Skylight Wallet

This commit simply updates the version of a Monero library dependency (monero_c) used by the Skylight Wallet app. The actual code changes are not shown in the diff—only the version reference was changed. There is no information in the commit or supplied references indicating this update fixes or introduces any security issue.

This commit simply updates the version of an external Monero library (monero_c) that the Skylight Wallet app depends on. The actual code changes are not shown in this diff—only the version reference was changed. There is no visible security fix or security problem in the commit itself.

This commit adds a user-friendly date picker for wallet restoration and makes tooltips show when tapping a status icon. It is a routine feature improvement with no apparent security relevance.

This update fixes a crash that could happen when a user tries to delete or switch their cryptocurrency wallet in the Skylight Wallet app. The crash occurred because the app might free the wallet's underlying native memory while a background task (like checking the network connection or refreshing balances) was still using it. The patch adds a simple 'busy' flag and a wait step so the app finishes any in-flight task before closing the wallet. There is no direct evidence this crash can be exploited by an attacker to steal funds or data, but any use-after-free bug in native code is a security concern worth treating carefully.

This commit is a large hardening and bug-fix patch for a mobile Monero wallet. It fixes several privacy and reliability problems: it stops the app from silently falling back to clearnet when Tor is required, moves sensitive address-book and transaction data out of plain storage into encrypted storage, prevents the app from overwriting a corrupted address book with an empty one, fixes notification bugs that could spam or miss transaction alerts, and adds proper iOS background sync. The changes are defensive and reduce the chance of leaking a user's view key, IP address, or contacts.

This commit fixes a background-sync bug in a cryptocurrency wallet app. Previously, when a background or foreground sync task finished, the wallet's scanning thread could keep running and its progress would be discarded because the wallet was never closed. The change explicitly pauses scanning and saves (checkpoints) the wallet before the task ends, and it also stops early if the sync gets stuck. There is no attacker-controlled behavior here; it is a reliability/bug-fix patch.

This commit fixes several wallet-loading bugs in a Monero wallet app. The most important change corrects how restored wallets are created: previously the app told the backend that every restored wallet was 'new', which made it skip scanning old transactions, so users could see a zero balance after restoring. The patch also prevents the app from opening the same wallet file twice, stops repeated connection attempts from racing each other, and makes the app detect when a wallet exists in the opposite mode (full node vs light wallet server). These are reliability and correctness fixes rather than remote attack vectors, but the 'new wallet' flag bug could cause real funds to appear missing.

This commit improves build reliability and supply-chain consistency for the Skylight Wallet. It switches the source of a key Monero-related library from a personal GitHub account (vtnerd) to the project's own organization (magicgrants), and it replaces a script that pinned the Rust compiler version for only the Tor plugin with a script that also pins the version for the OpenAlias plugin. There is no direct evidence of a security vulnerability being fixed; the changes are best described as hardening build reproducibility and reducing trust in an external repository.

This commit changes how the Skylight Wallet app estimates Monero transaction fees. Previously, the app calculated fees by actually building full draft transactions and then reusing those draft transactions when the user pressed send. Now it uses a dedicated native fee-estimation function and always builds the real transaction only when the user confirms the send. The change also switches the underlying Monero library from a personal repository (vtnerd/monero_c) to an organization-owned fork (magicgrants/monero_c). The main security-relevant effect is reducing the risk that a stale or reused draft transaction gets sent accidentally, and it removes a retry loop that could have produced misleading fee information. There is no explicit security bug fixed in the diff itself, so the security relevance is moderate and inferred.

This commit is a feature draft that upgrades the wallet's OpenAlias support from version 1 to also support the newer OpenAlias v2 standard. It adds safer parsing, DNSSEC-over-Tor resolution, and displays a sanitized recipient name on the confirmation screen. There is no indication in the commit that it fixes a known security bug; it reads as a defensive-by-design feature implementation.

This is a large feature update for the Skylight Monero wallet that brings in improvements from another project called Spice. It adds support for connecting directly to a full Monero node (not just a light wallet server), background and continuous syncing, a more secure clipboard for copying sensitive data, QR-code wallet restoration, and a new OpenAlias resolver. The changes are mostly defensive: they improve privacy, reduce clipboard leaks, and make transaction sending more precise. There is no clear security vulnerability introduced by the patch, but because it is a very large change touching many security-sensitive areas (wallet files, network connections, background services, and clipboard handling), it deserves careful review and testing before release.

This change stops the Android app package from embedding a list of its third-party libraries. The commit message says this is needed so F-Droid (an alternative app store focused on privacy and open-source apps) will accept the app, because F-Droid rejects the extra data block that contains that library list. This is a packaging/policy change, not a fix for a code vulnerability. It slightly reduces information an attacker could gather from the published APK, but it does not by itself make the app safer to use.

This commit fixes the mobile wallet's automated build process so it always uses the same Rust compiler version when building a privacy-sensitive networking component (the Tor plugin). Without the fix, the build could silently use whatever the latest 'stable' Rust release is at the time, making releases non-reproducible and potentially introducing unexpected behavior or compiler-related issues. It also copies a pre-installed Rust toolchain into the build container so the build does not fail from a missing rustup. This is a build-hardening and reliability change, not a direct fix for an active security vulnerability in the wallet itself.

This commit updates the versions of third-party GitHub Actions used in the project's automated build and release pipelines and locks them to specific, unchangeable commit hashes. It also adds a minor workaround for a Homebrew warning. The change is a routine supply-chain hardening measure; it does not introduce any obvious security vulnerability and likely reduces the risk of a compromised or malicious action update silently affecting future builds.

This commit swaps out precompiled Monero wallet library files across Android, iOS, Linux, and Windows for newer versions. The actual code inside those libraries is not shown, so we cannot tell from this commit alone whether the update fixes a security bug, adds a feature, or is just routine maintenance. The only visible source change is a reordering of iOS framework entries in a packaging metadata file.

This commit improves build reproducibility: it pins exact software versions (Docker images, source-code commits, Android NDK), uses fixed build paths, and removes non-deterministic timestamps. These are defensive hardening changes that make it easier for anyone to independently verify that the published app was built from the claimed source code. There is no direct vulnerability fix here, but the changes reduce supply-chain risk and make future tampering harder to hide.

This commit updates a SHA256 checksum used to verify the appimagetool download during the wallet's build process. The old hash no longer matched the file being downloaded, which would break builds. The change itself is a routine hash correction, but because the commit only changes the hash and does not show the corresponding appimagetool version or release being updated, it is impossible to confirm from the diff alone whether the new hash matches a legitimate upstream release or a tampered one.

This commit makes two small build-pipeline changes: it pins Windows release builds to a specific older Windows Server 2022 runner image instead of the latest one, and it updates the expected checksum and filename for the AppImage build tool downloaded during Linux release builds. There is no direct evidence in the commit that these changes fix a security vulnerability. The most plausible security-relevant effect is supply-chain risk reduction: pinning the Windows runner avoids unexpected changes from future 'windows-latest' updates, and updating the AppImage tool checksum ensures the downloaded build tool matches a known version. However, the commit message gives no security context, so this is speculative.

This commit only changes the app's version number from 1.0.10 to 1.0.11 in a configuration file. There are no code changes, no security fixes, and no functional changes visible in this commit.

This commit only adds documentation to the README explaining how users can verify that downloaded release files are genuine using GPG signatures. It does not change any code, build process, or signing keys, and it does not fix or introduce any security vulnerability.