libwally-core

This is a routine automated update by Dependabot that bumps the version of a JavaScript build tool called browserslist, used only in the WebAssembly packaging part of the project. The change only updates version numbers and metadata in a lock file. There is no indication of a security fix or vulnerability.

This is a routine automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.5 to 3.1.7 inside the WebAssembly packaging directory. The commit itself only changes a package-lock.json file and does not alter any of libwally-core's cryptographic or wallet code. The newer fast-uri version is known to fix a URI-parsing bug that could, in some applications, cause a program to hang or behave unexpectedly when processing a malformed URI. Because this dependency is used only in the build/test tooling for the WASM package and is not part of the shipped cryptographic library, the practical security risk to libwally-core users is very low.

This is an automated dependency update by Dependabot that bumps the JavaScript package fast-uri from version 3.1.4 to 3.1.5 inside the WebAssembly packaging directory. The change only updates version numbers and package hashes in package-lock.json. There is no indication in the commit itself that this fixes a security issue, and no security references were provided.

This commit only adds new test cases to check that the library correctly rejects malformed cryptographic signatures. It does not change any production code, so by itself it cannot introduce or fix a security vulnerability. It may be related to earlier work that hardened signature parsing, but the diff only contains tests.

This is an automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.2 to 3.1.4 inside the WebAssembly packaging directory. It only changes a package-lock.json file and is marked as a development dependency, meaning it is not part of the core cryptographic library shipped to users. There is no direct evidence in the commit that this fixes a security problem in libwally-core itself, but dependency updates can sometimes address bugs or vulnerabilities in the helper library.

This commit is a routine version bump from 1.5.5 to 1.5.6. It only changes version numbers in build files, documentation, and package metadata. There are no code changes that affect security or functionality.

This commit is a routine version bump from 1.5.4 to 1.5.5 across build files, documentation, and package metadata. It changes only version strings and the build version constant; no code logic is modified.

This commit is a routine version bump from 1.5.3 to 1.5.4 across build files, documentation, and package metadata. It changes only version strings and constants; no code logic is modified. There is no security-relevant content in the diff.

This commit fixes the CMake build system so it correctly detects several platform features and headers that the library's C code relies on. Before this fix, the CMake build could silently produce a misconfigured library that uses less secure fallback code paths (for example, missing secure memory-zeroing functions or unaligned-access handling). The commit does not change the core cryptographic code itself; it only changes how the build system discovers what the current platform supports.

This is a tiny build-maintenance change: it replaces the deprecated Python `distutils.sysconfig` module with the newer `sysconfig` module in the package setup script. There is no security vulnerability visible in the diff, no change to cryptographic code, and no disclosed incident. It is a routine compatibility cleanup.

This is an automated Dependabot update that bumps the JavaScript development dependency fast-uri from version 3.1.0 to 3.1.2 inside the WebAssembly (WASM) packaging directory. The change only updates a package-lock.json file. There is no direct evidence in the commit that this fixes a security issue, but version bumps of URI-parsing libraries can sometimes address security bugs. Because it is a devDependency used during build/packaging, any risk is likely limited to the build environment rather than end users of the compiled library.

This commit only updates the TypeScript type-declaration file for the JavaScript/WebAssembly wrapper. It widens many function parameters from 'Buffer|Uint8Array' to 'Buffer|Uint8Array|null', meaning callers are now allowed to pass null. The change is purely in type definitions; the actual C/WASM implementation is not modified here. It makes the API more permissive on paper, which could hide programming mistakes, but it does not by itself create a runtime vulnerability.

This commit is a routine version bump from 1.5.2 to 1.5.3 across build files, documentation, and package metadata. No code logic, cryptographic functions, or security behavior changed.

This commit fixes a small but real bug in a Bitcoin/Elements transaction library. When creating a new transaction input fails, the code was trying to securely wipe memory using the wrong size: it used the size of a transaction output instead of the size of a transaction input. On most systems this means the clearing is ineffective or incomplete, so secret data (like scripts or witness data) could remain in memory longer than intended. It is a memory-clearing bug, not a direct remote exploit, but it weakens a security safeguard.

This commit fixes a simple but real bug in a transaction helper function. Before the fix, if a caller accidentally passed a null pointer as the output parameter, the library would crash by writing to address zero. The fix adds a standard null check and returns an error instead. It is a defensive hardening change rather than an active remote exploit, but it removes a reliable local crash path.

This is an automated dependency update that removes an old JavaScript helper package called serialize-javascript and upgrades a build tool called terser-webpack-plugin. The change only affects the build-time tooling for the WebAssembly package, not the core cryptographic library. It is a routine maintenance patch with no direct evidence of an active security flaw being fixed in the project's own code.

This change fixes a performance problem when reading Bitcoin-style transactions that contain an unusually large number of 'witness' data pieces. Previously the code started with a small buffer and repeatedly grew it, which made processing time balloon (a 'quadratic' slowdown). The patch pre-allocates the exact needed size during deserialization, so large-but-valid transactions no longer cause severe delays. It is a denial-of-service/performance fix rather than a memory-corruption bug.

This commit only adds new software testing tools (fuzzing harnesses) for parsing Bitcoin-style transactions and PSBTs. It does not change the actual transaction/PSBT parsing library code, so it cannot by itself introduce a security vulnerability or fix one. It is a test-infrastructure change.

This is a small internal cleanup in transaction parsing code. The developer removed an unnecessary 'destination' parameter from several helper macros and made them use an existing pointer variable directly. There is no change to security behavior, no bug fix, and no new feature.

This commit fixes a bounds-check bug when reading confidential asset or value commitments in Bitcoin/Elements transactions. Before the fix, the code read the first byte of a commitment to decide its type without first confirming that at least one byte remained in the buffer. A malformed, truncated transaction could therefore read one byte past the end of the input data, potentially causing an out-of-bounds read. The patch adds a one-byte length check before that first read.

This is a tiny code cleanup change. The function previously calculated 'bytes + bytes_len' and assigned it to 'end' before checking whether 'bytes' was NULL. AddressSanitizer (a debugging tool) flags arithmetic on NULL pointers even when the result is never used, which made fuzzing tests falsely report memory leaks. The patch moves that calculation to after the NULL check so the debugging tool stays quiet. There is no user-facing bug or security vulnerability being fixed here.

This is a routine automated update by Dependabot that bumps the webpack JavaScript build tool from version 5.94.0 to 5.105.0 inside the WebAssembly package directory. It only changes the package-lock.json lockfile and does not alter any of the project's own cryptographic or wallet code. The update is a development dependency, so it only affects how the package is built, not what end users run in production. There is no indication in the commit that this fixes a specific security vulnerability.

This commit is a routine version bump from 1.5.1 to 1.5.2 across build files, documentation, and package metadata. It changes only version numbers and the library compatibility age/current values; no source code logic is modified. There is no security-relevant change in the diff itself.

This commit adds new test data and a test case to check that the library can correctly read and write two special Elements transactions. The transactions involve asset issuance or reissuance token amounts larger than normally allowed. There is no code change to the library itself—only new tests—so this is a defensive test addition rather than a fix for an active vulnerability.

This commit adds a new public helper function that checks whether a chunk of taproot-related data (a BIP-341 control block) is well-formed. It is purely a validation/verification addition and does not change existing behavior or fix a bug. There is no indication in the commit that it addresses a security vulnerability.