Monero LWS

This commit fixes nine separate bugs in the Monero Light Wallet Server (LWS). The most serious ones are: an infinite loop when importing certain address data, a missing size limit that let unauthenticated remote clients request huge amounts of memory, reading untrusted array data from clients before proper validation, an incorrect overflow check when calculating subaddress counts, and a double HTTP response that could confuse clients. Several other fixes correct thread handling, mempool behavior, and a round-robin scheduling erase bug. The commit title says these issues were 'reported by llm'—likely an automated or large-language-model-assisted review—so the security relevance is acknowledged by the project author but not via a formal vendor security advisory.

This commit fixes a broken GitHub Actions workflow file that builds and publishes Docker images. It corrects a variable name (from 'platform' to 'arch') and adds a missing period at the end of the docker build command. There is no security issue here—just a routine build script repair.

This commit fixes a YAML indentation error in a GitHub Actions workflow file. It changes one line of spacing so the Docker login step is correctly aligned under the job's steps list. There is no security-relevant change to the software itself.

This commit fixes a typo in a GitHub Actions workflow file. The Docker build command had an extra word ('build build') that would cause the automated Docker image build to fail. It is a routine CI/CD fix with no security relevance.

This commit fixes a GitHub Actions workflow syntax error. The 'matrix' keyword was missing its required parent 'strategy' wrapper, which would prevent Docker build jobs from running correctly. There is no security relevance in the code change itself.

This commit is a routine compatibility update to keep the Monero Light Wallet Server (LWS) project building against recent changes in the upstream Monero codebase. It replaces a custom macro-based type declaration (POD_CLASS) with plain C++ struct forward declarations and adds a few missing standard library header includes. There is no indication in the commit that any security vulnerability is being fixed.

This commit fixes a type-casting mistake in the Monero Light Wallet Server's database code. The program was treating its own custom database context as a different, more generic context. That mismatch could corrupt internal accounting of active readers/writers or cause the wrong cleanup code to run when a database transaction ends. The patch also removes a lot of now-redundant LMDB wrapper code and switches the project to use its own dedicated transaction and cursor types so the mistake cannot recur in the same way.

This commit fixes a simple syntax typo in a GitHub Actions workflow file. The condition that decides whether to add release tags had an extra closing brace, which would cause the workflow to fail parsing rather than run incorrectly. There is no security issue here.

This commit only updates the 'external/monero' git submodule pointer from one commit hash to another. No actual source code changes are shown in this repository's diff. The title and message are generic ('Latest master') and give no indication of what changed in the submodule. Without inspecting the submodule's own commits, we cannot determine any security relevance from the materials provided.

This commit fixes a bug in the Monero Light Wallet Server (LWS) where webhook notifications for mempool transactions could fail or behave incorrectly when scanning subaddresses. The change passes an existing database reader into the output-handling callback, so the code no longer tries to start a new read transaction inside an already-active one. This prevents potential failures or inconsistent reads during mempool webhook processing. The commit also adds tests that exercise the mempool publication path with a webhook server.

This commit simply adds a new GPG public key file to the repository. A GPG public key is used to verify that future releases or commits were genuinely signed by the project maintainer. There is no code change, no vulnerability, and no security issue in the diff itself.

This commit is a routine build/maintenance change that adjusts which version of the external Monero dependency is pinned. There is no indication of any security fix, vulnerability, or user-facing behavior change. It is essentially a housekeeping update to a submodule reference.

This commit appears to change which version of an external Monero component the project points to (a so-called 'git submodule pin' or dependency reference). The title says it fixes the pin for 'external/master' back to the 'master' branch. No actual code changes are visible, and no security-related information is provided in the commit message or materials.

This commit fixes a database-handling bug in Monero Light Wallet Server (LWS). The bug caused the server to permanently miss some subaddress outputs because a read transaction was not closed before a new one was opened, triggering an LMDB error (MDB_BAD_RSLOT). The fix explicitly releases the old read transaction before starting the next one. There is no direct evidence this is exploitable by an attacker; it appears to be a reliability/correctness bug.

This commit fixes a math mistake when checking whether a user requested too many Monero subaddresses. The original code divided two numbers and compared the result to a maximum, which is the wrong way to detect overflow and could allow the multiplication to overflow. The fix reverses the division so the check works correctly. A malicious or malformed request might have been able to bypass the subaddress limit, though the practical effect depends on what happens after the check.

This commit simply changes a version string from '1.0-alpha' to '1.1-alpha' in a single source file. There is no functional code change, no bug fix, and no security relevance visible in the diff or commit message.

This commit changes one character in the documentation configuration file (mkdocs.yml), adding a trailing slash to the site description. It does not touch any program code, cryptographic logic, network handling, or user data. There is no security relevance.

This commit is a routine documentation-site fix. It changes how the MkDocs documentation builder is invoked in a GitHub Actions workflow (from `python3 mkdocs build` to `python3 -m mkdocs build`) and fixes a typo in the site description. There is no security relevance.

This commit makes a trivial wording change to the project's documentation configuration file, adding a slash to the site description. There is no security relevance.

This commit adds mempool (pending transaction) support to Monero Light Wallet Server. It lets users see unconfirmed transactions through the /get_address_txs REST endpoint and the live /feed websocket. The change also refactors how the server checks whether transaction outputs belong to a user's address, moving that logic into a shared helper called ownership_test. There is no direct evidence in the commit message or diff that this fixes a security vulnerability; it reads as a feature addition with associated code cleanup.

This commit adds a new real-time WebSocket '/feed' endpoint to the Monero Light Wallet Server. It lets wallet clients receive live transaction and block updates instead of polling. The change is large (+3,300 lines) and touches networking, authentication, serialization, and database access. It also refactors existing account-opening code so it can be shared between the old REST API and the new feed. There is no indication in the commit that this is a security fix; it appears to be a feature implementation. Because it is brand-new network-facing code, it increases the attack surface, but the diff itself does not contain an obvious, directly exploitable vulnerability.

This commit updates a single function that decodes hidden Monero transaction amounts to match a recent upstream Monero library change. The old code called rct::h2d(copy.amount) directly and assumed it always succeeded. The new code creates a local output variable, calls rct::h2d(out, copy.amount), and only returns the decoded amount if the function reports success. This is a defensive fix that prevents the wallet server from returning potentially invalid or garbage decoded amounts if the conversion fails. It is unlikely to be a critical remote-exploitable vulnerability on its own, but it removes a correctness bug that could affect balance or transaction reporting.

This commit updates the GitHub Actions workflow that publishes documentation to GitHub Pages. It replaces a third-party deployment action with GitHub's official actions and adds explicit permissions so the workflow only gets the access it needs. The change is a routine hardening/improvement of the documentation publishing pipeline, not a fix for an active security flaw in the Monero Light Wallet Server software itself.

This commit fixes an Arch Linux CI build script by adding the --noconfirm flag to a pacman system update command. It is purely a build/CI maintenance change and has no security relevance to the actual Monero LWS software or its users.

This commit is a routine GitHub Pages configuration fix. It moves the custom domain setting from the deployment workflow file into a dedicated CNAME file in the docs folder, and removes a duplicate lowercase 'cname' file. There is no security issue here—just housekeeping to make the documentation website's custom domain work correctly.