Monero GUI

This commit is a routine code cleanup that swaps out old Qt programming interfaces for their newer replacements. It does not fix a security bug and does not introduce any obvious security weakness. The changes are purely about keeping the code compatible with newer versions of the Qt toolkit.

This commit removes the Monero GUI wallet's direct dependency on the X11 graphics library on Linux. Previously, X11 was used only to detect whether Caps Lock is on when the user types their password. After the change, Linux systems without native Caps Lock support (including Wayland) will simply report that Caps Lock is off. The commit also fixes a minor Windows Caps Lock check so it correctly reads the on/off toggle bit. There is no obvious security vulnerability here, but users on Linux without native support may get less warning when Caps Lock is active.

This tiny change stops a software-update notification window from appearing while the user is entering their hardware wallet passphrase. The most likely real-world effect is avoiding a confusing or annoying overlap of two popups, not a serious security flaw. There is no direct evidence in the commit that this fixes an exploitable vulnerability.

This commit simply updates the Monero GUI's built-in downloader to fetch a newer version of the bundled P2Pool mining software (from v4.17 to v4.17.1) and refreshes the expected file hashes accordingly. There is no code change to how downloads are verified or installed, and no security relevance is stated by the project.

This commit adds a simple user-facing check in the Monero wallet setup wizard: before creating a wallet, the app now verifies that the chosen folder exists and can be written to. Previously, the wizard only checked whether a location was selected, not whether it was usable. This is a defensive hardening fix that prevents user confusion and possible failed wallet creation, rather than a fix for an active attack.

This commit fixes a user-interface layout bug in the Monero wallet application. It stops repeated 'Quick Layouts recursive rearrange' warning messages from appearing on startup by changing how text input fields size themselves. There is no security issue here.

This change tightens how the Monero GUI's build containers fetch the Qt user-interface library. Previously, the build scripts downloaded Qt using only a version tag (like 'v5.15.19-lts-lgpl'), which could silently point to different code if Qt's maintainers ever moved or re-created that tag. Now the scripts reset the downloaded Qt source to a specific, fixed commit hash, so every release build uses the exact same Qt code. This is a supply-chain hardening fix: it prevents a malicious or accidental tag change from slipping modified Qt code into Monero's official wallets.

This commit changes how the Monero GUI's release build containers download some important software libraries. Previously, several libraries were downloaded over unencrypted or unauthenticated connections (git:// and http://), which could allow a network attacker to tamper with the downloaded code before it was compiled into Monero's release binaries. The commit switches those downloads to https, which provides encryption and server authentication. The commit message explicitly notes that the Qt library was only pinned by tag, so a man-in-the-middle attacker could have substituted malicious Qt source code into the build. The other libraries (libgpg-error, libgcrypt, libiconv) had additional integrity checks (commit hash pins or sha256sum), so the practical risk there was lower, but the change still removes an unnecessary weak link.

This commit simply updates the Monero GUI's built-in downloader to fetch a newer version of the bundled P2Pool mining software (from version 4.16 to 4.17) and updates the matching file hashes accordingly. There is no code change to how downloads are verified or installed, and no security issue is visible in the diff itself.

This update fixes a security flaw in the Monero GUI wallet's export feature. When users exported their transaction history to a CSV file, the wallet stripped quote marks from transaction notes and address labels but did nothing else. If an attacker tricked a user into sending a payment with a specially crafted note beginning with =, +, -, or @, that note could become a spreadsheet formula. When the victim later exported and opened the CSV in Excel or similar software, the formula could run, potentially stealing data or running commands. The fix prefixes risky fields with a single quote so spreadsheets treat them as plain text.

This commit fixes a bug where user-controlled text was being displayed as rich text in several places in the Monero wallet app. Rich text can include hidden instructions, fake links, or misleading formatting. The most important case is the transaction note, which can be supplied by someone sending you a payment request, so an attacker could potentially use it to trick you. The fix escapes that text so it is shown as plain characters rather than interpreted as formatting or code.

This commit simply updates the version of P2Pool that the Monero GUI wallet automatically downloads, from version 4.15.1 to version 4.16. It changes the download URLs, filenames, and the expected SHA-256 hash values for each supported operating system. There is no indication in the commit itself that this is a security fix or that the hashes are wrong.

This change moves the start of a background wallet refresh thread from object creation time to the first time refresh is actually requested. It is a performance and resource-management improvement, not a security fix. There is no indication in the commit that it addresses a vulnerability.

This commit changes how a wallet password is passed into a background task. Previously, the password was captured by reference (a pointer to the original variable), which could mean the task reads from memory that is no longer valid if the original variable is destroyed before the task runs. Now it is captured by value, making a safe copy. This is a defensive fix that may prevent a use-after-free or read of stale memory, but the commit itself does not prove an exploitable vulnerability exists.

This commit fixes a bug in how the Monero GUI's QR code scanner copied image data into the quirc QR decoder library. Previously, the code copied the entire QImage buffer byte-for-byte, including padding bytes that Qt adds at the end of each image row. The new code copies each row individually, skipping the padding. This could have caused quirc to misread QR codes or, in a worst-case scenario, feed malformed data to the decoder. There is no direct evidence in the commit of an exploitable security vulnerability such as memory corruption.