Sparrow Wallet

This commit fixes a bug in the Sparrow Wallet desktop app where, if the Bitcoin server could not return a transaction referenced by a wallet input, the app would crash or show incorrect data. The change makes the app treat such transactions as 'unfetched' and display 'Unknown' or the raw transaction hash instead of throwing exceptions or dereferencing missing data. This is a defensive UI/data-handling fix rather than a cryptographic vulnerability, but it prevents user-facing errors and possible misleading fee/value displays.

This commit fixes a user-interface bug in Sparrow Wallet's terminal (command-line) mode. Previously, alert buttons with custom labels like 'Refresh Wallet' could not be shown correctly and were either mislabeled or failed to map. The change adds a new dialog class that displays buttons with their actual text, so users see the correct choices and can act on them.

This change fixes a resource leak in the Sparrow Wallet desktop app. When a wallet tab was closed, a background subscription that refreshes wallet data from the connected server was not being stopped, so it could keep running and potentially cause memory to be held longer than needed. The patch now explicitly stops (disposes of) that subscription when a wallet is closed, and also prevents a settings form from ever starting one.

This commit simply disables the 'Add Account' button in the terminal version of Sparrow Wallet when there are no accounts left to add. It is a minor user-interface improvement to prevent a user from clicking a button that would have no effect. There is no security issue here.

This commit fixes a unit test that was failing on Windows. The test uses an embedded H2 database feature, and Windows file paths use backslashes. H2 interprets backslashes in its connection URL as escape characters, so the test path was being mangled. The fix converts the Windows path to forward slashes for the URL and adds a check that the test setup actually created the expected file before proceeding. There is no change to production wallet code or user-facing behavior.

This commit only changes the column headings in CSV export files so they include the name of the bitcoin unit being used (for example, 'Value (BTC)' or 'Value (sats)'). It is a user-experience improvement, not a security fix.

This commit changes how Sparrow Wallet displays bitcoin amounts in tables and charts. When a wallet using the 'auto' unit setting receives 1 BTC or more, the app now switches the display from satoshis to BTC. This is a user-interface convenience change, not a security fix.

This change fixes a bookkeeping issue between the Sparrow Wallet app and Bitcoin Core. When Bitcoin Core automatically expands the set of addresses it watches for a wallet, Sparrow could get out of sync and either try to re-import descriptors it already had, or refuse to extend the wallet's address range. The patch refreshes Sparrow's cached view of those ranges before deciding whether to import. The main risk is operational: users could see missing transactions, failed wallet loads, or address gaps, rather than a direct theft-of-funds bug.

This commit fixes how Sparrow Wallet calculates fees when you speed up or replace a Bitcoin transaction. Previously, if your wallet had unconfirmed follow-up transactions (like a CPFP child) that depended on the transaction being replaced, the wallet did not count their fees toward the replacement cost. That could cause the replacement to be rejected by the network for paying too little. The fix also improves the error message so users are told the correct minimum fee to use next time, and it allows a CPFP child that pays to a change address to be treated as a consolidation output when bumping fees.

This commit tightens how Sparrow's Cormorant integration decides when a Bitcoin Core wallet transaction has been replaced or dropped from the mempool. It now also considers new 'mempool conflicts' reported by Bitcoin Core 28+, waits until Core has finished loading its mempool before concluding a transaction is gone, and double-checks whether a transaction might have been confirmed in a block before purging it. The change is a defensive bug-fix that reduces the chance of Sparrow wrongly removing a transaction from its local view.

This small change fixes a UI bookkeeping bug in Sparrow Wallet. When you open a transaction in a tab, the wallet now properly stores the on-chain block information even if it could not fetch all of that transaction's input transactions. Previously, the block information may not have been saved in that case, so the confirmation count shown in the tab would not update as new blocks arrived. This is a correctness/fix for displayed state, not a vulnerability that lets someone steal funds or run code.

This commit fixes a UI display bug in Sparrow Wallet's transaction confirmation indicator. Previously, if a transaction tab opened when a transaction already had six or more confirmations, the little progress/tick icon would not draw correctly. It also now handles the rare case of a blockchain reorganization (reorg) reducing confirmations back below six, restoring the progress circle instead of leaving a tick. There is no indication this affects funds, private keys, or transaction signing.

