Sparrow Wallet

This commit adds a build-system workaround so that Linux installers for the Sparrow Wallet correctly register file types (like .psbt Bitcoin transaction files) and URI handlers (like bitcoin: payment links) with the desktop environment. It is a packaging fix, not a code change that affects wallet security or user funds.

This commit only changes the color contrast of alternating chunks of displayed Bitcoin addresses in the wallet's user interface. It makes some address segments slightly less visually distinct from surrounding text. There is no security-relevant change.

This commit is a straightforward user-interface improvement: it makes the transaction diagram and related labels display Bitcoin amounts in whatever unit the user has chosen (BTC or satoshis), instead of always showing satoshis. It also refreshes the diagram when the user changes the unit format. There is no security issue here.

This is a small UI follow-up change. It moves a visual styling marker from one container element (rootStack) to another (rootBox) so that a user preference—chunking Bitcoin addresses into colored groups—applies correctly across all windows, including ones opened after startup. There is no security-relevant behavior here.

This commit adds a new user preference in the Sparrow Wallet View menu that lets users turn Bitcoin address chunking (visual grouping of address characters) on or off. It also moves the existing 'Hide Empty Used Addresses' option into a new 'Bitcoin Addresses' submenu. There is no security-relevant change here—only a cosmetic UI feature and menu reorganization.

This commit is a cosmetic CSS tweak for a Bitcoin wallet application. It changes when address text gets alternating color formatting: previously all address chunks were styled, now only those inside text fields, labels, or selected tree-table views get the alternate shading. There is no security relevance in this change.

This commit simply updates documentation and a build workflow label to reflect that Sparrow now requires Java 25 instead of Java 22. It fixes a spelling mistake ('reproduciblity' to 'reproducibility') and adds an SDKMAN tip. There are no code changes and no security implications.

This is a one-line change to a GitHub Actions build script. It moves a closing quotation mark in a shell command so the wildcard pattern is outside the quotes. This is a shell-quoting style fix with no apparent security relevance to the wallet software or its users.

This commit changes how the project's automated build system installs Java. It removes a method that downloaded and ran a shell script from the internet (SDKMAN) and instead uses GitHub's official, pinned Java setup action with a specific Java version. It also clears a cached Java directory to make builds more reproducible. This is a hardening improvement, not a vulnerability fix.

This commit changes how the project's automated build system downloads and installs Java. It replaces a pre-made GitHub Action with a custom shell script that downloads SDKMAN, installs a Java version based on a project config file, and then passes that downloaded Java archive to the standard setup-java action. There is no direct evidence in the commit that this change fixes or introduces a security vulnerability.

This commit changes a single line in a GitHub Actions workflow file, switching the version of a third-party action from a fixed release tag (@v1) to a floating branch reference (@main). This is a build pipeline configuration change. There is no direct evidence in the commit that this fixes a security vulnerability, and the change itself could arguably increase supply-chain risk by accepting unreviewed future updates from the action's main branch. The commit message provides no security context.

This is a one-line fix to a GitHub Actions workflow file. The action reference was changed from 'actions/sdkman-action@v1' to 'sdkman/sdkman-action@v1'. This appears to correct the repository owner name for a third-party GitHub Action used during automated software builds. There is no indication in the commit itself that this is a security issue, and no malicious code is present in the diff.

This commit changes how the project's automated build system selects its Java version. It replaces a direct GitHub setup step with a configuration file (.sdkmanrc) that tells SDKman to use Java 25.0.2 from the Temurin distribution. There is no security-relevant change here—only a tooling and consistency improvement.

This commit updates the kmp-tor library dependency in Sparrow Wallet from version 408.16.3 to 408.21.0 (and runtime from 2.2.1 to 2.5.0). The stated reason is to fix a file deletion problem on Windows. The change itself is just a version bump in the build file; there is no code change in Sparrow itself. We cannot see what exactly was fixed in the upstream library from this commit alone, and no security relevance is claimed by the project.

This commit fixes a Windows installer build problem by moving certain file-type associations (for Bitcoin, auth47, and lightning files) out of the shared installer options and into the Linux and macOS sections only. The change appears to be a build/packaging fix, not a security patch. There is no indication it addresses a vulnerability or that an attacker could exploit it.

This commit only changes the test runner settings in the project's build file. It swaps some Java module-opening arguments for a different one that removes warnings during automated testing. There is no change to the actual wallet application code that users interact with, and nothing here suggests a security vulnerability or fix.

This commit is a routine dependency and toolchain upgrade. It bumps the Java runtime from version 22.0.2 to 25.0.2, JavaFX from 23.0.2 to 25.0.2, a couple of GitHub Actions helpers to newer versions, and a barcode library from 0.2.1 to 0.3.0. There is nothing in the changed code that introduces an obvious security vulnerability, and the project does not describe this as a security fix.

This commit changes how Bitcoin addresses are shown on screen in the Sparrow Wallet app. Instead of displaying one long continuous string, addresses are now split into 4-character chunks with alternating colors to make them easier to read and verify. It is a user-interface improvement, not a security fix or vulnerability.

This commit is a minor user-interface polish update for the QR code display dialog in Sparrow Wallet. It changes the order of buttons in the dialog's button bar, renames a density toggle from 'Decrease/Increase Density' to 'Less/More Dense', and updates two small SVG icon graphics for the BBQR encoding option. There is no security-relevant change visible in the code.

This commit updates build tooling and one UI library to versions compatible with Java 25. It is a routine maintenance change with no clear security relevance visible in the diff.

This commit changes Sparrow Wallet so that when it performs automatic wallet discovery with a BitBox02 hardware wallet, it no longer scans for old-style 'legacy' Bitcoin addresses (P2PKH). The change appears to be a compatibility or reliability fix for the BitBox02 device, not a security vulnerability patch. There is no evidence in the commit of an exploit, attacker, or disclosed security issue.

This commit claims to fix how Sparrow Wallet detects 'change' outputs when signing transactions with a Trezor hardware wallet. Change outputs are coins sent back to the user's own wallet during a payment. If detection fails, the wallet or device might mislabel or mishandle those coins, which could confuse the user or in some designs affect how funds are verified. The actual code change is only one line in one file, but the diff was not provided, so we cannot verify what exactly was changed.

This commit adds a new feature to Sparrow Wallet that lets users scan a connected hardware wallet for existing accounts and transactions across multiple script types. It is a feature addition, not a security fix. The code changes how wallet import events and discovery results are handled, moving from single-wallet to multi-wallet results. There is no direct evidence in the commit of a vulnerability being patched.

This commit is a small cleanup that makes the CoinGecko historical exchange-rate request send the same browser-like User-Agent header that other exchange-rate calls already use. Previously, that one CoinGecko call sent no special headers. The change is unlikely to be a security fix on its own; it looks more like a reliability tweak to avoid being blocked by the CoinGecko API, which sometimes rejects requests without a User-Agent.

This commit is a user-interface improvement for Sparrow Wallet's QR code sharing feature. It replaces a simple on/off toggle between two QR formats with a dropdown menu that also adds a new 'Raw' option for transaction hex, and it remembers the user's last chosen format. There is no indication this fixes a security vulnerability.