Sparrow Wallet

This commit only adds a new unit test file for importing and exporting wallet labels. It does not change any production code, so it cannot introduce a security vulnerability on its own. It is a routine test addition.

This commit fixes a bug where importing wallet labels from a JSONL file could silently skip some lines after a Java runtime update. The fix adds a required empty constructor for a label class and corrects how key derivation data is copied so it can be safely reused after the original source data is no longer available.

This commit is a routine version bump from 2.5.2 to 2.5.3. It only changes version strings in four files: the build configuration, macOS packaging metadata, application code, and build documentation. There are no code logic changes, bug fixes, or security-related modifications visible in the diff.

This commit only changes the wording of a warning message shown to users when a Bitcoin transaction file (PSBT) uses a non-standard signature hash type. The old message said the PSBT 'may be unsafe to sign,' and the new message tells the user to 'Review this PSBT carefully before signing.' The underlying security check and behavior are unchanged; only the label and explanatory text were softened.

This commit only changes a test file to make date-formatting unit tests stable across different computer locales. It does not modify the actual wallet application code, so it has no security impact on users.

This commit changes how dates are displayed on the wallet's balance chart. It switches the multi-year axis label from a two-digit year (like 'Aug 24') to a four-digit year (like 'Aug 2024') and adds unit tests. There is no security relevance in the code change itself.

This commit fixes a formatting bug in Sparrow Wallet's 'send to many' dialog. Previously, the dialog ignored the user's chosen number format (for example, comma vs. dot as the decimal separator) and used the Java default. This could cause confusion or errors when entering or importing Bitcoin amounts, especially from CSV files. The change makes the dialog consistently use the wallet's configured unit format.

This commit fixes a small rounding bug when importing a 'send to many' payment list in Sparrow Wallet. When amounts were entered in whole bitcoins (BTC), the app converted them to satoshis by multiplying with a large constant using normal decimal math. Because computers can store decimal fractions imprecisely, the result could be off by one satoshi (the smallest Bitcoin unit). The fix uses a dedicated helper that handles the conversion more safely. A one-satoshi error is tiny in dollar terms, but could cause a transaction to be slightly wrong or, in edge cases, fail validation.

This commit fixes a bug where Sparrow Wallet could crash with a NullPointerException when it tried to process a Bitcoin transaction that it expected to receive from an Electrum server but did not actually get. The patch now checks if the transaction is missing, marks it as unfetchable, and skips it instead of crashing. It also adds a safety check so the wallet is not accessed when it is not available. This is a reliability fix that prevents the application from failing unexpectedly during transaction history loading.

This commit is a small follow-up fix for a previous change that added support for 'silent payment' outputs. Silent payments are a privacy feature where the actual recipient address is computed later, so the transaction output temporarily has no readable address and a non-zero amount. Before this fix, Sparrow would warn users about these outputs as if they were unknown or possibly suspicious scripts. The change tells the wallet: 'If this output is a silent payment we already know about, don't show that warning.' It is a refinement to avoid unnecessary user warnings rather than a fix for a critical security flaw.

This commit adds a warning when a user tries to load a Bitcoin transaction that sends money to an unusual or unrecognised address/script type. Previously, Sparrow would silently open such transactions and not show those outputs in its visual transaction diagram, which could mislead a user into signing or broadcasting a transaction without realising where some funds were going. Now the user is warned and asked whether to proceed.

This commit updates a dependency called 'lark' to a newer version that uses 'hid4java' (a library for talking to USB devices like hardware wallets). The actual code change is only one line, and the diff content is not available, so we cannot see what changed inside the dependency. It may be a routine compatibility update, but it could also include security fixes for how Sparrow Wallet communicates with hardware wallets over USB.

This commit changes how Sparrow Wallet flags tiny, unwanted incoming bitcoin payments ('dust attack' UTXOs). For single-signature software wallets (PolicyType.SINGLE_SP), it now uses a higher default threshold (5000 satoshis instead of 1000) and no longer requires the same address to appear more than once before marking a tiny payment as suspicious. For other wallet types, the old logic remains unchanged. The change is defensive: it makes dust attacks more visible to affected users, but it is not a fix for a vulnerability that lets an attacker steal funds.

This commit is a routine version bump from 2.5.1 to 2.5.2. It only changes version strings in four files: the build configuration, macOS app metadata, the app's main Java file, and the reproducible build documentation. There are no code logic changes, no bug fixes, and no security-related modifications visible in the diff.

This commit fixes a UI bug in Sparrow Wallet's settings screen. When loading a wallet that uses Taproot (P2TR), the settings dialog was incorrectly showing the default script type rather than the wallet's actual script type. The fix moves the default-selection logic so it only runs during initial setup, not when an existing wallet is being loaded. There is no direct evidence this is a security vulnerability.

This is a small bug-fix patch that prevents a crash (NullPointerException) when displaying a tooltip on a wallet transaction entry. The tooltip shows estimated confirmation time based on current network fee conditions. If a transaction had no fee rate data, the old code would crash while trying to use that missing value. The fix checks for the missing value and safely returns nothing instead. There is no indication this can be exploited by an attacker to steal funds or compromise the wallet.

This commit is a routine version bump from 2.5.0 to 2.5.1. It only changes version strings in four files and contains no security-related code changes.

This commit changes the width of a dropdown menu in the wallet settings screen from 170 pixels to 180 pixels. It is purely a cosmetic user-interface tweak with no security relevance.

This commit makes two tiny user-interface changes: it shortens an error message so it doesn't show a full silent payment address, and it widens a dropdown box by 10 pixels. There is no security issue here.

This commit is a routine version bump from 2.4.3 to 2.5.0. It only changes three version number strings in build files and application metadata. There are no code logic changes, no bug fixes, and no security-related modifications visible in the diff.

This commit only changes user-facing help text in the wallet settings screen. It updates the descriptions for wallet policy types (single signature, multisignature, silent payments) and script types (Segwit, Taproot, Legacy). There are no code logic changes, no security fixes, and no behavior changes.

This commit simply increases how long Sparrow Wallet waits after broadcasting a transaction before giving up on seeing it in the Bitcoin memory pool (mempool). The change is from 3 polling iterations to 12, with the stated goal of supporting Bitcoin Core's 'privatebroadcast' feature, which can delay when a transaction becomes visible. There is no indication this fixes a security vulnerability; it is a compatibility/timeout adjustment.

This commit simply updates a third-party barcode scanning library called jzbar from version 0.3.1 to 0.4.0. There is no information in the commit itself indicating what changed in the new library version or whether it fixes any security issue.

This commit adds a new default public Electrum server (frigate.2140.dev) to the Sparrow Bitcoin wallet and changes how the app picks a public server when a connection fails. The new server is advertised as supporting 'Silent Payments' (a newer Bitcoin address type), and the app now tries to choose only servers that can handle the types of wallets currently open. There is no direct evidence in the commit of a security vulnerability, but adding a new third-party server and changing server-selection logic can affect user privacy and reliability.

This commit adds a safety feature for a new Bitcoin privacy technology called 'silent payments.' It records the relationship between a regular-looking payment address and its silent-payment counterpart in the wallet's database. The main goal is to prevent users from accidentally breaking silent-payment outputs when they later modify (RBF) a transaction, such as by removing inputs. The commit also blocks one risky UI action with a warning dialog when such a change would be unsafe.