Monero GUI

This change fixes a bug in the Monero wallet setup wizard. Previously, when restoring or creating a wallet from seed/keys, the wallet was first saved with a blank or temporary password before the user's chosen password was applied. If applying the real password failed, the wallet file could remain on disk with a weak or empty password. The patch makes the wallet creation functions accept the intended password directly, and aborts the save if the password cannot be set.

This commit updates the Monero GUI wallet's message-signing screen so that when a user verifies a signature, the app now reports extra details: whether the signature is valid, which key type was used (spend key, view key, or unknown), and whether it uses an older signing algorithm. It is a user-interface improvement to reduce confusion, not a fix for a vulnerability.

This commit fixes a display bug in the Monero GUI wallet's transaction history. Previously, when sorting transactions by block height, failed transactions were incorrectly treated like pending ones and shown at the top of the list. The fix ensures only genuinely pending (unconfirmed) transactions float to the top, while failed transactions are sorted by their actual block height like normal. There is no direct evidence this is a security vulnerability—it's primarily a user-experience and accuracy fix.

This commit is a user-interface improvement for the Monero GUI wallet's transaction history screen. It changes how outgoing payments with multiple recipients are displayed, searched, and copied. There is no security vulnerability here; it is a routine feature enhancement.

This update fixes a timing bug in the Monero wallet's send screen. If a user quickly changed or cancelled a payment while a transaction was still being prepared in the background, the wallet could accidentally show or use the wrong transaction details. The fix adds request IDs so the app can tell old, stale transactions apart from the current one and safely discard them. It also cleans up transaction objects when the user rejects a payment, preventing possible crashes or memory waste.

This commit adds a feature that lets users scan a QR code to restore a Monero wallet from its secret keys. The change itself is a feature addition, not a fix for a known vulnerability. There is one minor security-relevant detail: the QR code URI scheme was changed from 'monero_wallet:' to 'monero-wallet:' and a new parser was added. The code validates the wallet address before accepting the QR data, which is good. However, the new parser does not validate the secret view/spend keys or restore height values, so a malformed QR code could at worst cause the restore wizard to receive invalid key strings. There is no evidence in the commit of a disclosed security bug, an exploit, or an attacker-controlled code path.

This commit simply updates the Monero GUI wallet's built-in downloader to fetch a newer version of the bundled P2Pool mining software (from v4.18 to v4.18.1) and updates the matching file hashes. There is no indication in the commit itself that this is a security fix, vulnerability, or malicious change. It appears to be a routine dependency/version bump.

This commit fixes a display bug in the Monero GUI wallet's transaction history list. Previously, failed transactions were being shown at the top of the list alongside pending transactions, because any transaction without a confirmed block height was treated as 'top priority.' Now only genuinely pending transactions are promoted to the top; failed transactions are sorted by their actual (zero) block height instead. There is no direct security risk such as theft, code execution, or data loss.

This commit is a user-interface improvement for the Monero GUI wallet's transaction history screen. It changes how outgoing payments to multiple recipients are displayed, searched, and copied. There is no security vulnerability here; it is purely a usability enhancement.

This patch fixes a race condition in the Monero GUI wallet's send screen. If a user quickly changed send details or canceled a transaction while an earlier transaction was still being prepared in the background, the wallet could mix up the old and new transactions. The fix tags each send request with an ID and discards results from outdated requests, and it properly cleans up canceled transactions to avoid memory leaks or accidental use of the wrong transaction.

This is a routine GitHub Actions CI fix for the Windows build. It adds the 'rust:p' package to the list of MSYS2 packages installed during the build. There is no security-relevant change visible in the diff.

This commit simply updates the Monero GUI's built-in downloader to fetch a newer version (4.18) of the bundled P2Pool mining software. It changes download URLs and the expected file hashes to match the new release. There is no indication of a security fix or vulnerability in this change.

This commit is a straightforward user-interface cleanup in the Monero wallet restore wizard. It replaces a third radio-button option ('Restore from QR Code') with a dedicated QR scan button, simplifying the layout. There is no security-relevant change in behavior—QR scanning still works the same way, and no sensitive data handling or access-control logic was modified.

