python: update bleak and dependencies

Blockstream/Blockstream Jade

4de91c8e View source ↗

Public commit record

What the developer wrote

Authored by Jon Griffiths

45/100 · Thin

python: update bleak and dependencies

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

The short version

What changed, and why it matters

This commit updates the Python Bluetooth library used to talk to Blockstream Jade hardware wallets from an older version (bleak 0.13.0 with dbus-next) to newer versions (bleak 2.1.1 with dbus-fast). The code changes are mechanical API adjustments: how the app scans for devices, how it reads descriptors, and how it stores the receive characteristic. There is no direct evidence in the commit that this fixes a specific security vulnerability, but updating dependencies can remove known bugs or weaknesses in the Bluetooth stack. The commit message does not describe any security issue.

Recommended action

Treat as routine maintenance. Review the bleak and dbus-fast release notes for any security advisories between the old and new versions, and verify the pinned hashes match official PyPI releases. No immediate security response is indicated by this commit alone.

Security signals we found

Dependency version bump for Bluetooth library and its D-Bus backend

API migration from deprecated bleak 0.13.0 patterns to current bleak 2.x patterns

No explicit security claim, CVE, or advisory in commit message or diff

Potential removal of bugs or vulnerabilities present in older dependency versions, but not confirmed by supplied materials

Technical analysis

Evidence from the diff

The patch migrates jadepy/jade_ble.py from bleak 0.13.0 APIs to bleak 2.1.1 APIs. Key changes: bleak.discover() becomes bleak.BleakScanner.discover(); client.read_gatt_descriptor() now takes a descriptor object instead of a handle integer; client.set_disconnected_callback() becomes the disconnected_callback property; the internal rx_char_handle integer is replaced with the full rx_characteristic object; start_notify/stop_notify now use the characteristic object. requirements.txt pins dbus-fast 4.0.0 and bleak 2.1.1 with hashes, replacing dbus-next 0.2.3 and bleak 0.13.0. No explicit CVE, advisory, or security rationale is provided in the commit or supplied references.

Changed components

jadepy/jade_ble.pyrequirements.txtbleak Python BLE librarydbus-fast / dbus-next D-Bus bindings

Inspect captured patch +59 / −24

diff --git a/jadepy/jade_ble.py b/jadepy/jade_ble.py
index c8aee7c..f8caa00 100644
--- a/jadepy/jade_ble.py
+++ b/jadepy/jade_ble.py
@@ -37,7 +37,7 @@ class JadeBleImpl:
         self.inputstream = None
         self.write_task = None
         self.client = None
-        self.rx_char_handle = None
+        self.rx_characteristic = None
 
         if not loop:
             loop = asyncio.get_event_loop()
@@ -79,7 +79,7 @@ class JadeBleImpl:
             scan_time = min(2, self.scan_timeout)
             self.scan_timeout -= scan_time
 
-            devices = await bleak.discover(scan_time)
+            devices = await bleak.BleakScanner.discover(scan_time)
             for dev in devices:
                 logger.debug(f'Seen: {dev.name}')
                 if dev.name and \
@@ -122,26 +122,26 @@ class JadeBleImpl:
                                     f'Serial number: {self.serial_number or "<any>"}')
 
         # Peruse services and characteristics
-        # Get the 'handle' of the receiving characteristic
+        # Get the receiving characteristic
         for service in client.services:
-            for char in service.characteristics:
-                if char.uuid == JadeBleImpl.IO_RX_CHAR_UUID:
-                    logger.debug(f'Found RX characteristic - handle: {char.handle}')
-                    self.rx_char_handle = char.handle
+            for c in service.characteristics:
+                if c.uuid == JadeBleImpl.IO_RX_CHAR_UUID:
+                    logger.debug(f'Found RX characteristic - handle: {c.handle}')
+                    self.rx_characteristic = c
 
-                if 'read' in char.properties:
-                    await client.read_gatt_char(char.uuid)
+                if 'read' in c.properties:
+                    await client.read_gatt_char(c.uuid)
 
-                for descriptor in char.descriptors:
-                    await client.read_gatt_descriptor(descriptor.handle)
+                for d in c.descriptors:
+                    await client.read_gatt_descriptor(d)
 
