Stack Wallet

This commit changes how often the app checks for updates on a support ticket and skips re-downloading the full ticket details when the app already has them. It is a routine performance and responsiveness improvement, not a security fix. There is no indication it addresses a vulnerability.

This commit moves two existing app features—gift cards and concierge services—from a wallet-specific menu to the main home screen on mobile. It is a user-interface navigation change, not a security fix or vulnerability patch. There is no indication it fixes a bug that could be exploited.

This commit adds on-screen warnings telling users to send only USDT (TRC20) to a displayed address and not to send plain TRX. It is a user-interface safety hint, not a code change that fixes a software vulnerability. There is no evidence in the commit of an exploit, bug, or security flaw being patched.

This commit is a purely cosmetic UI change. It adjusts the width and button height of a confirmation dialog on desktop versions of the app. There is no security relevance.

This commit simply changes the user interface for entering a billing/shipping name. Instead of one 'Full name' text box that the app later tried to split into first and last names, it now shows two separate boxes labeled 'First name' and 'Last name'. There is no security fix or vulnerability here; it is a routine UI and data-handling refactor.

This commit fixes a programming crash in the Stack Wallet app's checkout screen. In some countries, the app was forcing a 'State' field to be shown even when no state was selected, which could cause the app to crash with a null error. The fix hides the state field when it isn't needed and only forces it when it is required.

This commit is a user-experience refactor, not a security fix. It moves the loading of a ShopInBit offer from inside the offer screen to the moment the user taps the 'Review offer' button, so the screen opens with data already loaded. The 'Accept offer' button no longer needs to be temporarily disabled while waiting. There is no indication this change addresses a security vulnerability.

This commit simply renames a button label from 'Decline' to 'Cancel' on a shopping offer screen so the text matches what the button actually does (close the screen). There is no security relevance.

This is a small code-quality cleanup in a Flutter screen that shows ticket attachment details. It stops passing a UI framework reference (WidgetRef) into helper methods and instead passes the actual service object directly. There is no direct security vulnerability visible in the diff, but the change removes a pattern that can make code harder to reason about and could theoretically hide lifecycle bugs.

This is a small bug-fix patch in a mobile wallet's shopping-support ticket screen. It stores a service reference when the screen first loads, then reuses that reference later, instead of asking the app's state-management system for the service again after the screen may have been destroyed. The change prevents a runtime crash ('provider read after dispose') but does not appear to be a security vulnerability.

This is a one-line UI bug fix for opening attachment links on desktop versions of the Stack Wallet app. The change tells the app to use the root navigator on desktop when displaying an 'Opening attachment' progress indicator. There is no indication this fixes a security vulnerability; it appears to address a navigation/display issue specific to desktop layouts.

This commit is a minor user-interface wording cleanup for a shopping feature. It changes two on-screen labels so that the heading now mentions VAT and the price line no longer repeats it. There is no security relevance in the code change itself.

This commit only changes a user-visible label in a shopping concierge form from a longer description to a shorter one, and tweaks how a multi-line text field label is visually aligned. There is no security-relevant change.

This commit simply changes a form field label from 'Delivery country' to 'Delivery country (Required)' in the app's shopping/payment flow. It is a user-interface wording change with no security relevance.

This commit simply adds the text '(incl. VAT)' next to displayed prices in two shopping-related screens. It is a cosmetic/user-interface label change with no security relevance.

This commit fixes a data-type mismatch in how the app reads VAT (sales tax) rates from a partner service. The code previously expected whole-number percentages like 19, but the service can actually send decimal values like 19.5. The change lets the app store and handle those decimal rates correctly. There is no direct evidence this is a security fix; it reads as a routine bug fix for incorrect parsing that could cause display or calculation errors.

This commit changes how the app handles package tracking links from a shopping partner API. Previously, the app took whatever text the API returned and treated it as a link. Now, if the text doesn't already start with 'http://' or 'https://', the app automatically adds 'https://' in front. This is a quick fix to prevent broken or unsafe links, but it doesn't fully validate that the resulting string is a real, safe URL.

A single-line change flips a third-party shopping integration from sandbox/test mode to live/production mode. This is a configuration change rather than a traditional code vulnerability, but it moves real user transactions and partner secrets from a safe test environment to the live service. If the rest of the app is not ready for production, this could expose real payment or order data, charge real money, or leak the partner secret through production traffic.

This commit fixes the way Spark Name registration data is embedded in blockchain transactions. Spark Names are human-readable aliases (like a username) tied to a privacy address. The previous code likely sent the registration fee to a plain address without attaching the required extra metadata, which could cause the name registration to fail or be recorded incorrectly. The patch adds the proper script format, including the name and Spark address, so the Firo network can recognize and process the registration. It also switches the underlying Spark mobile library from Cypher Stack's fork to the official Firoorg repository.

This commit adds a feature that displays shipping tracking links on a purchase ticket detail page. When a user taps a link, the app tries to open it in an external browser. The change is mostly a normal UI feature, but it does accept tracking-link strings from ticket data and pass them directly to the phone's URL opener. That creates a small risk if a malicious or compromised server sends a harmful link, because the app will try to open whatever it receives without visible filtering.

This commit is a routine feature improvement for the ShopinBit integration in Stack Wallet. It changes how package tracking links are handled: instead of storing one raw string that may contain several URLs crammed together with commas, pipes, or semicolons, the code now splits that string into a clean list of individual tracking URLs. It also turns empty strings from the server into null values so the rest of the app doesn't treat an empty value as a real link. There is no security fix here and nothing that looks like a vulnerability.

This commit replaces a custom-built HTML parser in Stack Wallet's ShopinBit ticket-message feature with the well-known 'html' package. The old code parsed HTML by hand using string scanning and regular expressions, which is a common source of security bugs (for example, tricking the parser into treating malicious code as harmless text or vice versa). The new code uses a dedicated HTML parser that is more robust against malformed or adversarial input. The change is a defensive refactor; there is no direct evidence in the commit that an actual attack was found or exploited.

This update improves how Stack Wallet's ShopInBit support-chat feature handles images and file attachments. It replaces an older inline-base64-only image renderer with a safer parser that also supports server-hosted attachments, adds request timeouts so background polling can't get stuck forever, and skips malformed messages instead of crashing the whole chat. The code also adds path-traversal checks on attachment URLs so a malicious link can't trick the app into requesting unintended server paths using the user's own login token.