Sparrow Wallet

This is a one-line bug fix for a NullPointerException (NPE) that occurs when comparing an unresolved silent payment output. A silent payment is a newer Bitcoin privacy feature that lets someone receive payments without publicly revealing their address. An 'unresolved' output likely means the wallet has not yet finished identifying whether the payment belongs to it. The fix prevents the wallet from crashing during that comparison, but the available information does not show whether the crash could be triggered by an attacker or lead to loss of funds.

This commit tightens how Sparrow Wallet checks that a scanned QR code or loaded file matches the transaction the user is currently working on. Previously, the app only compared the new transaction/PSBT against the single currently open tab. Now it checks all open transaction tabs. This reduces the chance that a user accidentally accepts a wrong or maliciously substituted transaction because they had the wrong tab active. It is a defensive hardening fix, not a clear-cut remote exploit.

This commit adds a safety check in the Sparrow Wallet desktop app to make sure a transaction loaded from a file or scanned from a QR code actually matches the PSBT (a partially-signed Bitcoin transaction) that was already open. Before this change, the app would accept any transaction or PSBT from a file/scan and display it, which could mislead a user into thinking a different transaction was the one they intended to sign. The fix shows an error dialog when the loaded or scanned data does not match the original PSBT, and includes a special message for silent-payment transactions that cannot be verified from a final transaction alone.

This commit removes the Windows installer's custom directory chooser. The installer will now always install Sparrow into a standard per-user location instead of letting the user pick a different folder. This is a routine packaging change that reduces user choice but does not, by itself, create a security vulnerability.

This commit updates the Windows installer for Sparrow Wallet so that the app properly advertises itself to Windows as a handler for 'bitcoin:', 'lightning:', and 'auth47:' web-style links. It also fixes the icon path for those link handlers to use the install folder. This is a normal installer improvement, not a security fix for a vulnerability.

This commit updates the Windows installer template used by Sparrow Wallet to match the version that ships with JDK 25. It also keeps Sparrow's custom registry entries that register 'auth47', 'bitcoin', and 'lightning' web link types with Windows. There is no indication in the commit of a security vulnerability being fixed or introduced.

This commit only changes two GitHub workflow files to add a Java compiler option that suppresses a specific category of warning messages ('module' lint warnings). It does not modify application code, dependencies, build logic, or anything that handles user data, keys, or network traffic. There is no security relevance visible in the diff or commit message.

This commit fixes a build-time trust issue and cleans up temporary debugging. It adds the missing cryptographic key for the OpenTelemetry library so Gradle can verify its downloaded files, and removes a one-off debug step that was used to investigate why the build was failing. It does not change the wallet application itself or user funds handling.

This commit only adjusts a temporary debugging step in the project's automated build workflow. It makes the debug script more tolerant of Windows paths and failures, and prints extra diagnostic information. There is no change to the wallet application code, no security fix, and no malicious-looking behavior.

This commit adds temporary debug logging to a GitHub Actions build workflow. It prints file hashes and downloads a public Maven module to help diagnose why Gradle dependency verification is failing. There is no code change to the Sparrow Wallet application itself and no security-relevant behavior.

This commit changes the project's automated build workflow to lock down the exact versions of external GitHub Actions it uses by specifying their cryptographic SHA fingerprints instead of version tags. This is a defensive hardening measure that reduces the risk of a supply-chain attack, where a malicious or compromised update to a third-party action could tamper with the wallet's build artifacts or signing certificates.

This commit adds Gradle's dependency verification files. These files list the public keys and expected checksums for the libraries the project downloads during its build. It is a standard supply-chain hardening step, not a code change that introduces a vulnerability.

This commit adds a GitHub Actions workflow that automatically updates the project's Gradle dependency verification files. These files are a security control that helps ensure downloaded build dependencies have not been tampered with. The change itself is a defensive automation improvement and does not introduce a vulnerability or malicious behavior.

This commit swaps out the library Sparrow Wallet uses to talk to webcams. The old library used JNA (a common Java-to-native bridge), while the new one uses Java's newer Foreign Function & Memory (FFM) API. The change also adds a manual step that tries to load a native library file named openpnp-capture directly from the Java installation directory. There is no direct evidence in the commit of a security vulnerability, but any change that touches native camera access and library loading deserves a careful look because mistakes there can create ways for attackers to run malicious code or bypass sandbox protections.

This commit updates a build tool (the Beryx JLink plugin) from version 3.2.1 to 4.0.2 and adjusts the build script syntax to match the new plugin version. It also slightly reorganizes how native library paths are referenced. There is no direct evidence in the commit that this fixes a security vulnerability, but updating build tooling can sometimes address indirect risks such as supply-chain or build-reproducibility issues.

This commit adds custom JSON serializers for two new types of silent-payment address classes and blocks Gson from using Java reflection on any class outside the Sparrow project. The change is defensive: it makes tests fail in the same way production would if a custom serializer were missing, which helps prevent silent data corruption or crashes when saving/loading wallet data. There is no direct evidence of an exploitable vulnerability being fixed.

This commit fixes a regression in how Sparrow Wallet saves and loads wallet data as JSON when running on newer Java versions (JDK 25). Previously, the app relied on a deep Java reflection trick to serialize certain objects, which no longer works in JDK 25. The fix removes that fragile dependency and explicitly tells the JSON library how to construct and serialize each wallet-related class. It is a compatibility/maintenance fix, not a patch for an active security vulnerability, but it touches code that handles encrypted wallet data and private-key material, so correctness matters for user safety.

This commit only adds a new unit test file for importing and exporting wallet labels. It does not change any production code, so it cannot introduce a security vulnerability on its own. It is a routine test addition.

This commit fixes a bug where importing wallet labels from a JSONL file could silently skip some lines after a Java runtime update. The fix adds a required empty constructor for a label class and corrects how key derivation data is copied so it can be safely reused after the original source data is no longer available.

This commit fixes how Sparrow Wallet exports coin labels in the BIP-329 format. Previously, the export incorrectly marked every unspent coin as 'spendable=true' in the exported file, even though the BIP-329 specification says the 'spendable' field should only be used to mark coins as frozen (not spendable). Other wallets importing this file could have treated frozen coins as spendable, or made incorrect assumptions about the user's coins. The fix now only writes 'spendable=false' for frozen coins and leaves the field out otherwise.

This commit simply bumps the version of a Java library called Lanterna from 3.1.3 to 3.1.5 in the project's build file. There is no information in the commit itself saying this fixes a security problem, and no independent references were provided. On its own, this looks like a routine dependency update rather than a security patch.

This commit is a routine version bump from 2.5.2 to 2.5.3. It only changes version strings in four files: the build configuration, macOS packaging metadata, application code, and build documentation. There are no code logic changes, bug fixes, or security-related modifications visible in the diff.

This commit only changes the wording of a warning message shown to users when a Bitcoin transaction file (PSBT) uses a non-standard signature hash type. The old message said the PSBT 'may be unsafe to sign,' and the new message tells the user to 'Review this PSBT carefully before signing.' The underlying security check and behavior are unchanged; only the label and explanatory text were softened.

This commit adds a safety check in Sparrow Wallet when opening a PSBT (a file format used to pass partially-signed Bitcoin transactions between wallets). Before this change, the wallet did not verify the signature-hash types declared inside the PSBT. A malicious or malformed PSBT could ask the wallet to sign in a way that unexpectedly alters what the signature covers, potentially leading to loss of funds. After the change, Sparrow warns the user and asks whether to continue.

This commit only changes a test file to make date-formatting unit tests stable across different computer locales. It does not modify the actual wallet application code, so it has no security impact on users.