This change fixes how Sparrow Wallet detects blockchain reorganizations when connected to Bitcoin Core. Previously, if Bitcoin Core's active chain briefly dropped below the last known block height (for example during a reorg), Sparrow would throw an error on every poll and keep failing until the user reconnected. Now it correctly recognizes this situation as a reorg and resets its last known block, allowing normal polling to continue.

This commit updates a linked subproject called 'lark' with the stated goal of preventing Trezor hardware wallet pairing credentials and older v1 message payloads from being written to application logs. If successful, it reduces the risk that sensitive wallet communication secrets could leak through log files, which might otherwise be read by malware, backups, or support staff. However, the actual code changes are inside the subproject and not visible in this commit, so we can only judge from the commit message.

This commit fixes a bug in Sparrow Wallet's Electrum server batching logic. When the wallet had experienced network timeouts, it tried to shrink its request batch size by half. If the configured page size was already 1, halving it produced 0, which then caused every future batched request to fail for the rest of the session. The fix ensures the page size never drops below 1. This is a reliability/denial-of-service bug rather than a way for an attacker to steal funds directly.

This commit hardens Sparrow Wallet's handling of block-chain tip announcements from Electrum servers. Previously, a server could announce a fake high block height and the wallet might keep retrying or accept the claim, affecting confirmation counts shown to the user. The change now refuses an announced tip if the wallet cannot verify it links into the known chain, falls back to the last verified store tip, and warns the user. It also prevents endless retries on the same bad tip.

This commit changes how Sparrow Wallet chooses between a regular Bitcoin address and a newer 'silent payment' address when paying someone via a DNS name or a Bitcoin URI. Previously, the wallet preferred the regular address. Now, if the sending wallet supports silent payments, it prefers the silent payment address and only falls back to the regular address when silent payments aren't possible. This is a feature/correctness improvement rather than a fix for an active security flaw, but it reduces the chance of silently using a weaker address type when a stronger one is available.

This commit updates a submodule called 'drongo' with a one-line change whose message says it now checks silent payment metadata against every transaction input, not just the eligible ones. Silent payments are a privacy feature for Bitcoin. The change sounds like a security fix because verifying only some inputs could let a malicious or malformed PSBT (a partially-signed Bitcoin transaction) slip past checks. However, the actual code change is just a submodule pointer bump, so we cannot see the real code fix from this commit alone.

This commit tweaks the terminal (command-line) version of Sparrow Wallet. For a new type of wallet called a 'silent payments' wallet, it hides the 'gap limit' setting (which doesn't apply) and asks the user for the wallet's creation date when importing a watch-only silent-payments wallet. This is a user-interface improvement, not a security fix.

This commit simply hides the 'Discover' button when adding an account to a Silent Payments wallet. It is a UI change, not a fix for a vulnerability. There is no evidence of a security bug being patched.

This commit updates a submodule called 'drongo' inside the Sparrow Wallet project. The title says it now explicitly rejects a partially-signed Bitcoin transaction (PSBT) if it has been signed over silent payment outputs that were not actually computed. In plain terms, it tries to prevent a wallet from accepting a transaction signature that covers hidden recipient addresses it never verified. We cannot see the actual code change because only the submodule commit hash changed.

This commit fixes a race condition in Sparrow Wallet's silent-payments scanning. When the wallet subscribes to a server to scan for silent payments, the server's first notification can arrive before the wallet has finished recording the subscription's official start height. Without the fix, that early notification could be ignored (potentially leaving the scan stuck waiting forever) or a notification from an old, replaced subscription could be wrongly applied (showing incorrect transaction history). The change holds early notifications in a small queue until the start height is known, then applies only the ones that belong to the current subscription, in the correct order.

This commit fixes how Sparrow Wallet calculates transaction size and fees for silent-payment transactions before they are fully signed. Previously, the wallet treated an unresolved silent-payment output as if it took up no space, which made the displayed transaction size, fee rate, and effective fee rate look smaller than they would be once broadcast. The fix sizes these outputs as the Taproot (P2TR) outputs they become after signing, so fee calculations and warnings match reality.