         # Attach handler to be notified of new data on the receiving characteristic
         def _notification_handler(char_handle, data):
-            assert char_handle == self.rx_char_handle
+            assert char_handle == self.rx_characteristic
             inbufs.append(data)
 
-        assert self.rx_char_handle
-        await client.start_notify(self.rx_char_handle,
+        assert self.rx_characteristic
+        await client.start_notify(self.rx_characteristic,
                                   _notification_handler)
 
         # Attach handler called when disconnected
@@ -158,7 +158,7 @@ class JadeBleImpl:
                 self.write_task.cancel()
                 self.write_task = None
 
-        client.set_disconnected_callback(_disconnection_handler)
+        client.disconnected_callback = _disconnection_handler
 
         # Done
         self.client = client
@@ -170,8 +170,8 @@ class JadeBleImpl:
         try:
             if self.client is not None and self.client.is_connected:
                 # Stop listening for incoming data
-                if self.rx_char_handle:
-                    await self.client.stop_notify(self.rx_char_handle)
+                if self.rx_characteristic:
+                    await self.client.stop_notify(self.rx_characteristic)
 
                 # Disconnect underlying client - this should trigger the _disconnection_handler()
                 # above to run before this returns from the 'await'
@@ -183,7 +183,7 @@ class JadeBleImpl:
 
         # Set the client to None in any case - that will cause the receive
         # generator to terminate and not wait forever for data.
-        self.rx_char_handle = None
+        self.rx_characteristic = None
         self.client = None
 
     def disconnect(self):
diff --git a/requirements.txt b/requirements.txt
index 8b01e3b..0b3531c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -124,12 +124,47 @@ aioitertools==0.8.0 \
     --hash=sha256:8b02facfbc9b0f1867739949a223f3d3267ed8663691cc95abd94e2c1d8c2b46
 
