Skylight Wallet

This commit only changes the application's version number in a configuration file, from 1.0.5+10 to 1.0.6+11. There are no code changes, no security fixes, and no functional changes visible in the diff.

This commit fixes a minor user-experience bug in the wallet restore screen. Previously, if a user accidentally typed or pasted their secret recovery phrase with leading or trailing spaces, the app would treat it as invalid and fail to restore the wallet. The change simply removes those extra spaces before checking the phrase. It is not a security vulnerability and does not expose funds or data.

This commit removes a reused SOCKS connection pool and forces every network request to use a fresh connection that closes immediately after use. It also extends a connection test timeout from 10 to 20 seconds and cleans up unused proxy-port variables. The stated goal is to fix SOCKS requests that were timing out. There is no direct evidence in the commit of a security vulnerability being patched, but the change does remove a class of risks that connection pools can introduce, such as accidentally sending sensitive request data on a connection previously authenticated under different wallet state.

This commit only updates the project's README and adds two image assets: a feature graphic and a Google Play badge. There are no code changes, no configuration changes, and no security-relevant modifications.

This commit is a routine packaging and metadata update. It fixes how version numbers are handled in build scripts (allowing with or without a 'v' prefix), updates the application's version number from 1.0.4 to 1.0.5, and tweaks the package description and maintainer fields. There is no security-relevant change.

This commit adds the ability to build and release Debian (.deb) packages for the Skylight Wallet Linux app. It also removes an unused import in one Dart source file. There is no security-relevant change: no bug fixes, no vulnerability patches, no permission changes to existing files, and no new risky behavior.

This commit removes a single line of leftover debug code that was causing a fake incoming-transaction notification to appear every time the wallet home screen loaded. It also bumps the app's build number. There is no obvious security vulnerability in the removed code, but shipping debug notifications in a production build is a quality and trust issue.

This commit removes a Docker command-line flag that made the build container run as the current host user instead of the container's default user. The stated goal is to fix build permission problems. In itself, the change does not add a known vulnerability, but it means the build will now run as whatever user is configured inside the builder image. If that image runs as root, files created in the mounted workspace could end up owned by root, and any build-time scripts or tools will execute with the container user's privileges. There is no direct evidence in the commit that this is a security fix or that it introduces an exploitable flaw.

This commit changes the release workflow to run build commands in a non-login shell instead of a login shell. There is no security issue here. The change likely fixes a build problem caused by the login shell loading environment files or running scripts that interfered with the build container setup.

This commit only updates version numbers: the app version (1.0.3+7 to 1.0.4+8), the Flutter SDK used in the Docker builder (3.38.5 to 3.38.7), and the Dart SDK constraint (3.10.4 to 3.10.7). There are no code changes, no bug fixes, and no security-related changes visible in the diff.

This commit swaps out pre-built Monero wallet library files for newer versions across Android, iOS, and Linux. The actual code inside those libraries is binary and not shown, so we cannot tell from this commit alone whether the update fixes a security bug, adds a feature, or is routine maintenance. The only readable change is an iOS framework metadata tweak that removes a background-fetch mode and sets a minimum iOS version of 15.0.

This commit is a routine fix to the project's automated build pipeline for iOS. It restructures how iPhone and iPhone Simulator libraries are built and packaged into an Apple XCFramework, but it does not change any wallet code, cryptography, or user-facing behavior. There is no indication of a security issue.

This commit removes leftover debugging code from a background task that checks for new wallet transactions. It deletes a console log message and, more importantly, removes a temporary '+1' fudge added to the transaction count. That fudge could have caused the app to think there was one more transaction than actually existed, which might trigger unnecessary notifications or confusion, but it does not appear to let an attacker steal funds or take control.

This commit is mostly a routine iOS build-system update for a Monero wallet app. It swaps a single-architecture iOS framework for a universal 'xcframework' that supports both real iPhones and the simulator, and makes a few small platform-specific cleanups in the Dart code. There is no clear security bug being fixed here; it looks like normal development work to get the iOS app building and running correctly.

This is a large work-in-progress commit for a Monero wallet app. It mainly adds iOS support (CocoaPods setup, a bundled MoneroWallet framework, notification and logging export features) and hardens error handling in the Tor/SOCKS networking code. There is no clear security fix or vulnerability being patched. A few debug leftovers, such as a hardcoded '+1' in transaction counting and a test notification fired on every wallet home screen load, look like unfinished development code rather than intentional malicious changes. The bundled binary framework cannot be inspected from the diff, so its provenance and safety are unknown.

This change stops a GitHub Actions workflow from accidentally including pre-built binary files (called 'artifacts') when it creates automated pull requests. Those binaries were being deleted from the repository and the workflow now removes them before opening a PR. This is a repository hygiene and supply-chain safety fix, not a direct vulnerability in running software.

This commit updates pre-built Monero library files (binary .so files) and points a dependency to a newer version of the upstream monero_c code. The actual source code changes are not visible because the files are compiled binaries. There is no information in the commit message or supplied references saying this update fixes a security problem, introduces a vulnerability, or changes any behavior at all. On its own, this looks like a routine dependency refresh.

This commit fixes a bug where the transaction history auto-refresh would break when a transaction was still pending (not yet mined). It also makes small user-interface tweaks, such as making list items easier to tap and widening text boxes in transaction details. There is no clear security vulnerability being patched.

This commit simply adds two GitHub usernames to a workflow so they are automatically asked to review future pull requests. It does not change any application code, build logic, secrets, permissions, or security settings.

This commit corrects a simple typo in a GitHub Actions workflow file. The workflow was supposed to trigger when the file itself changed, but the path had an extra '.yml' extension ('build-builder-image.yml.yml' instead of 'build-builder-image.yml'). This is a routine configuration fix with no security implications.

This commit adds automated GitHub Actions workflows to build a Monero wallet library from an external source and create pull requests with the compiled binaries. It also renames a Dockerfile and moves an existing script that removes an executable-stack flag from a Linux library. The changes are mostly build-infrastructure housekeeping. There is no direct evidence of a security vulnerability being introduced, but the workflow does clone and build code from a third-party repository (vtnerd/monero_c) without pinned commit verification at build time, and it later edits pubspec.lock using a remote branch's current commit hash. That creates a supply-chain risk if the upstream repository is compromised, but it is not a confirmed incident.

This commit adds a user-facing checkbox that lets mobile users choose to route the app's Tor traffic through the separate Orbot/InviZible app instead of a manually entered proxy port. It also changes the default external Tor port from 9150 to 9050 and makes a hardcoded error message translatable. There is no obvious security vulnerability in the diff; it is a feature/configuration improvement.

This commit adds user-configurable Tor settings to the Skylight Wallet app. Users can now choose between built-in Tor, an external Tor proxy, or disabling Tor entirely. It also updates how the app fetches exchange rates and blockchain heights so they respect the new Tor setting. There is no clear security bug in the patch itself, but it introduces a 'Tor disabled' mode and changes how network traffic is routed, which could affect user privacy if the settings are mishandled or bypassed.

This is a small GitHub Actions workflow fix. It corrects a path trigger so the workflow runs when the workflow file itself changes, and adds a missing 'attestations: write' permission needed for newer GitHub artifact attestation features. There is no direct security vulnerability in the diff; it is a maintenance/configuration correction.

This commit adds a new GitHub Actions workflow file that automatically builds and publishes a Docker builder image when the main branch changes. It is a routine CI/CD configuration change with no apparent security defect.