Stack Wallet

This commit adds a new automated build step that produces a Flatpak installer for the Linux version of Stack Wallet. It does not change the wallet's code, cryptography, or how user funds are handled. It is a packaging and release-pipeline change, not a security fix or vulnerability.

This commit adds a temporary lock (mutex) around a function called checkElectrumAdapter in a cryptocurrency wallet app. The developer notes that without the lock, the function could be run by multiple parts of the app at the same time, causing a race condition. The race could potentially lead to duplicate or conflicting Electrum server connections, connection errors, or unexpected behavior when managing which server client is active. The fix is described as a 'bandaid,' meaning the underlying design still needs a safer rewrite.

This commit simply adds two new optional features, 'shopinBit' and 'cakePay', to the list of features that can be turned on or off at build time. It does not change any runtime behavior, security settings, or user data handling. There is no indication of a security issue.

This commit only reformats a single Dart map literal from multi-line to single-line style. It changes whitespace and line breaks, not program logic, data handling, or security behavior. There is no security relevance.

This commit is a routine user-interface cleanup. It replaces several copies of the same 'Are you sure you want to open this external link?' warning dialog with one shared version. The behavior shown to the user—asking permission before opening a web link in the device's browser—does not change. There is no indication this fixes a security bug.

This commit is a purely cosmetic UI cleanup for a ticket detail screen in the Stack Wallet app. It swaps some text widgets for selectable text, adjusts padding and borders, and replaces a custom container with a reusable rounded container. There is no security-relevant change.

This is a small UI bug fix in a Flutter settings screen. It moves an asynchronous key-loading call so it only happens while the screen widget is still active, preventing a harmless 'provider accessed after widget disposed' warning. There is no direct evidence this is a security vulnerability.

This commit is a user-interface cleanup for the CakePay gift-card flow on desktop. It replaces separate mobile/desktop navigation paths with a single nested navigator inside a dialog, swaps some loading indicators, and changes how order details receive their data (passing the whole order object instead of just an order ID). There is no clear security bug being fixed, and nothing in the diff suggests attackers could exploit it.

This commit is a purely cosmetic UI fix. It narrows three buttons on a desktop shopping page so they no longer overflow the window at the application's minimum width. There is no security relevance.

This commit changes a single screen in the Stack Wallet app so that timestamps are shown in the user's local time instead of UTC. It is a minor user-interface improvement with no security relevance.

This commit only changes the colors used for chat message bubbles in a customer-support ticket screen. It swaps hard-coded or theme-mismatched colors for theme-consistent primary/secondary button colors so the chat looks correct in light and dark modes. There is no security relevance.

This commit is a user-interface cleanup for the ShopInBit ticket and request screens. It swaps some dialog and container widgets, extracts repeated list-row code into helper widgets, and changes how a loading spinner is shown during ticket sync. There is no indication of a security fix or vulnerability being addressed.

This commit is a routine internal refactor that moves the app's shared database code from one location to another and switches some ShopInBit ticket data from the Isar database to a Drift/SQLite database. It is not described as a security fix, and the visible changes do not introduce obvious ways for an attacker to steal funds or data. The main risk is that any database migration could accidentally lose or corrupt user data, but nothing in the supplied diff proves that happened.

A one-line UI fix changes a safety check from 'if the widget is still in the tree' to 'if the Flutter BuildContext is still valid' before showing a temporary info banner. This is a routine Flutter correctness fix that prevents a possible crash when a screen is closed while the banner is being prepared. There is no direct evidence in the commit that this is a security issue.

This commit only adjusts the spacing between buttons on a settings screen, making gaps slightly wider on desktop and in a couple of places on mobile. It is a visual user-interface tweak with no security relevance.

This commit is a routine UI cleanup in the Stack Wallet app's ShopInBit settings screen. It removes an extra 'verify your key' dialog that was managed inside the same screen and turns it into a separate, self-contained dialog widget. The visible behavior—asking the user to re-enter their saved customer key before continuing—appears unchanged. There is no clear security fix or vulnerability here; it looks like a code-quality refactor.

This commit adds human-readable toString() methods and helper toMap() methods to three data classes that describe shopping tickets. It only changes how objects look when printed or logged; it does not alter how data is stored, transmitted, validated, or protected. There is no security issue visible in the change.

This commit is a routine refactor of the ShopinBit feature in Stack Wallet. It moves settings like whether the user accepted guidelines, completed setup, and their display name from the previous storage mechanism into a Drift/SQLite database, and switches UI code to use Riverpod providers for that database and the ShopInBit service. The diff shows no obvious malicious intent, no new network calls, no weakening of encryption, and no exposed secrets. It is primarily a code-quality and architecture change.

This commit fixes a small but real bug in the automated build pipeline for Android. Previously, the build script used `echo` to write the signing keystore from a base64-encoded secret. If the secret was empty or missing, `echo` would still create an empty file and the build would continue, potentially producing an unsigned or broken APK. The fix uses `printf '%s'` to avoid adding a trailing newline, and adds a check that aborts the build if the keystore secret is empty. This is a reliability and correctness improvement rather than a direct security vulnerability in the app itself.

This commit changes the GitHub Actions build workflow for the Stack Wallet Android app. It adds a step that converts the uploaded Android signing keystore from its original format into the PKCS12 format before building the APK. This is a CI/build pipeline fix and does not, on its own, introduce a vulnerability. It does mean the CI job now handles the app's private signing keystore and its password, so the security of the build pipeline remains important.