Electrum

This commit is a routine update to Electrum's language translation files (locale). It changes one line in one translation file. There is no indication of any security relevance.

This commit simply adds newer Bitcoin block checkpoints to Electrum's built-in chain data files. Checkpoints are pre-recorded block hashes that help the wallet verify it is following the correct blockchain. There is no code change and no indication of a security vulnerability.

This commit fixes a bug in Electrum's Qt send tab where the app could crash if a user edited the payment recipient field quickly while previous lookups were still finishing. The fix ignores results from outdated lookups instead of letting them trigger an error.

This commit only updates a stale code comment to match a recent variable rename and to correctly describe what the function now does. No actual code behavior was changed, so there is no security impact.

This commit is a cleanup of a previous change that added a cache for paid invoices. The developer admits the earlier code was sloppy ('arghhhhhh'). The patch removes redundant logic that tried to update the paid-invoice cache in multiple places and instead lets a single method, get_invoice_status, decide whether an invoice is paid. The risk is that if the cache is not updated correctly, Electrum might wrongly report an invoice as paid or unpaid, which could mislead users or merchants about whether money was actually received. There is no direct evidence this is exploitable by an attacker, but it is a correctness fix in payment handling.

This is a small internal cleanup commit for the Electrum Bitcoin wallet. It renames an in-memory cache used to remember which outgoing invoices have been paid, moves where the cache is initialized, simplifies some related logic, and makes sure the cache is also updated when a transaction is removed. There is no indication this fixes a security vulnerability or introduces a new security risk.

This commit adds a type check to ensure a transaction fee value coming from an external server is either a valid whole number or absent. Without the check, an unexpected type (such as a string or special object) could later cause errors or unusual behavior inside the wallet when it stores or compares fee data. The change is defensive and narrows the range of bad inputs the wallet will accept.

This commit fixes a bookkeeping bug in Electrum's mobile/QML wallet interface. When a wallet object is destroyed, it was not being removed from an internal list that tracks all active wallet objects. The commit adds that cleanup step. The commit message says this bug never caused visible problems because the mobile app currently has no way to unload or close a wallet, so the fix is preventive.

This commit adds a basic sanity check to Electrum's code that reads the built-in list of default servers (servers.json). Previously, if a user edited that JSON file incorrectly, the bad data would travel deeper into the program and cause a confusing crash later. Now the code checks early that each server entry is a dictionary and that all values inside it are strings, failing fast with a clearer error message. It is a hardening/quality improvement, not a fix for an externally exploitable vulnerability.

This commit only adds a new test file and a unit test for BOLT 12 merkle root calculation. It does not change any production code, so it cannot introduce a security vulnerability or fix one. It is purely a test-suite addition.

This commit is a performance optimization, not a security fix. It adds an in-memory cache of which outgoing invoices are already paid, so Electrum can skip expensive re-scanning of previous transaction outputs when many invoices share the same Bitcoin address. The goal is to stop the user interface from freezing for seconds or minutes when broadcasting a transaction. There is no indication this change fixes a vulnerability or changes security-critical behavior beyond making status lookups faster.

This commit is a simple code cleanup: it moves two definitions (a storage encryption version enum and a read/write error exception) from one file to another and updates the import statements in the files that use them. There is no functional change, no bug fix, and no security relevance.

This commit is a simple internal code cleanup. It adds a new helper method called get_path() to the wallet storage class and updates various parts of the program to use that method instead of reading the storage path directly. There is no security fix or vulnerability here.

This commit adds a check so that if a Lightning channel is funded by a coinbase transaction (newly created bitcoins from mining), Electrum waits for the standard 100-block maturity period before treating the funding as settled. Before this change, Electrum might have accepted an immature coinbase funding transaction too early, which could lead to an invalid channel state or forced channel closure if the coinbase output later becomes invalid or reorganized. The fix follows a recent update to the Lightning protocol specification.

This commit changes how Electrum tracks where certain data objects live in the wallet database. It switches from short names like 'invoices/*' to full paths like '/invoices/*', and updates the internal registry to handle these full paths. The stated goal is to prevent naming collisions and to enable future performance improvements. There is no direct evidence in the commit that this fixes an active security vulnerability, but path-collision bugs in serialization code can sometimes lead to wrong data being read or written, which could have security implications.

This is a small code cleanup in Electrum's transaction handling. It simplifies how raw transaction bytes are converted to hex strings. There is no obvious security bug being fixed here; it appears to be a follow-up simplification to a previous change.

This change is a performance optimization, not a security fix. It makes whitespace removal from transaction data optional, skipping it when loading transactions from the wallet's own stored files. The default behavior for user-provided input still removes whitespace. There is no direct security issue in the patch itself, though any future code that calls tx_from_any with untrusted input must remember to leave sanitization enabled.

This commit only changes unit tests. It removes the practice of mocking (faking) the wallet save function and instead creates in-memory wallets that don't touch disk. There is no change to the actual Electrum wallet application or its security behavior.

This commit is a simple code cleanup in the project's test suite. It moves a helper function used to create fake Lightning payment channels from one test file into a shared test-utility file, and updates other test files to import it from the new location. No production wallet code is changed, and there is no security fix or vulnerability introduced.

This commit only adds new automated tests for an existing Lightning channel rebalancing feature in Electrum. It does not change any production wallet or network code, so it cannot introduce a security vulnerability or directly fix one.

This commit adds a background polling loop to Electrum's Lightning watcher so that time-sensitive callbacks still run even when no new blockchain events occur for a while. It is a defensive reliability fix, not an obvious security patch, but stale watcher callbacks could in theory delay detection of channel problems. The change itself does not introduce a known vulnerability.

This commit is a pure internal refactoring of how Electrum marks which Python classes correspond to which parts of the wallet database. It replaces two old decorators (`stored_in` and `stored_as`) with a single new decorator (`stored_at`) and updates the registration tables that convert database keys and values. There is no user-facing change, no new feature, and no obvious security fix or vulnerability introduced in the diff itself.

This commit changes Electrum's internal build tooling. It introduces 'ghost packages'—empty placeholder packages used only during the build process to satisfy dependency resolvers—so that certain unwanted dependencies can be excluded from final deterministic builds. The change also makes a helper script read package metadata from the local build environment instead of downloading it from PyPI. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a build-hygiene improvement.

This commit simply moves the StoredDict, StoredObject, StoredList, and related helper code from one file (json_db.py) into a brand-new file (stored_dict.py). It then updates other files to import from the new location. The commit message and the diff itself show no changes to how the code works—only where it lives. There is no security fix or vulnerability introduced here.

This commit fixes a bug where Electrum could write unencrypted private keys to disk while creating or restoring a wallet, even when the user asked for password protection. The change rearranges the wallet setup so that the keystore is encrypted before it is placed into the wallet database, and the database storage is encrypted before any writes happen. It also moves the address-import step to happen after the keystore is saved, reducing the chance of plaintext key material touching disk.