Stack Wallet

This commit updates several software building blocks (dependencies) and the automatically generated code that matches them. The main change is moving the Isar database library from a pre-release test version (3.3.0-dev.2) to a stable release (3.3.2), along with related tools like build_runner, analyzer, hive_ce, and mockito. It also removes a workaround that pinned an older analyzer version. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as routine maintenance to keep the project compatible with newer tooling.

This commit updates the Stack Wallet app to use a newer version of its Tor privacy plugin and switches to prebuilt native assets downloaded from GitHub. There is no direct evidence in the commit of a security vulnerability, but changing how sensitive privacy components are fetched and built is a security-relevant configuration change.

This commit updates dependency versions for Xelis cryptocurrency support in Stack Wallet. It switches from the upstream xelis-flutter-ffi library to a fork maintained by Cypher Stack (the same organization as the wallet), and bumps flutter_rust_bridge from 2.12.0 to 2.13.0. The commit title says 'xelis native assets,' suggesting feature work rather than a security fix. There is no direct evidence in the diff or commit message of a vulnerability or security issue.

This commit simply updates the version of an external library called 'epiccash' used by the Stack Wallet app. It changes which exact code snapshot and prebuilt download the app will use, but the commit message gives no details about why the update was made or whether it fixes any security problem. Without seeing the actual changes inside the epiccash library, we cannot tell if this is a routine update or a security patch.

This commit simply updates the version of an internal backup library (stack_wallet_backup) used by the Stack Wallet app. The change points the app to a newer commit of that library and bumps its declared version from 0.0.1 to 0.1.0. There is no information in the commit itself about what changed in the backup library or whether any of those changes relate to security.

This commit adjusts two on-screen selection sheets in the Stack Wallet mobile app so they respect the phone's safe area (notch, gesture bar, etc.) and fixes some padding. It also removes a duplicate spacer in one sheet. There is no indication this fixes a security vulnerability; it appears to be a UI/UX follow-up to an earlier pull request.

This commit is a routine cleanup of build scripts. It removes old shell scripts that manually compiled cryptocurrency plugin libraries and updates the build instructions to rely on Flutter's newer native-assets system. There is no indication of a security fix, vulnerability, or malicious change.

This commit simply updates a dependency reference for libmwc (a Mimblewimble Coin library) from one Git commit hash to another. There is no description of what changed in the library, no mention of security fixes, and no diff showing actual code changes in Stack Wallet itself. On its own, this commit does not demonstrate any security issue.

This commit updates the SQLite-related Dart/Flutter packages used by the Stack Wallet app. It bumps versions of the database library (drift), the underlying SQLite bindings (sqlite3), and related tooling. The change also removes the direct dependency on sqlite3_flutter_libs and adds sqlcipher_flutter_libs as a transitive dependency. The commit message gives no reason for the update, so we cannot tell from the diff alone whether it fixes a security bug, a compatibility issue, or something else. Updating dependencies is a routine maintenance action, but because this touches the encrypted local database layer of a cryptocurrency wallet, any underlying vulnerability could have high impact.

This is a one-line fix in a test file that updates an import path from an old package name ('paymint') to the current package name ('stackwallet'). It does not change any production code, user-facing behavior, or security logic. It simply allows a unit test to compile and run correctly.

This commit updates the Stack Wallet app so it can correctly identify a newer kind of Firo cryptocurrency transaction (Spark V2 spends). Previously, the wallet only recognized one transaction type as a Spark spend; now it also recognizes type 11. This is a small correctness fix that helps the wallet display balances and transaction history accurately for Firo users. There is no direct evidence in the commit that this is a security vulnerability or that it was exploited.

This commit updates the Stack Wallet app so it can correctly identify a newer kind of Firo cryptocurrency transaction (Spark V2 spends, type 11) in addition to the older Spark V1 spends (type 9). Before this change, the wallet only recognized type 9 as a spend, so a type-11 spend might have been misclassified or mishandled in the user's transaction history and balance calculations. There is no direct evidence in the commit that this misclassification could be exploited by an attacker to steal funds, but it is a correctness fix that could affect balance display and user trust.

This commit fixes a UI crash (gray screen) that occurred when confirming a transaction sent to a Spark name. The crash happened because the code tried to read the first recipient address from an empty list. The fix safely checks whether a recipient exists before reading its address, falling back to Spark-specific recipient data when needed. There is no indication this is a security vulnerability; it is a robustness fix for a user-facing navigation/display error.

