Skylight Wallet

This commit fixes a Monero wallet bug where the amount a user wanted to send could silently change because the app was converting the typed amount into a 'double' (a computer number format with limited precision) before turning it into the exact atomic units the blockchain actually uses. The patch keeps the amount as text the whole way through, so the value the user sees is the value that gets spent. It also fixes a related bug where tapping 'Max' for large balances could produce unusable scientific notation like '5e-7'.

This commit fixes a bug in the wallet-deletion process. Previously, the app deleted wallet files while a background sync service still had them open in another process. That could leave deleted wallet data partially restored on disk, or cause the app to keep syncing a wallet the user asked to remove. The fix tells the sync service to stop first, then deletes the wallet through the core library's proper teardown path.

This commit fixes two real security gaps in a mobile cryptocurrency wallet. First, when the app was sent to the background and later reopened, it could return to an already-unlocked wallet with the password still in memory, letting anyone with the phone reach the seed phrase. The patch now locks the app on resume. Second, simply viewing the seed/secret keys only showed a warning sheet; now it also requires a fingerprint or face scan first. The commit message frames this as 'unifying lock requests between apps,' but the code comments and changes clearly describe the underlying security problems.

This commit removes a local QR-restore parser and switches the wallet to use a shared parser from another package. It also fixes two unrelated bugs in the send screen: one that could permanently block fee estimates after a single failure, and another that displayed tiny 'Max' balances in scientific notation, breaking sending. There is no obvious security vulnerability in the diff itself; the main concern is whether the new shared parser is as safe as the old one, which cannot be judged from this commit alone.

This commit adds Face ID and Touch ID support to unlock the Skylight Wallet app on iOS. It is a feature addition, not a security fix. There is no evidence in the commit of a vulnerability, bug, or security-relevant change beyond normal biometric authentication integration.

This commit fixes a user-interface bug in the wallet's settings screen. Previously, when the on-screen keyboard appeared, it could cover the bottom of a settings form because the popup sheet was sized using the full screen height. The change subtracts the keyboard area from the available height so the sheet shrinks accordingly, keeping input fields visible and usable. There is no security issue here.

This commit only changes user-facing text strings in the Skylight Wallet app. It updates labels, descriptions, and warnings shown to users in English and Portuguese to be clearer and more informative about privacy and security risks. No code logic, security behavior, or functionality was modified.

This commit swaps out precompiled Monero wallet library files for newer versions across Android, iOS, Linux, and Windows. The only human-readable change is updating the iOS framework's bundle identifier from 'com.skylight.MoneroWallet' to 'org.magicgrants.MoneroWallet'. The actual code inside the binary libraries is not shown, so we cannot tell from this commit alone whether the update fixes security bugs, introduces them, or is purely routine maintenance.

This commit simply turns off automated desktop builds for Linux and Windows in the project's release pipeline. It does not change any wallet code, fix a bug, or introduce a security feature. The Android build remains active, and the release job no longer waits for the disabled desktop jobs.

This is a one-line shell script fix that changes how the build script reads the required Rust compiler version from a configuration file. The old method could fail to extract the version correctly in some cases, potentially causing a build to use the wrong Rust toolchain. The new method is simpler and more robust. There is no direct evidence this is a security vulnerability, but build reproducibility and toolchain correctness are security-relevant for software supply-chain integrity.

This commit simply updates version numbers and switches several software dependencies to newer pinned versions. There is no visible code change in the app itself, and the commit message gives no indication that any security problem is being fixed. Without inspecting the actual contents of the updated dependency versions, we cannot tell whether this update addresses a security issue or is just routine maintenance.

This commit is a routine product update that brings user-interface improvements from another wallet project ("spice") into Skylight Wallet. It changes labels and help text, updates the address-book design, adds a language picker to the welcome screen, and refreshes the privacy policy and terms of service. There is no evidence of a security fix or vulnerability being introduced.

