Sparrow Wallet

This commit simply bumps the version of a third-party Java library called Apache Commons Compress from 1.27.1 to 1.28.0 in the project's build file. There is no information in the commit itself saying this fixes a security problem, and no verified security references were provided. It is a routine dependency update.

This commit simply bumps the version of a common Java helper library (Apache Commons Lang3) from 3.19.0 to 3.20.0 in the project's build file. There is no code change shown, and no security issue is mentioned or identifiable from the diff alone.

This commit upgrades a database library (jdbi) and adds a new validation step that checks a Sparrow wallet file's embedded H2 database for unexpected objects such as custom routines, triggers, check constraints, non-base tables, generated columns, and domains. It also tightens a filename check to inspect the full wallet file path. These changes look like hardening against a maliciously crafted wallet file, but the commit message only says 'upgrade jdbi to v3.51.0' and does not explain the security relevance. No advisory or CVE is referenced in the materials.

This commit updates a database connection-pooling library called HikariCP from version 4.0.3 to 7.0.2 in the project's build file. Such upgrades are often done to pick up bug fixes, performance improvements, or security patches, but the commit message itself does not say this is a security fix, and no specific vulnerability is referenced.

This commit simply bumps the version of a PDF library called OpenPDF from 1.3.30 to 1.3.43 in the project's build file. It is a routine dependency update. The commit itself does not say why the upgrade was made, and no security advisory or vulnerability details are provided. It may include bug or security fixes from the newer OpenPDF release, but that cannot be confirmed from this change alone.

This commit appears to be a routine dependency upgrade of the JNA (Java Native Access) library to version 5.18.1. No diff content was provided, and no verified references link this change to any security issue. There is not enough information to assess whether this is a security-relevant patch or a normal maintenance update.

This commit simply updates two logging helper libraries (SLF4J) from version 2.0.12 to 2.0.17. There is no indication in the commit itself that this fixes any security issue. It appears to be a routine dependency maintenance change.

This commit fixes a certificate validation bug in Sparrow Wallet's TLS code. Previously, the app always told Java's certificate checker to expect an RSA-based certificate, even when the server presented an Elliptic Curve (EC) certificate. That mismatch could cause valid EC-secured servers to be rejected or, in some situations, weaken the validation path. The patch now detects the certificate's actual algorithm and passes the correct value ('ECDHE_ECDSA' for EC, 'RSA' otherwise).

This commit fixes a bug in Sparrow Wallet's encrypted network connections. When the wallet connected to a server through a proxy (like Tor), it accidentally checked the proxy's identity instead of the actual server's identity. It also adds proper hostname verification for connections that use standard certificate authorities. Without these checks, a malicious actor controlling a proxy or network path could trick the wallet into trusting the wrong server, potentially exposing transaction data or balances.

This commit changes how Sparrow Wallet validates TLS certificates when connecting to public Electrum servers. Previously, the app avoided saving certificates for public servers and relied on user-approved certificate 'pinning' (TOFU). Now it tries to use normal certificate authority (CA) validation for public servers that have CA-signed certificates, while still using pinning for self-signed certificates. The change also deletes a saved pinned certificate if it expires on a public server, so the app can fetch a fresh, CA-validated one. This is a security-hardening change, not an obvious vulnerability fix, though the prior behavior could have made man-in-the-middle attacks against public servers easier if users routinely accepted changed certificates.

This commit adds certificate pinning for secure (TLS) connections to Bitcoin Core in the Sparrow Wallet. Previously, Sparrow trusted any certificate when talking to a user's own Bitcoin Core node over HTTPS, which could allow a network attacker to impersonate that node and intercept or alter wallet traffic. Now Sparrow records the first certificate it sees (a 'trust on first use' or TOFU model) and checks that future connections present the same certificate. It also keeps Electrum server certificates separate from Bitcoin Core ones. This is a security improvement, not a vulnerability being introduced.

This commit fixes a bug where a wallet name containing a backtick character could break or manipulate the SQL command used to delete a wallet account. The fix both prevents users from typing backticks into wallet names and safely escapes any backtick that already exists before running the database command. This is a defensive hardening change rather than a confirmed remote attack.