This commit adds a feature to the Monero GUI wallet that lets users scan a QR code to restore a wallet from its secret keys. The change itself is a feature addition, not a direct security fix. However, it handles extremely sensitive data (private view and spend keys) encoded in QR codes, and the parsing logic uses string operations and URI decoding that could be risky if a malformed or malicious QR code is scanned. There is no evidence in the commit of input validation beyond checking the public address format. Because private keys are involved, any weakness in parsing could have serious consequences, but the commit does not demonstrate an actual vulnerability.

This commit fixes a broken feature in the Monero wallet's setup wizard that restores a wallet by scanning a QR code. The feature had been completely non-functional since a prior redesign because the code that processes the scanned QR code was placed in a JavaScript library that cannot access the wizard's user-interface elements. The patch moves that code into the correct wizard page, updates it to use the current user-interface elements, and safely handles QR codes that contain only an address with no extra key data. This is a straightforward bug fix with no clear security relevance.

This commit adds automated user-interface tests for the Monero wallet setup wizard. It does not change how real users create or open wallets; it only adds test code and exposes a few internal UI control names so the tests can interact with wizard pages. There is no security fix or vulnerability here.

This commit changes the Monero GUI wallet creation wizard so that users always see and can edit the wallet save location, regardless of which wallet mode they chose. Previously, the location field was hidden in simpler modes and the wallet was saved to a default folder. The change also stops validating whether the default folder is writable, only checking custom locations. This is a user-experience and correctness fix rather than a clear security patch, though it removes a minor validation inconsistency.

This change alters the Monero GUI wallet setup wizard so that newly created or recovered wallets are kept only in memory, rather than being written to a temporary file on disk during the setup process. The old approach created temporary wallet files on the computer's storage and then deleted them after the user finished the wizard. The patch removes the code that created and cleaned up those temporary files. This is a defensive improvement: it reduces the chance that an unfinished or temporary wallet file containing sensitive data is left behind on disk, exposed to other users, recovered by forensic tools, or leaked through backups, swap files, or file indexing. The change also adds a small UI guard so the wizard cannot be interacted with while a hardware-device wallet is being created asynchronously.

This commit fixes a broken GitHub workflow script that verifies P2Pool software hashes. The script previously used the third-party 'requests' library, which is not installed on the slim Ubuntu runner used by the project. The change switches to Python's built-in 'urllib' library so the automated check can run again. It is a reliability/maintenance fix, not a security vulnerability patch.

This commit simply removes an unused Makefile variable called 'deldirs'. There is no change to compiled code, no security fix, and no user-facing behavior change.

This commit fixes a bug in the Monero GUI wallet where three functions that read transaction details could access memory beyond the bounds of an internal list when the list is empty. The old check used 'index > size - 1', which underflows when the list is empty (size 0), so the guard failed and the code could read from an invalid position. The new check 'index >= size' is safe even when the list is empty. This is a defensive fix that prevents a potential crash or reading of unintended data when the wallet processes an unsigned transaction with no outputs or fees recorded.

This commit fixes a precision-loss bug when the Monero GUI wallet passes payment amounts from the user interface (QML) to the underlying wallet code. Previously, amounts were converted too early from human-readable XMR strings into 64-bit integers, which could silently drop very small fractions of a Monero amount. The patch moves the conversion into the C++ backend where the wallet's own parsing function is used, preserving precision. This mainly affects QR-code/payment URIs and reserve proofs, not a remote exploit.

This commit fixes a flaw in the Monero GUI wallet creation and restore wizard. Previously, when restoring or creating a wallet from keys, the temporary wallet was created with a blank password. If setting the user's chosen password later failed, the wizard would still save the wallet—leaving it protected by the blank password instead of the intended one. The change ensures the temporary wallet gets a random password and that the wizard aborts saving if the real password cannot be set.

This commit fixes a Qt 6 compatibility bug in the Monero GUI wallet. In Qt 6, passing a plain true/false value into a JavaScript callback argument list was being misread as a list size, so the callback received 'undefined' instead of the actual result. The fix explicitly wraps each value as a QJSValue. This is a reliability/functional bug, not a security vulnerability: there is no evidence it can be exploited to steal funds, run code, or bypass protections.

This commit only updates documentation and build scripts to remove the miniupnpc library from the list of dependencies. It does not change any actual program code, so it cannot directly introduce or fix a security vulnerability in the software itself. It is a housekeeping change reflecting that the project no longer needs miniupnpc.