libwally-core

This is a routine automated update by Dependabot that bumps the version of a JavaScript build tool called browserslist, used only in the WebAssembly packaging part of the project. The change only updates version numbers and metadata in a lock file. There is no indication of a security fix or vulnerability.

This is a routine automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.5 to 3.1.7 inside the WebAssembly packaging directory. The commit itself only changes a package-lock.json file and does not alter any of libwally-core's cryptographic or wallet code. The newer fast-uri version is known to fix a URI-parsing bug that could, in some applications, cause a program to hang or behave unexpectedly when processing a malformed URI. Because this dependency is used only in the build/test tooling for the WASM package and is not part of the shipped cryptographic library, the practical security risk to libwally-core users is very low.

This commit changes a library function so that it now returns an error when a PSBT/PSET input amount is missing, instead of silently returning zero. It also adds a new 'has_input_amount' check so callers can ask whether the value exists before reading it. The change is an intentional fix to prevent callers from accidentally treating a missing amount as zero. It also cleans up some old, non-existent function names in the Java wrapper.

This commit changes a library function so that it returns an error when asked for an output amount that is not actually present, instead of silently returning zero. This prevents callers from accidentally treating a missing amount as a real zero-value output, which could lead to incorrect transaction handling in Bitcoin/Elements PSBT workflows.

This commit tightens how the library reads PSBT (Partially Signed Bitcoin Transaction) data. It adds a new parsing flag that requires the parser to consume the entire input, and turns that flag on automatically when reading base64-encoded PSBTs. Previously, extra bytes tacked onto the end of a PSBT could be silently ignored. The change is defensive: it helps prevent malformed or intentionally padded PSBTs from being accepted as valid.

This is an automated dependency update by Dependabot that bumps the JavaScript package fast-uri from version 3.1.4 to 3.1.5 inside the WebAssembly packaging directory. The change only updates version numbers and package hashes in package-lock.json. There is no indication in the commit itself that this fixes a security issue, and no security references were provided.

This commit fixes a missing safety check in libwally-core's AES encryption/decryption function. Previously, callers could pass an output buffer smaller than the input data, which could lead to writing past the end of the buffer (a buffer overflow). The patch now rejects such calls and adds tests for many invalid input combinations. The issue was reported by an outside security researcher.

This commit fixes a Java language binding bug where a function that reads a Bitcoin transaction output amount was incorrectly declared to return a 'size' type (a memory/length value) instead of an unsigned 64-bit integer. Output amounts in Bitcoin are 64-bit integers, so the wrong return type could cause the returned value to be truncated, misinterpreted, or trigger type-conversion errors in Java applications using libwally-core. The fix is a one-line change in the SWIG interface file used to generate Java wrappers.

This commit adds a new public-key compression function to a cryptographic library and updates the existing decompression function so both can accept already-compressed or already-uncompressed keys as input. It also adds tests and language bindings. There is no security vulnerability here; it is a normal feature addition with defensive input validation.

This commit only adds new test cases to check that the library correctly rejects malformed cryptographic signatures. It does not change any production code, so by itself it cannot introduce or fix a security vulnerability. It may be related to earlier work that hardened signature parsing, but the diff only contains tests.

This commit tightens signature validation in a cryptographic library. It now rejects malformed DER-encoded signatures that are longer than allowed, or where one of the signature numbers (R or S) is zero. Previously, the underlying secp256k1 library would accept these invalid forms silently, which could lead to later failures or unexpected behavior when the signatures are used in Bitcoin/Elements transactions.

This commit adds a new public API to libwally-core that lets users derive BIP32 keys directly from a parsed Bitcoin/Elements descriptor. It also fixes two consistency bugs in how descriptor keys are looked up: it now correctly routes requests for the special 'blinding key' index, and it correctly marks SLIP77 blinding key nodes so callers can tell what kind of key they are getting. There is no direct evidence in the commit that these changes fix an exploitable vulnerability; they appear to be correctness and API-completeness improvements.

This is an automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.2 to 3.1.4 inside the WebAssembly packaging directory. It only changes a package-lock.json file and is marked as a development dependency, meaning it is not part of the core cryptographic library shipped to users. There is no direct evidence in the commit that this fixes a security problem in libwally-core itself, but dependency updates can sometimes address bugs or vulnerabilities in the helper library.

This commit is a routine version bump from 1.5.5 to 1.5.6. It only changes version numbers in build files, documentation, and package metadata. There are no code changes that affect security or functionality.

This commit only updates the project's changelog file (CHANGES.md) to document what is included in the upcoming 1.5.6 release. It does not change any source code, build scripts, tests, or documentation that affects how the software runs. The changelog entries describe fixes that were already made in earlier commits, including a security-relevant fix about preventing memory leaks via extended CPU registers on x86. Because this commit itself only edits the changelog, it introduces no new security risk and requires no action.

This commit fixes a parsing bug in libwally-core's Bitcoin descriptor handling. Previously, if extra characters appeared after a valid nested expression inside parentheses, the parser silently ignored them. For example, 'wsh(pk(KEY)xyz)' was accepted as if it were just 'wsh(pk(KEY))'. This could let malformed or attacker-crafted descriptors be misinterpreted, potentially causing two users or programs to disagree about what a wallet script actually is. The fix makes the parser reject such trailing garbage.

This commit tightens validation for Bitcoin descriptors that wrap a miniscript inside sh() (pay-to-script-hash) or wsh() (pay-to-witness-script-hash). Previously, the library accepted any miniscript fragment as the top-level child, even fragments that are not valid standalone scripts (for example, a fragment that only pushes a public key or verifies a signature but leaves a value on the stack). The change now rejects those malformed descriptors before they can be used to create addresses or transactions. The risk is that an attacker or buggy wallet could trick a user into accepting a descriptor whose script does not behave as expected, potentially making funds unspendable or enabling unexpected spending conditions.

This commit is a routine version bump from 1.5.4 to 1.5.5 across build files, documentation, and package metadata. It changes only version strings and the build version constant; no code logic is modified.

This commit is just a changelog update for libwally-core version 1.5.5. It mentions that the release 'de-optimizes some memcpy calls on x86 to prevent leaks via extended registers.' That wording suggests a security-sensitive fix, but the actual code change is not shown in this commit—only the release note is. So we can flag the topic as potentially security-relevant, but we cannot verify the fix from this commit alone.