this is a workaround for reproducible-build issues we ran into during the 4.8.0 release. see https://github.com/spesmilo/electrum/pull/10739#issuecomment-4904680121
Since the last p4a rebase, p4a is installing some python packages using "pip install --target". We noticed that hostpython had two different versions of setuptools installed at the same time (two dist-info folders in site-packages/). This is due to the `--target` option for `pip install`. We are calling it with `--upgrade` too, but even then apparently it does not remove old versions. Indeed, when testing locally in a venv it leaves all .dist-infos there hanging. According to https://github.com/pypa/pip/issues/13763#issuecomment-3783977222, `--target` is not suitable or intended for this usecase at all.
Current patch is only focused on setuptools, as a minimal workaround. Ultimately the same issue could arise with any other package. For example, still with ensurepip itself, we could be left with multiple versions of pip installed. Or anything we install via hostpython_prerequisites could have duplicate versions installed...
100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 18/100
This change adjusts how the Electrum Android app is built so that the build process installs only one specific, checked version of a helper library called setuptools, instead of accidentally ending up with two copies. Having two copies could make builds unpredictable from one run to the next. The patch itself is a build-hygiene fix aimed at reproducibility, not a direct fix for an active security flaw.
build: move default FRESH_CLONE location from /tmp to /var/tmp
Apparently many distros these days mount /tmp as RAM-disk. Even debian (starting with 13) does this now. The Android build needs to store dozens of gigs, so RAM is often not sufficiently large.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit simply changes the default temporary directory used during Electrum's build process from /tmp to /var/tmp. The reason is practical: many Linux distributions now put /tmp in memory (RAM disk), and the Android build needs to store tens of gigabytes, which can exceed available RAM. This is a build reliability change, not a security fix.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 29/100
This commit adds a search box to Electrum's mobile-style QML wallet list. It also changes how 'hidden' wallets (those whose filenames begin with a dot) are handled: previously they were blocked entirely, now they are allowed but kept out of the normal list. A user can load a hidden wallet only by typing its exact name into the search box. The change appears to be a deliberate feature, not a fix for an active security bug, but it slightly widens what wallet files the GUI will load.
android build: forbid buildozer to install unversioned deps of p4a
While p4a itself does not need ninja in our usage, to build Qt6, we need ninja. However instead of installing it from PyPI, I think debian main is much more trustworthy.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 20/100
This commit tightens the Android build process for the Electrum Bitcoin wallet. It stops an automated build tool (buildozer) from silently downloading unversioned Python helper packages, and instead installs the 'ninja' build tool from the more carefully reviewed Debian software repository. The change reduces the risk that a compromised or malicious helper package could sneak into the Android app build, but it is a hardening improvement rather than a fix for an active attack.
android build: build p4a recipes with --no-isolation
the core change is https://github.com/spesmilo/python-for-android/commit/8c0fcc9ef2e559918ca96ecde6e09fe521bb1427 the rest here just follow that
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 16/100
This commit updates the Android build system for the Electrum Bitcoin wallet. It changes which version of a build tool (python-for-android) is used and adjusts the exact pinned versions of helper Python packages used during the build. The changes are about making the build process more reproducible and compatible with newer packaging tools, not about fixing a vulnerability in the wallet app itself. There is no direct evidence in the commit that this fixes a security flaw.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 20/100
This commit only updates release notes and documentation to state that Electrum's Android app now requires Android 8.0 instead of Android 6.0. There are no code changes, no bug fixes, and no security patches in the diff.
AI review queuedhw_wallet: fix crash on exit if device unpairing failsby Sasha Zykov · b0ae14a5 · Jul 3, 2026 · 2 filesMessage 73 · AdequateLow 29Details
Commit message · Sasha Zykov
hw_wallet: fix crash on exit if device unpairing fails
On wallet close, the close_wallet hook unpaired the device before stopping the keystore TaskThread. Unpairing does device I/O and can raise, e.g. if the device was unplugged while the wallet was open:
Plugin error. plugin: trezor, hook: close_wallet Traceback (most recent call last): File "electrum/plugin.py", line 833, in run_hook r = f(*args) File "electrum/hw_wallet/plugin.py", line 89, in close_wallet self.device_manager().unpair_pairing_code(keystore.pairing_code()) File "electrum/plugin.py", line 1118, in unpair_pairing_code self._close_client(_id) File "electrum/plugin.py", line 1134, in _close_client client.close() ... File "electrum/plugins/trezor/clientbase.py", line 286, in close self.client.lock() ... trezorlib.transport.bridge.BridgeException: trezord: acquire/62/null failed with code 400: device not found
run_hook() swallows the exception, so the thread was never stopped. A still-running QThread (child of the wallet window) at interpreter shutdown then makes Qt abort the process:
QThread: Destroyed while thread '' is still running
Stop the thread before unpairing, and make DeviceMgr._close_client treat client.close() as best-effort, as closing a missing device is a normal condition during cleanup.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 29/100
This commit fixes a crash that could happen when closing an Electrum wallet that uses a hardware device (like a Trezor). If the device was unplugged before closing, the wallet's cleanup step could fail and leave a background Qt thread running. At shutdown, Qt would then forcefully abort the whole program. The fix stops the thread first and treats device-close failures as harmless during cleanup.