This commit is purely a visual redesign of the app's dark theme. It changes color values—making backgrounds darker and switching accent colors to a Monero orange shade—but does not alter any security logic, data handling, or network behavior.

This commit only renames the user-facing label for a setting from 'Verbose Logging' to 'Enable Logging to File' (and the Portuguese equivalent). It changes displayed text strings in localization files, not how logging works, what data is logged, or any security behavior. There is no security issue here.

This commit mostly moves existing features—log exporting, delete-wallet dialog, and biometric unlock—into a shared library called wallet-core, and tweaks on-screen keyboard behavior. It is a refactoring and bug-fix patch, not a clear security fix. There is no direct evidence in the commit that it repairs a vulnerability, though centralizing sensitive code like biometric auth and wallet deletion in a shared library can make future security maintenance easier.

This commit is a routine UI refactor. It removes the app's own transaction-details popup and starts using a shared one from a related 'wallet-core' library. It also adds a couple of new translated labels, such as 'Change' and 'Copied to clipboard'. There is nothing in the diff that looks like a security fix or vulnerability.

This commit is a large refactoring change that moves several wallet features—fiat exchange rates, background syncing, notifications, and preference storage—out of the Skylight Wallet app and into shared 'wallet-core' packages. The app now imports and configures those packages instead of containing its own implementations. The change itself is architectural: it deletes hundreds of lines of local code and replaces them with thin wrappers and configuration calls. There is no obvious new security bug in the diff, but because the actual logic now lives in external packages that are not shown, the full security effect cannot be judged from this commit alone.

This commit removes the old 'WalletModel' wallet engine and switches the Skylight Wallet app to use only the newer 'wallet-core' engine. It is a large cleanup/refactoring change: about 2,000 lines of the old engine code are deleted, feature flags are removed, and screens now always talk to the shared wallet-core adapter. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a completion of a migration that had already been running behind a feature flag.

This commit fixes a small user-interface timing bug in the Skylight Wallet mobile app. It makes the ongoing background-sync notification show 'Wallet up to date' only when the wallet is actually caught up, instead of briefly showing it too early or staying stuck on 'Syncing…' when the wallet is already synced. There is no security-relevant change here.

This commit fixes a minor user-interface bug in a cryptocurrency wallet app. When the user had disabled the fiat price API, a red warning icon was incorrectly shown as if the API had failed. The change simply hides that warning icon when the API is intentionally disabled. There is no security issue here.

This commit is a routine feature patch that wires up background and foreground wallet synchronization and adds incoming transaction notifications across mobile and desktop. It does not appear to fix a security vulnerability; it is part of an ongoing migration to a shared 'wallet-core' backend. The changes mostly move existing logic into helper functions and add notification gating so users are not spammed or re-notified.

This commit changes how the wallet reacts when the user switches between server types (a local node versus a lightweight server). Instead of immediately rebuilding and resyncing the wallet in the foreground, the app now delegates that work to a dedicated method. The stated goal is to fix a delayed or stale connection-status display. The diff itself is a one-line refactor and does not contain any obvious security bug or fix for one.

This commit changes the automated release build script to add `--enforce-lockfile` to a Flutter package command. That flag tells the build tool to use exactly the dependency versions recorded in the project's lock file and not silently upgrade or change packages. It is a supply-chain hardening measure that reduces the chance of an unexpected or malicious package version sneaking into a release build, but it is not a fix for a known active vulnerability.

This commit changes the F-Droid build script to add the '--enforce-lockfile' flag when Flutter downloads its package dependencies. In plain terms, it tells the build tool: 'only install the exact versions of dependencies recorded in the lockfile, and fail if the lockfile is missing or out of sync.' This is a supply-chain hardening measure. It reduces the risk that a build silently picks up a newer, potentially malicious or buggy version of a dependency, but it is not a fix for a known active vulnerability.

This commit only increases the app's build number from 403 to 404 in a configuration file. It makes no code changes and has no security relevance.