This commit fixes a networking issue in Sparrow Wallet's built-in 'cormorant' Electrum server so it now listens only on the local computer (localhost) instead of on all network interfaces. Previously, the server could accept connections from other devices on the same network, which could let an attacker or another user on the network interact with the wallet's internal server without the user's knowledge.

This commit is a routine version bump from 2.4.1 to 2.4.2. It only changes version strings in build files, macOS packaging metadata, and the application's internal version constant. There are no code logic changes, no bug fixes, and no security-related modifications.

This commit adds a user-facing convenience feature: when you open a wallet file from a folder that is not Sparrow's default wallets folder, Sparrow now asks if you want to make that folder your new default wallets directory. It also lets you save a custom wallets directory in settings. There is no security bug being fixed here—this is purely a usability improvement.

This commit updates Sparrow Wallet's download verification tool so it recognises additional Linux package filenames when users drag-and-drop files to verify. Previously only names starting with 'sparrow-' or 'sparrow_' were accepted; now 'sparrowwallet-', 'sparrowwallet_', 'sparrowserver-', and 'sparrowserver_' are also accepted. There is no security vulnerability here—it is a straightforward compatibility/usability improvement.

This commit changes how Sparrow Wallet imports a Samourai wallet backup file. Previously, if the backup file contained any extra characters after the closing JSON brace, the import would fail. The new code tries to parse the file as-is, and if that fails, it trims everything after the first closing brace and tries again. This is a robustness fix for malformed or padded backup files, not a clear-cut security patch. It could, in theory, hide malicious trailing content from the parser, but there is no direct evidence in the commit that this trailing content is dangerous or that the change is intended to address a security vulnerability.

This commit appears to add support for using a passphrase with KeepKey hardware wallets in Sparrow Wallet. A passphrase is an extra word added to a wallet seed for additional security. No actual code diff was provided, so we cannot assess whether the change was implemented safely or unsafely. Based only on the title and one-line description, there is no visible security issue.

This commit tightens what characters are allowed in Sparrow wallet file names. It appears to block a way that a specially crafted wallet file name could inject extra commands into the H2 database connection string (JDBC URL), which might let an attacker who can get a user to open a maliciously named wallet file perform unexpected database operations. The patch is defensive and partial: it adds a blocklist for semicolon-prefixed parameters in the file name and also removes the semicolon from allowed characters when naming wallets.

This commit makes a small JavaFX UI tweak in three address-display components. It marks an internal 'TextFlow' layout node as 'unmanaged,' which stops it from participating in automatic layout calculations. The stated goal is to prevent repeated layout passes when addresses are shown in chunked groups. There is no indication this fixes a security vulnerability, and no exploit path is visible from the change.

This commit is a routine version bump from 2.4.0 to 2.4.1 for the Sparrow Wallet application. It updates version strings in the build file, macOS app metadata, and the application's Java code, plus refreshes documentation about which Java version to use for reproducible builds. There are no code changes that affect wallet security, transaction handling, or user data.

This commit is a purely cosmetic fix for the Sparrow Wallet desktop application. It makes sure that when using the dark theme, the text on menu items attached to certain default-style buttons is colored white so it remains readable. There is no security issue here.

This commit is a routine version bump from 2.3.2 to 2.4.0. It only changes three version number strings in build files and source code. There is no functional code change, no bug fix, and no security-related modification.

This commit is a purely cosmetic tweak to the dark theme's color settings. It slightly darkens the alternate color used when Bitcoin addresses are displayed in chunks, improving visual contrast. There is no security relevance.

This commit removes Sparrow Wallet's installer associations for handling 'bitcoin:', 'lightning:', and 'auth47:' web-style links. The change was made because the packaging tool (jpackage) no longer supports these extension-less file associations. This is a compatibility/build cleanup, not a security fix. A side effect is that after installing future Sparrow versions, clicking these link types in a browser may no longer automatically open Sparrow, depending on the platform and how the installer is configured.