Krux

This commit only adds one line to the changelog file describing a previously merged feature. It does not change any code, configuration, or executable behavior. There is no security-relevant change in the diff itself.

This commit is purely a code-style cleanup. It removes an extra blank line and adjusts spacing around a comment so the code matches the project's formatting rules (the 'black' formatter). No behavior of the wallet software changes, and there is no security fix or vulnerability introduced.

This commit fixes a bug where the Krux device could not switch which physical pins it uses to talk to a printer. The change forces the hardware to reassign the printer's data pins (TX/RX) even if they were already mapped to something else. This is a functional bug fix rather than a clear security patch, but incorrect pin mapping could in theory cause a printer to misbehave or leak data on the wrong pins.

This change relaxes how Krux checks the 'internal key' used in Taproot multisig wallets. Previously it required the wallet to use a specific deterministic chain code derived from the other public keys; now it only checks that the internal key is the well-known NUMS (provably unspendable) public key and ignores the chain code. This makes Krux compatible with wallets like Coldcard and Nunchuck that use different chain-code conventions, but it removes a validation step that ensured the internal key was constructed in a specific reproducible way.

This commit only removes blank lines between import blocks in eight Python files. It is a code-formatting cleanup with no functional changes and no security relevance.

This is a routine developer maintenance commit that updates the Black code formatter from version 25 to version 26, refreshes the Poetry lockfile with newer versions of many development and documentation dependencies, and applies one tiny formatting change (removing a blank line) in a font conversion script. There is no indication of any security fix or vulnerability being addressed.

This commit changes how a build container downloads a third-party compiler toolchain. The old command tried to clone submodules in one step from the original binutils-gdb repository, which appears to be unavailable or moved. The new approach clones the main repository first, then redirects the submodule URL to an archived copy before initializing submodules. This is a build-fix change, not an obvious security patch, but it does alter which source code is pulled into the build environment.

This commit simply updates the project's Telegram support group link from an old group name to a new one across three documentation files. It does not change any code, security settings, or functionality.

This commit simply updates the project's Telegram support group link from one URL (t.me/SC_Krux) to another (t.me/KruxDIY) in three documentation files. It is a routine documentation change with no security relevance.

This commit changes how Krux handles wallet descriptors. Instead of requiring users to manually set wallet type (single-sig, multisig, miniscript), network (mainnet/testnet), and address format, Krux now reads these directly from the descriptor. It also removes the old feature that tried to guess these settings from raw xpubs, which could make unsafe assumptions. When a loaded descriptor doesn't match the currently configured wallet, Krux now shows a clear warning and asks the user whether to switch settings automatically. Overall this is a security-hardening and usability improvement, not an introduced vulnerability.

This commit only updates user documentation. It adds a footnote comparing Krux's camera-based mnemonic generation to an old system called Lavarand, and rewords some explanatory text about entropy quality indicators. No code, cryptography, or device behavior was changed.

This commit fixes a warning message that was being shown to users at the wrong time. The Krux device signs Bitcoin transactions using PSBT files. In rare cases, the device needs to fill in a missing 'fingerprint' (a short identifier for a wallet key) with zeros before signing. The warning 'Fingerprint unset in PSBT' was being displayed whenever this zero-fill happened, even when the wallet's own fingerprint was already zero. That meant users could see a confusing or misleading security warning in a legitimate situation. The change only shows the warning when the wallet actually has a non-zero fingerprint but the PSBT still needs zero filling. This is a user-interface and correctness fix, not a direct theft-of-funds vulnerability, but misleading warnings can train users to ignore real security alerts.

This commit is a documentation and simulator update. It swaps in a new macaw (arara) image for screenshots and QR-code simulation sequences, and adds one harmless mock method so the simulator can handle a camera lens-correction call. There is no security-relevant change.

This commit adds a new automated GitHub Actions check that enforces conventional commit message formatting (like 'feat:', 'fix:', 'ci:') for pull requests. It does not change any application code, cryptography, wallet logic, or user-facing behavior. There is no security relevance in the change itself.

This commit updates the project's Python dependency lock file to require urllib3 version 2.6.0 or newer. The commit message says this is a security fix for CVE-2025-66471, a vulnerability in the urllib3 library. urllib3 is used indirectly through other packages (requests and translate) and only in development tools, not in the main Krux firmware that runs on hardware wallets. The change itself is a routine dependency bump, not a code fix inside Krux.

This commit is a normal feature update for the Krux Bitcoin signing device. It adds the ability to detect QR codes that have inverted colors (black background with white QR code) and renames some internal camera-mode functions. There is no indication of a security vulnerability or malicious change in the code.

This commit fixes a display bug in Krux's Datum tool. When a user scanned a BIP39 mnemonic seed phrase from a QR code, the device received the words as a list but tried to show them as a single string, which could not render correctly. The fix joins the word list into a normal spaced sentence so the device can display it. There is no direct evidence this is a security vulnerability, only a UI/data-format bug.

This commit fixes a small bug in how Krux reads certain QR codes. Some QR codes carry raw binary data, and the code previously assumed the data would arrive as text. The fix converts binary data to text before passing it onward. This is a defensive correction that prevents a crash or misread when scanning a specific kind of QR code (binary-encoded Uniform Resource QR codes). There is no direct evidence in the commit that this is exploitable as a security attack.

This commit adjusts user-interface timing and sensitivity constants for the Krux hardware wallet: button debounce times are lowered, the allowed range for touch sensitivity is widened, and the swipe gesture threshold is reduced. These are usability/tuning changes, not security fixes. There is no indication in the commit or changelog that any vulnerability is being addressed.

This commit is a routine documentation update for the Krux project. It updates the website/docs to point users to a newer version of the Krux-Installer (v0.0.21 instead of v0.0.20), fixes some broken/typoed download links and file names, and reorganizes the macOS installation instructions. There is no code change and nothing in the commit suggests a security vulnerability or malicious behavior.

This is a one-line bug fix in Krux's QR code parser. A previous change accidentally broke Compact SeedQR support by trying to decode binary QR data as text before checking the format. The fix moves the decode step inside a try block so binary data is handled safely. There is no direct evidence this is a security vulnerability; it appears to be a functionality regression.

This commit fixes a shell script that sets the serial communication speed (baudrate) when flashing Krux firmware to certain hardware devices. Previously, the 'dock' device was missing from the list that should use a 1.5 Mbps baudrate, which could cause flashing to fail or be unreliable for that device. There is no security vulnerability here—it's a device compatibility/operational bug fix.

This commit fixes two typos in user-facing documentation. The instructions for verifying a downloaded file incorrectly included '.txt' in the filenames of the signature and checksum files. The patch removes '.txt' so the commands match the actual filenames produced by the project. There is no code change and no security vulnerability.

This commit fixes two typos in the user documentation for verifying a downloaded Krux installer. The instructions previously told users to run commands with an extra '.txt' in the filename, which would have caused the commands to fail because the actual signature and checksum files do not include '.txt'. This is a documentation-only correction with no code changes.

This commit only updates user documentation for the Krux installer. It removes per-platform verification instructions and replaces them with a single new page explaining how to verify the installer's authenticity and integrity. No source code, build scripts, or cryptographic checks in the project itself were changed.