Monero GUI

This commit simply updates the Monero GUI wallet's built-in downloader to fetch a newer version of the bundled P2Pool mining software (from v4.18 to v4.18.1) and updates the matching file hashes. There is no indication in the commit itself that this is a security fix, vulnerability, or malicious change. It appears to be a routine dependency/version bump.

This commit changes how the Monero GUI wallet stores and uses login credentials for remote nodes (servers that help the wallet talk to the Monero network). Previously, the wallet kept daemon username/password as persistent wallet-level settings. Now those credentials are passed fresh each time a connection is initialized, so they are scoped to that specific connection instead of lingering on the wallet object. This is a defensive cleanup that reduces the risk of credentials being reused for the wrong node or leaking across connections, but the commit message does not frame it as a security fix.

This commit fixes a display bug in the Monero GUI wallet's transaction history list. Previously, failed transactions were being shown at the top of the list alongside pending transactions, because any transaction without a confirmed block height was treated as 'top priority.' Now only genuinely pending transactions are promoted to the top; failed transactions are sorted by their actual (zero) block height instead. There is no direct security risk such as theft, code execution, or data loss.

This commit is a user-interface improvement for the Monero GUI wallet's transaction history screen. It changes how outgoing payments to multiple recipients are displayed, searched, and copied. There is no security vulnerability here; it is purely a usability enhancement.

This patch fixes a race condition in the Monero GUI wallet's send screen. If a user quickly changed send details or canceled a transaction while an earlier transaction was still being prepared in the background, the wallet could mix up the old and new transactions. The fix tags each send request with an ID and discards results from outdated requests, and it properly cleans up canceled transactions to avoid memory leaks or accidental use of the wrong transaction.

This is a routine GitHub Actions CI fix for the Windows build. It adds the 'rust:p' package to the list of MSYS2 packages installed during the build. There is no security-relevant change visible in the diff.

This change fixes a privacy leak in the Monero GUI wallet's update checker. Previously, when the wallet checked for updates and downloaded the signed list of official file hashes, it did not route that request through the user's configured proxy. This could expose the user's real IP address to the update server and any network observer, even if the user had set a proxy for other wallet traffic. The patch now passes the configured proxy address through to the update check so those hash downloads also go through the proxy.

This commit simply updates the Monero GUI's built-in downloader to fetch a newer version (4.18) of the bundled P2Pool mining software. It changes download URLs and the expected file hashes to match the new release. There is no indication of a security fix or vulnerability in this change.

This commit removes the 'Sign (offline)' button for hardware wallets in the Monero GUI wallet. The change prevents users from attempting an unsupported operation that could lead to failed or unsafe transactions when using a Ledger/Trezor-like device. The issue was reported by zkao using a tool from zkSecurity, suggesting it was found during a security review, but the commit message does not explain the exact attack or failure scenario.

This commit is a straightforward user-interface cleanup in the Monero wallet restore wizard. It replaces a third radio-button option ('Restore from QR Code') with a dedicated QR scan button, simplifying the layout. There is no security-relevant change in behavior—QR scanning still works the same way, and no sensitive data handling or access-control logic was modified.

This commit adds a feature to the Monero GUI wallet that lets users scan a QR code to restore a wallet from its secret keys. The change itself is a feature addition, not a direct security fix. However, it handles extremely sensitive data (private view and spend keys) encoded in QR codes, and the parsing logic uses string operations and URI decoding that could be risky if a malformed or malicious QR code is scanned. There is no evidence in the commit of input validation beyond checking the public address format. Because private keys are involved, any weakness in parsing could have serious consequences, but the commit does not demonstrate an actual vulnerability.