Sparrow Wallet

This commit is a routine version bump from 2.4.2 to 2.4.3. It only changes version strings in four files: the build script, macOS package metadata, the application's version constant, and the reproducible build documentation. There are no code logic changes, no bug fixes, and no security-related modifications.

This commit only changes the wording of an on-screen instruction shown to users after they change the passphrase on a Trezor hardware wallet. It tells users to restart the device and adds guidance for battery-powered devices. There is no code behavior change and no security fix.

This commit simply allows Sparrow Wallet's transaction editor to display and edit Bitcoin transactions that use version number 3, in addition to versions 1 and 2. It is a routine compatibility update with no apparent security relevance.

This commit fixes a bug in Sparrow Wallet that could corrupt the wallet database when a user removes the wallet password/encryption. Previously, the code changed the file's encryption settings before writing the wallet data with the old password, which could leave the database in a broken state. Now, when removing encryption, the wallet data is written first using the current password, and only then is the file encryption removed. When adding or keeping encryption, the file encryption is changed first as before.

This commit fixes UI bugs in Sparrow Wallet's transaction editor when working with PSBT v2 (a modern format for partially-signed Bitcoin transactions) and 'DST' (likely descriptor/transaction templates). Previously, when a user changed transaction version, locktime, or input sequence numbers in the editor, the underlying PSBT object was not updated to match. This could cause the displayed/edited transaction to disagree with the actual PSBT being signed or exported, potentially leading to unexpected transaction behavior or failed signing. The patch makes the editor keep the PSBT in sync and also disables locktime controls when the form is read-only.

This commit fixes a visual styling bug in the Sparrow Wallet dark theme. It changes a CSS rule so that the text color of labels inside split-menu buttons is white, matching the dark background. There is no security relevance in this change.

This commit adds new ways to sign Bitcoin messages using the BIP-322 standard through QR codes and PSBT files in Sparrow Wallet. It changes how the wallet decides which signing formats are allowed and removes a fallback that previously forced older P2PKH-style signing for wallets that couldn't sign BIP-322. The main concern is that the new logic may let users select a signing format their hardware wallet or keystore doesn't actually support, or may mishandle PSBT files imported back from an external signer. There is no direct evidence in the commit of a vulnerability being fixed or introduced, but the change touches security-sensitive signing code.

This commit changes how Sparrow Wallet reads multi-line Bitcoin wallet descriptors from files. Previously, the importer would join non-empty lines together into one paragraph, which could accidentally merge separate descriptors into a single broken string. Now each non-empty, non-comment line is treated as its own descriptor. The change is mostly a bug fix and test addition; it does not appear to be a security patch, but the old behavior could cause import failures or confusion when a file contained multiple descriptors.

This commit updates a software library called jackson-databind from version 2.17.2 to 2.21.1. Jackson-databind is a widely used tool that helps Java programs convert data between formats like JSON and Java objects. Older versions of this library have a history of security bugs, especially when handling untrusted data. The update itself is very small—only one line in the build file changes—but the commit message does not say which specific security issue is being fixed. Without a vendor statement or a linked security advisory, we cannot be certain this is a security patch, but upgrading this particular library is commonly done to address known vulnerabilities.

This commit updates the Google Gson library used by the Sparrow Wallet project from version 2.9.1 to 2.13.2. Gson is a widely-used library that converts Java objects to and from JSON data. Upgrading a dependency across several minor and patch versions often includes bug fixes and security fixes, but the commit message itself does not say this is a security update. Without a vendor statement or a known CVE tied to this specific upgrade, we cannot confirm it fixes a specific vulnerability, though it is a prudent maintenance change.

This commit is described as upgrading a software component called 'protobuf' to version 4.34.0 in a single file named 'lark'. No actual code diff is available, and no verified references were supplied. There is no visible evidence of a security fix or vulnerability being addressed.

This commit updates two cryptography-related software libraries (Bouncy Castle and PGPainless) to newer versions in a component called 'drongo'. Such updates are often routine maintenance, but can also fix security bugs in how the wallet handles encryption and digital signatures. Without seeing the actual code changes or release notes, we cannot tell whether this fixes a specific security problem or is just a general upgrade.

This commit simply updates a user-interface library called ControlsFX from version 11.1.0 to 11.2.3 in the project's build file. There is no information in the commit itself saying this fixes a security problem, and no independent references were provided. It looks like a routine dependency update.

This commit simply bumps a Kotlin coroutines library for JavaFX from version 1.10.1 to 1.10.2. There is no indication in the commit itself that this fixes a security issue, and no security references were provided. It appears to be a routine dependency update.

This commit simply updates the JUnit testing library from version 5.10.0 to 5.14.1. JUnit is only used for running tests during development and is not included in the actual wallet application that users run. There is no indication of any security issue being fixed or introduced.

This commit updates a single dependency—JetBrains annotations—to a newer patch version. These annotations are compile-time code markers (for things like 'this can be null') and do not change how the wallet runs or handles bitcoin. There is no security-relevant change visible in the materials provided.

This commit updates the image-resizing library Thumbnailator from version 0.4.18 to 0.4.21 and removes a manual module configuration for it. The newer version likely fixes bugs or security issues in the older library, but the commit message does not say what those issues are. Without a public advisory, we can only guess that this is a routine dependency update that may address security problems.

This commit simply removes a third-party Java library called 'streamsupport' from the project. It was used to provide modern Java stream features on older Java versions, but the project no longer needs it. There is no security issue visible in this change.

This commit simply bumps the version of a third-party command-line parsing library (jcommander) from 2.0 to 3.0 in the project's build file. There is no indication in the commit itself that this fixes a security vulnerability, and no security-relevant information is provided.

This commit updates the ZXing barcode/QR-code library from version 3.4.0 to 3.5.4 in the project's build file. Library updates often include bug fixes and security patches, but the commit message does not say this is a security fix. Without a vendor advisory or changelog reference, we cannot confirm any specific vulnerability is being fixed, though staying on an older version can leave known issues unpatched.

This commit updates a dependency called Caffeine from one version to version 3.2.3. Caffeine is a common Java library used for caching data in memory. Dependency upgrades can sometimes fix security bugs, but the commit message here does not say this is a security fix, and no diff was provided to inspect. We therefore cannot conclude it has security relevance from the information given.

This commit updates a dependency called dnsjava from an unspecified older version to version 3.6.4. dnsjava is a library used to handle DNS (Domain Name System) lookups in Java applications. Version 3.6.4 was released as a security fix for a known vulnerability in earlier versions of dnsjava. Without seeing the actual code diff, we cannot confirm what vulnerability is being fixed or how severe it is for Sparrow Wallet specifically, but dependency upgrades to patched security versions are generally done to close known security holes.

This commit simply updates a third-party software library (RxJava) used by the Sparrow Wallet project from version 2.2.15 to version 2.2.21. There is no indication in the commit itself that this fixes a security problem. It appears to be a routine maintenance update.

This commit updates a password-hashing library (argon2-jvm) used by the Sparrow bitcoin wallet from an unspecified older version to version 2.12. Argon2 is the algorithm that turns your wallet password into the secret key that protects your bitcoin. Library upgrades in this area are often done to fix bugs or security weaknesses in earlier versions, but the commit itself gives no details about what problem is being fixed. Without seeing the actual code change or a vendor explanation, we cannot confirm this is a security fix, though it is a plausible one.

This commit appears to be a routine dependency version bump for the Apache Commons Codec library, from an unspecified earlier version to version 1.21.0. No code changes or diff content were provided, and no security-related context is visible in the commit title or message. On its own, this is a normal maintenance update and does not indicate a security issue in Sparrow Wallet.