 # BLE libraries (bleak and dependencies)
-dbus-next==0.2.3 \
-    --hash=sha256:58948f9aff9db08316734c0be2a120f6dc502124d9642f55e90ac82ffb16a18b \
-    --hash=sha256:f4eae26909332ada528c0a3549dda8d4f088f9b365153952a408e28023a626a5
-bleak==0.13.0 \
-    --hash=sha256:33e92739a8a117628fa1533bf973fd55ade2051c3a12ba3bbfee6ca9eca46959 \
-    --hash=sha256:eb0716852cad7e96613934680b6aff4f48d68671d6ab967155497387cd98dcee
+dbus-fast==4.0.0 \
+    --hash=sha256:0615063551e8d4b34bee778885ab56be3ef168df38f9bfc4364d8c80687e2df4 \
+    --hash=sha256:091f15fe7a2418b5b670f1edf0c15f6d7ed25886a089899e355bc3710972d731 \
+    --hash=sha256:0a91ec3707b743c2e211fa9ecd08ee483c3af19a2028ad90d2911a7e17d20737 \
+    --hash=sha256:0b2aaf80991734e2bbff60b0f57b70322668acccb8bb15a0380ca80b8f8c5d72 \
+    --hash=sha256:131b68cbc1862b4470fd94014a5709270cf5d018a68ddc5867a2e8cae19109a1 \
+    --hash=sha256:191c9053c9d54356f0c5c202e2fab9ad2508b27b8b224a184cf367591a2586cb \
+    --hash=sha256:1f8f4b0f8af730c39bbb83de1e299e706fbd7f7f3955764471213b013fa59516 \
+    --hash=sha256:2283e9c22411b1307fa3e3586fd4b42b44cae90e8a39f4fb4942a97a885d437b \
+    --hash=sha256:2818d76da8291202779fe8cb23edc62488786eee791f332c2c40350552288d8b \
+    --hash=sha256:28209c72c36f8e2bb2152c02598d353e9442d53d751efbf49870bc37ac3afcad \
+    --hash=sha256:35bbeb692e60ff2a0eb3f97dc4b048e92fc7ddc8468ed7bd173bc5513d4690cc \
+    --hash=sha256:39ac2e639833320678c2c4e64931b28a3e10c57111c8c24967f1a16de69b92b0 \
+    --hash=sha256:3b83681987b2986af050b728ecea5e230252c09db3c9593cead5b073f6391f41 \
+    --hash=sha256:512f25a0705903047e9b55d2bc3724f06dcbfb77e0b13f10a7eb835679d3705c \
+    --hash=sha256:618931126219f23285b33b5825dc40cfb166c8e6554f800f7c53dfb5f368289b \
+    --hash=sha256:621ad63b0599fc125d4574d358bbc642089c910dcc9e42ae23d32ab807c8e5af \
+    --hash=sha256:6b430760c925e0b695b6f1a3f21f6e57954807cab4704a3bc4bc5f311261016b \
+    --hash=sha256:76d6f4e14e0c54461691c043508e0d0c1844ebc9470dfe7a1f50ead7f2ad59d8 \
+    --hash=sha256:7ea5e9021779388f6b0d93d1c7eaf619185afd99bbca772f0e1ecec2b55e8d17 \
+    --hash=sha256:8171360d891109b6c6d4195dcdf36248871c09b6729c666734a44226a57485d0 \
+    --hash=sha256:89d040c5a9635b28319163c29ce1f251ed91070692a51f2db6ade06799e1b4ce \
+    --hash=sha256:8a29ad81e59b328c840c9020daa855971d8f345d2c2472e9d5b200b3c82fc734 \
+    --hash=sha256:93a864c9e39ab03988c95e2cd9368a4b6560887d53a197037dfc73e7d966b690 \
+    --hash=sha256:9e53d7e19d2433f2ca1d811856e4b80a3b3126f361703e5caf6e7f086a03b994 \
+    --hash=sha256:aa367aaad3a868dfb9373eca8868a2a0810bac6cbe35b67460682127834c2460 \
+    --hash=sha256:bfb269a9ed3b3ab29932b2948de52d7ea2eebfcad0c641ad6b25024b048d0b68 \
+    --hash=sha256:c34c748b71c6fc71e47ffe901ccfcd4a01e98d5fa80f98c732945da45d9fc614 \
+    --hash=sha256:c71b369f8fd743c0d03e5fd566ff5d886cb5ad7f3d187f36185a372096a2a096 \
+    --hash=sha256:d1b7274af1769359e8b02c546eb368f4cc43fce4ba4286ee97f357d395372492 \
+    --hash=sha256:ddd92e5179ca5af5348ac34fb6a7c279d1485a715d560bcb8ff8443296fb1aff \
+    --hash=sha256:dfa3cb3137c727ea50d89e9e4e4ce5042e28baf36fcc8b1e3c84dff50eee70aa \
+    --hash=sha256:e1d3ee49a4a81524d7caaa2d5a31fc71075a1c977b661df958cee24bef86b8fe \
+    --hash=sha256:e3d62b7a0e392a80f61227c6f314e969dd5bec36e693723728908f8e8a172885 \
+    --hash=sha256:e65a68793ce650d94ac86021a473988715197762b24c72c510833e9111c5170d \
+    --hash=sha256:f36526cb043ab630ee458b58965fcf1e6d51d742f11df8ba2756cc280a21899d \
+    --hash=sha256:f6af190d8306f1bd506740c39701f5c211aa31ac660a3fcb401ebb97d33166c7 \
+    --hash=sha256:ffc16ee344e68a907a40327074bca736086897f2e783541086eedb5e6855f3f0
+bleak==2.1.1 \
+    --hash=sha256:4600cc5852f2392ce886547e127623f188e689489c5946d422172adf80635cf9 \
+    --hash=sha256:61ac1925073b580c896a92a8c404088c5e5ec9dc3c5bd6fc17554a15779d83de
 
 # requests and deps
 idna==3.3 \

Risk score

Why this scored 18/100

Our methodology →

Potential impact 3/30

Exploitability 2/25

Stealth signal 2/15

Affected reach 4/15

Confidence 4/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

fmt: fix and prevent future use of unsupported format spec "zu"

otp: release md context on failure and clean temporary buffers

identity: clean temporary hash buffer