Sparrow Wallet

This commit is a minor user-interface polish update for the QR code display dialog in Sparrow Wallet. It changes the order of buttons in the dialog's button bar, renames a density toggle from 'Decrease/Increase Density' to 'Less/More Dense', and updates two small SVG icon graphics for the BBQR encoding option. There is no security-relevant change visible in the code.

This commit changes Sparrow Wallet so that when it performs automatic wallet discovery with a BitBox02 hardware wallet, it no longer scans for old-style 'legacy' Bitcoin addresses (P2PKH). The change appears to be a compatibility or reliability fix for the BitBox02 device, not a security vulnerability patch. There is no evidence in the commit of an exploit, attacker, or disclosed security issue.

This commit claims to fix how Sparrow Wallet detects 'change' outputs when signing transactions with a Trezor hardware wallet. Change outputs are coins sent back to the user's own wallet during a payment. If detection fails, the wallet or device might mislabel or mishandle those coins, which could confuse the user or in some designs affect how funds are verified. The actual code change is only one line in one file, but the diff was not provided, so we cannot verify what exactly was changed.

This commit adds a new feature to Sparrow Wallet that lets users scan a connected hardware wallet for existing accounts and transactions across multiple script types. It is a feature addition, not a security fix. The code changes how wallet import events and discovery results are handled, moving from single-wallet to multi-wallet results. There is no direct evidence in the commit of a vulnerability being patched.

This commit is a small cleanup that makes the CoinGecko historical exchange-rate request send the same browser-like User-Agent header that other exchange-rate calls already use. Previously, that one CoinGecko call sent no special headers. The change is unlikely to be a security fix on its own; it looks more like a reliability tweak to avoid being blocked by the CoinGecko API, which sometimes rejects requests without a User-Agent.

This commit is a user-interface improvement for Sparrow Wallet's QR code sharing feature. It replaces a simple on/off toggle between two QR formats with a dropdown menu that also adds a new 'Raw' option for transaction hex, and it remembers the user's last chosen format. There is no indication this fixes a security vulnerability.

This commit fixes how Sparrow Wallet writes output descriptors when a wallet uses a non-standard key derivation path. Previously, the code stripped the leading 'm/' from the derivation path in a simplistic way, which could produce incorrect descriptors for unusual paths. The fix now uses a dedicated parser/formatter (KeyDerivation.parsePath/writePath) to handle the path correctly. This is primarily a correctness/reliability fix, but incorrect descriptors could in theory lead to users backing up or sharing wrong wallet configuration data.

This commit changes the Bitcoin fee-rate data source used by Sparrow Wallet from mempool.space's standard recommended-fee endpoint to its more precise fee-estimate endpoint. It is a minor data-source change, not a code-level security fix. There is no indication in the commit that this resolves a security vulnerability.

This commit is a purely cosmetic UI change in the Sparrow Wallet desktop app. It swaps the JavaFX layout component used to display BIP39 mnemonic word fields from a TilePane to a GridPane so the 12 or 24 seed words line up in a tidy grid. There is no change to how seed words are generated, stored, validated, or protected, and no security-relevant behavior is introduced or fixed.

This commit adds an extra safety check in Sparrow Wallet that warns users before broadcasting Bitcoin transactions with extremely high fee rates. Previously, the wallet only warned if the fee rate exceeded the top of a long-term fee rate range. Now it also warns if the fee rate is more than 100 times the default fee rate. This helps prevent users from accidentally overpaying transaction fees, which could be caused by user error, wallet misconfiguration, or potentially a malicious or compromised transaction.

This commit adds a brand-new feature to Sparrow Wallet: support for Keycard hardware wallets via a smart card interface. It introduces many new Java files that handle low-level smart card communication, secure channel encryption, PIN handling, key derivation, and signing. The change is a large feature addition (+3,250 lines) rather than a small bug fix. There is no direct evidence in the commit message or diff that this fixes a known security vulnerability, and no external references were provided. Some implementation details—such as hardcoded pairing passwords, a TODO comment about device certificate verification, and a fallback to a default derivation path—could become security concerns if misused, but they are not proven vulnerabilities on their own.

This commit changes how Sparrow Wallet asks CoinGecko for currency exchange rates. It now sends a fake web-browser 'User-Agent' header instead of none. This is likely a workaround because CoinGecko started blocking or rate-limiting requests that had no user agent. It is not a fix for a vulnerability in Sparrow itself, but it does make Sparrow's exchange-rate requests slightly more identifiable and could affect privacy if the same user agent is reused elsewhere.

This commit makes two small logging and error-handling changes in code that talks to smart cards (hardware wallets). It downgrades one routine card-enumeration error from 'error' to 'info' level, and turns a swallowed CBOR parsing error into a thrown exception. There is no indication these changes fix a security vulnerability; they appear to be code-quality or diagnostic-noise improvements.

This commit changes Sparrow Wallet so that, when a user chooses a wallet to sign a Bitcoin transaction (PSBT), the app automatically fills in any missing key-path details needed for signing. The change is small and appears to be a usability/fix improvement rather than a clear security patch. There is no vendor statement or external reference saying this fixes a vulnerability, so we cannot confidently label it as a security fix.

This commit adds a warning message in Sparrow Wallet when a user pastes an older-style extended public key (SLIP132 format) into a watch-only wallet that uses a different Bitcoin address type. It does not change wallet logic or fix a vulnerability; it only alerts the user to a possible mismatch so they can correct it. The change is defensive UX, not a security patch.

This commit changes the left and right margins of a text input dialog box from 60 pixels to 65 pixels. It is purely a cosmetic/layout adjustment for the Trezor hardware wallet v2 integration and has no security relevance.

This commit improves the user interface for pairing a Trezor hardware wallet with Sparrow Wallet. It adds a numeric-only input filter for the pairing code, makes the text larger, and shows the device name in pairing messages. There is no clear security vulnerability in the changes.

This commit adds support for pairing the Trezor Safe 7 hardware wallet with Sparrow Wallet. It introduces a JavaFX dialog flow that asks the user to confirm pairing and enter a pairing code shown on the device. The change is a feature addition for a new hardware device and does not, on its own, appear to be a security vulnerability. The pairing secrets are stored in a local JSON file, similar to how the existing BitBox02 pairing is handled.

This commit makes two small user-interface tweaks to the screen where a user imports a master private key: it changes a title to say 'Enter master private key', makes the Import button the default button that activates when the user presses Enter, and adds a period to a description sentence. There is no security-relevant code change.