This commit re-enables sending private Firo (Spark) funds to exchange addresses, which had been temporarily blocked. It also upgrades the wallet to support a newer Spark transaction format (Chaum V2) that allows multiple inputs, and it adds safety checks to prevent broadcasting insecure multi-input transactions using the older format. The change is described by the developer as a 'partial revert' ahead of a network fork, not as a security fix.

This commit updates the Stack Wallet app's integration with the Firo Spark privacy library. It adds support for a new Spark transaction version ("H2" / Chaum V2) that activates on mainnet at block 1,371,000, while keeping older behavior on test networks. The change is a dependency and protocol upgrade, not a clear security fix, but it touches sensitive code that creates private transactions and could affect whether coins are spendable after the network upgrade.

This commit updates the Windows build pipeline for a small helper program called mwebd, which Stack Wallet uses for Litecoin MWEB privacy features. It bumps the mwebd version from v0.1.8 to v0.1.19, switches to a newer Go compiler, removes an old workaround that disabled part of the upstream plugin, and fixes a checksum comparison bug caused by Windows file paths. There is no direct evidence in the commit that this fixes a security vulnerability, but updating dependencies and removing workarounds can have security side effects.

This commit updates the project's Docker build image to install the Go programming language toolchain. It downloads Go 1.24.13 from the official Go website, verifies the file's integrity using a published SHA-256 checksum, extracts it, and adds it to the container's system PATH. The change appears to be a routine CI/build environment update rather than a security fix or vulnerability patch. There is no direct evidence in the commit that this addresses a security issue.

This commit rewrites how Stack Wallet calculates fees for MWEB (a privacy feature in Litecoin). It introduces a new helper module that reconciles the estimated fee against what the transaction actually pays, and loops up to 10 times to fix mismatches. The change appears to be a bug-fix/refactor of fee arithmetic rather than a new feature or an obvious security patch. There is no vendor statement that this fixes a security vulnerability.

This commit fixes a bug in the FROST Bitcoin wallet's coin-selection retry logic. Previously, when the first attempt to build a transaction didn't have enough funds, the code tried to add extra UTXOs but used a Set (which ignores duplicates and has no guaranteed order) and also accidentally included the current UTXO again instead of only the remaining ones. The fix switches to an ordered List and correctly picks/removes the next UTXO. This could have caused transaction building to fail, loop incorrectly, or select the wrong inputs.

This commit updates a single Flutter package dependency called flutter_mwebd from version 0.0.1-pre.11 to 0.0.1-pre.12. The change is routine maintenance: it bumps the version number in the project's lock file and in a template used to generate package configuration. The commit message gives no details about what changed in the new version or whether it fixes any security issue. Without access to the upstream package's changelog, we cannot determine if this update addresses a vulnerability.

This commit simply bumps the minimum Flutter version from 3.44.8 to 3.44.9 across build configuration files, a Dockerfile, and a dependency lock file. It is a routine tooling/maintenance update with no visible security relevance.

This commit is purely a code-style reformat. It changes whitespace, line breaks, and indentation in four Dart files to satisfy the project's continuous integration (CI) formatter. No program logic, behavior, or security-sensitive code was altered.

This commit fixes how custom transaction fees are calculated for MWEB (a privacy feature in Litecoin) in Stack Wallet. Previously, when a user set a custom fee in 'satoshis per virtual byte' (sats/vByte), the app sometimes used the wrong fee rate or mixed up per-byte and per-kilobyte units. The fix makes the code consistently convert sats/vByte to a per-kilobyte rate before sending it to the MWEB library. A new test confirms that a custom sats/vByte setting now overrides the default per-kilobyte rate. This is a correctness bug that could cause users to overpay or underpay fees, and underpayment could potentially delay or stall transactions.

This commit rewrites how Stack Wallet's Xelis wallet handles background synchronization. It replaces a single refresh lock with a new 'operation coordinator' and an 'event batcher' that groups rapid blockchain notifications before acting on them. The stated goal is to fix race conditions and inconsistent state caused by the old mutex-based design. The change is defensive refactoring rather than a patch for a known exploit, but concurrency bugs in wallet code can historically lead to incorrect balances, missed transactions, or crashes.

This commit adds a cleanup routine for Ethereum transactions that were replaced by another transaction with the same nonce. In Ethereum, if you send a second transaction with the same sequence number (nonce) but a higher fee, the first one can be dropped by the network. Stack Wallet previously kept these dropped transactions visible as 'pending' forever. The new code detects them by checking the blockchain and removes them from the local transaction list. It is a bug-fix/quality improvement rather than an active remote hack vulnerability.