Lower-priorityqml: add myself to About pageby f321x · d24c91e8 · Jul 2, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · f321x
qml: add myself to About page
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply adds a person's name to the About page in Electrum's QML (mobile-style) user interface. It is a routine contributor-credit update with no security relevance.
This commit is a routine update to Electrum's language translation files (locale). It changes one line in one translation file. There is no indication of any security relevance.
util.make_aiohttp_session: wrap aiohttp-socks 0.11+ excs to ClientError
older versions of aiohttp-socks and python-socks used to raise - ProxyConnectionError(OSError) - ProxyTimeoutError(TimeoutError) - ProxyError(Exception)
now they raise: - ProxyConnectionError(Exception) - ProxyTimeoutError(Exception) - ProxyError(Exception)
In many call sites, we currently handle OSError and TimeoutError, usually by simply logging the error or showing it to the user. Another exceptions our call sites handle similarly is aiohttp.ClientError, which is the aiohttp base class for any client connection error.
A simple "fix" for us to restore the old behaviour is converting the new aiohttp_socks exception types to aiohttp.ClientError.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 37/100
This commit fixes a compatibility issue with newer versions of a proxy library used by Electrum. The newer library changed which error types it raises when proxy connections fail. Because Electrum's code was written to catch the old error types, unexpected proxy errors could slip through, potentially causing crashes or confusing error messages instead of being handled gracefully. The fix converts the new proxy errors into a standard network error type that Electrum already knows how to handle.
Lower-priorityqetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.by Sander van Grieken · 11155fdf · Jul 2, 2026 · 1 fileMessage 58 · ThinLow 36Details
Commit message · Sander van Grieken
qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.
fixes #10714
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
AI analysis · Low 36/100
This commit fixes a crash in Electrum's mobile/QML fee slider. When a user typed a fee rate that the input regex allowed but Python's Decimal parser rejected, the app would crash with an 'InvalidOperation' exception instead of gracefully falling back to zero. The fix catches that exception and treats the bad value as 0, preventing the app from freezing or closing unexpectedly.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply changes a version number string from 4.7.2 to 4.8.0 in a single file. It does not modify any security-related code, fix any bug, or change any behavior of the Electrum wallet software. There is no security issue here.
Lower-priorityadd release notes for version 4.8.0by f321x · 78e2fcc7 · Jul 2, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · f321x
add release notes for version 4.8.0
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit only adds the written release notes for Electrum version 4.8.0. It is documentation: it lists what changed in the new version, including one security fix, but it does not change any program code. By itself, this commit does not introduce or fix a vulnerability in the software.
wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran
Sighash warnings/errors might in theory not be triggered for inputs owned by the wallet but which are beyond the gap limit. tx.add_info_from_wallet(wallet) side-effects the wallet state so that wallet.is_mine() learns derivation paths for beyond-gap-limit addresses.
In practice both GUIs currently call tx.add_info_from_wallet before check_sighash runs, so this was not exploitable.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
explicit security languagesigning or wallet path
AI analysis · Low 42/100
This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was that this safety check could be skipped for wallet addresses that were beyond the user's configured gap limit, because the wallet had not yet learned those addresses belonged to it. The fix makes the check self-contained by first asking the transaction to teach the wallet about any relevant addresses, using a copy so the original transaction is not changed. The commit message says the current graphical interfaces already performed this step, so the bug was not exploitable in practice through normal use.
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply adds newer Bitcoin block checkpoints to Electrum's built-in chain data files. Checkpoints are pre-recorded block hashes that help the wallet verify it is following the correct blockchain. There is no code change and no indication of a security vulnerability.
cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 diff --git a/contrib/requirements/requirements-binaries.txt b/contrib/requirements/requirements-binaries.txt index b41089680..5771aef24 100644 --- a/contrib/requirements/requirements-binaries.txt +++ b/contrib/requirements/requirements-binaries.txt @@ -3,3 +3,12 @@ PyQt6 # we need at least cryptography>=2.1 for electrum.crypto, # and at least cryptography>=2.6 for dnspython[DNSSEC] cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +PyQt6==6.9.1 diff --git a/contrib/requirements/requirements-build-android.txt b/contrib/requirements/requirements-build-android.txt index e9d272837..4bf6cc1fc 100644 --- a/contrib/requirements/requirements-build-android.txt +++ b/contrib/requirements/requirements-build-android.txt @@ -20,3 +20,10 @@ toml # needed for the Qt/QML Android GUI: # TODO double-check this typing-extensions + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +sh==2.2.2 diff --git a/contrib/requirements/requirements-build-appimage.txt b/contrib/requirements/requirements-build-appimage.txt index ee8b4aa89..d79cd93b6 100644 --- a/contrib/requirements/requirements-build-appimage.txt +++ b/contrib/requirements/requirements-build-appimage.txt @@ -7,4 +7,11 @@ wheel # The pinned Cython must be installed before hidapi is built; # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 -Cython>=0.27 \ No newline at end of file +Cython>=0.27 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 diff --git a/contrib/requirements/requirements-build-base.txt b/contrib/requirements/requirements-build-base.txt index 5bfea96fe..6cc7d303c 100644 --- a/contrib/requirements/requirements-build-base.txt +++ b/contrib/requirements/requirements-build-base.txt @@ -28,3 +28,12 @@ flit_core>=3.4,<4 # aio-libs/frozenlist and aio-libs/propcache needs: # https://github.com/aio-libs/frozenlist/blob/c28f32d6816ca0fa56a5876e84831c46084bb85d/pyproject.toml#L6 expandvars + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 +setuptools-scm<9 + +expandvars==1.0.0 +poetry-core==2.1.3 diff --git a/contrib/requirements/requirements-build-mac.txt b/contrib/requirements/requirements-build-mac.txt index 5504223d3..583c91170 100644 --- a/contrib/requirements/requirements-build-mac.txt +++ b/contrib/requirements/requirements-build-mac.txt @@ -15,3 +15,12 @@ packaging>=22.0 # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 Cython>=0.27 + + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-build-wine.txt b/contrib/requirements/requirements-build-wine.txt index 80cccba33..647a90acb 100644 --- a/contrib/requirements/requirements-build-wine.txt +++ b/contrib/requirements/requirements-build-wine.txt @@ -9,3 +9,10 @@ altgraph pywin32-ctypes>=0.2.1 pyinstaller-hooks-contrib>=2025.2 packaging>=22.0 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-hw.txt b/contrib/requirements/requirements-hw.txt index 5dfb0290e..3c4955eb6 100644 --- a/contrib/requirements/requirements-hw.txt +++ b/contrib/requirements/requirements-hw.txt @@ -30,3 +30,13 @@ pyserial>=3.5.0,<4.0.0 # prefer older urllib3 to avoid needing hatchling # (pulled in via trezor -> requests -> urllib3) urllib3<2 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +libusb1<3.4 +protobuf==3.20.3 diff --git a/contrib/requirements/requirements.txt b/contrib/requirements/requirements.txt index e9963c12c..da9ab8cde 100644 --- a/contrib/requirements/requirements.txt +++ b/contrib/requirements/requirements.txt @@ -18,3 +18,15 @@ attrs>=20.1.0,<23 # - upper limit to avoid needing hatchling at build-time :/ # (however newer versions should work at runtime) dnspython>=2.2,<2.5 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +aiohappyeyeballs<2.7 +jsonpatch==1.33 +jsonpointer==3.0.0 +propcache==0.3.1 +protobuf==3.20.3 +python-socks==2.8.1 ```
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discount
AI analysis · Low 36/100
This commit updates Electrum's frozen dependency lists to newer versions of many Python packages used to build and run the wallet. The author describes it as 'somewhat conservative and paranoid.' It is a routine dependency refresh, not a code fix for a known vulnerability. Updating pinned dependencies can improve security by moving to newer, patched versions, but the commit itself does not describe any specific security issue, and a large dependency bump always carries some risk of introducing new bugs or build problems.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 47/100
This commit updates the version of OpenSSL used when building the Electrum Android app from 3.0.18 to 3.0.21, along with the matching cryptographic fingerprint (SHA-512 hash). OpenSSL is a widely used library that provides encrypted connections. Newer patch releases typically fix security bugs in the older version, so this is likely a routine dependency update to address known vulnerabilities in OpenSSL 3.0.18. However, the commit message does not say which specific bugs are being fixed, and no separate security advisory was supplied.
note: 3.12 is in security-only status, so can't bump win/mac binaries without switching to 3.13 (as we don't compile our own cpython for those) we should bump those to at least 3.13...
85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
AI analysis · Informational 19/100
This commit updates the Python versions used to build Electrum's Android, Linux AppImage, and host Python components. It moves Android and host Python from 3.11.14 to 3.11.15, and the Linux AppImage from 3.12.11 to 3.12.13. It also switches Android builds to download Python from the official python.org source instead of GitHub auto-generated archives. The commit message notes that Python 3.12 is now in 'security-only' status and Windows/Mac binaries should ideally move to 3.13. This is a routine maintenance/security-hardening build change, not a fix for an active exploit.
AI review queuedqt: fix crash through stale pi resolveby f321x · 299be410 · Jul 1, 2026 · 1 fileMessage 76 · AdequateInformational 24Details
Commit message · f321x
qt: fix crash through stale pi resolve
When multiple PIs get resolved consecutively through repeated editing of the PI field, and the `on_resolve_done` callback tries to access a PI that has been cleared by a previous, failed callback an exception is raised.
I was able to reproduce this somehow by adding a sleep to `PaymentIdentifier._do_resolve()` and entering lightning addresses.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 24/100
This commit fixes a bug in Electrum's Qt send tab where the app could crash if a user edited the payment recipient field quickly while previous lookups were still finishing. The fix ignores results from outdated lookups instead of letting them trigger an error.
