← Watch feed
Update python/pinserver libwally to 1.5.1
Public commit record
45/100 · Thin
What the developer wrote
Authored by Jon Griffiths
Update python/pinserver libwally to 1.5.1
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
What changed, and why it matters
This commit simply updates a dependency called 'wallycore' used by the Blockstream Jade PIN server from version 1.4.0 to 1.5.1. It changes the version number and the list of cryptographic fingerprints (hashes) that verify the downloaded package. The commit message does not say why the update was made or whether it fixes any security issue. Without knowing what changed between 1.4.0 and 1.5.1, we cannot tell if this is a routine maintenance update or a security fix.
Recommended action
Treat as routine dependency hygiene unless the wallycore 1.5.1 release notes identify a security fix. Review the upstream libwally 1.5.1 changelog and the pinserver submodule diff to confirm whether any security-relevant changes are included. If a security fix is identified, assess whether Jade firmware or the PIN server needs coordinated updates.
Security signals we found
01
Dependency version bump of cryptographic library (libwally/wallycore)
02
No security rationale or advisory mentioned in commit message
03
No CVE or vendor security notice supplied
04
Pin-server submodule pointer updated without visible diff
Evidence from the diff
The diff is a pure version bump of the pinned Python package wallycore from 1.4.0 to 1.5.1 in requirements.txt, including the corresponding SHA-256 hashes for all supported platform wheels. The submodule reference ‘pinserver’ is also updated, but its contents are not shown in the diff. No code changes, vulnerability descriptions, CVE references, or security advisories are present in the commit or supplied references.
Changed components
requirements.txtpinserver submodulewallycore / libwally dependencyInspect captured patch +38 / −38
diff --git a/requirements.txt b/requirements.txt
index e894d0d..1e4dcff 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -5,43 +5,43 @@ cbor2==5.4.6 --hash=sha256:b893500db0fe033e570c3adc956af6eefc57e280026bd2d86fd53
pycodestyle==2.8.0 \
--hash=sha256:720f8b39dde8b293825e7ff02c475f3077124006db4f440dcbc9a20b76548a20 \
--hash=sha256:eddd5847ef438ea1c7870ca7eb78a9d47ce0cdb4851a5523949f2601d0cbbe7f
-wallycore==1.4.0 \
- --hash=sha256:1ad9cbec6b15c3cb26df8889ba50775afbc9bed50b72256280e402867e54e5a1 \
- --hash=sha256:249376879b0074bbc5a34c758956c5c94e742bcffcce3f5bc6f3fcf2fc53e882 \
- --hash=sha256:2ebe5d7af4a35cb81adb3e880244bc622aa00c2ffcc3438a0bea6bdf4762d0e4 \
- --hash=sha256:36300907a6faa043fd5a5d2b3054b915c53a6769ac7c683c0d8eaaa4adb0440f \
- --hash=sha256:36c719f35cd2f2697d7b5cb522ce67b5c589a41ccfd420794ae78648a49dbacc \
- --hash=sha256:3c89d8de2d459916501be6bd63aac2f0deb5742203cbe6f55f49bd23237e271f \
- --hash=sha256:4a2888a3c84825e6b9a5b88593c5f4d08e49b2fafa705ff36920d0db7e0484ee \
- --hash=sha256:4b3c9dc9b05c80bce6581cc8df871953a67c89c47af95f822aff275c10928502 \
- --hash=sha256:55087e7c864fe193e3c915ebaa68331e78048f5c98a371936b80afdadf257033 \
- --hash=sha256:5c9e073455babab54d9eda2b4073f7e84cdee54a59055e163ec16ba93ad22016 \
- --hash=sha256:60201bd58199de38247ab5adc21bdc0a547478ccec4647648b768a6ee43fffa1 \
- --hash=sha256:649c8fa1c39dcb5a7888fada761d3a1ee334a7cb551bd75285603568425de528 \
- --hash=sha256:71aeb345c42a757d6fe3a9ac212f60dd81d814449759cf66c8f07ac1051dc57e \
- --hash=sha256:723cf8cc6dfcab10a521b41de4885e70cf36e556dab20c1301cbb3e36d422149 \
- --hash=sha256:73872451a1a546b152b95a216e839134e1031eda101228bd28189305c0589e27 \
- --hash=sha256:73f46e03bac347b7883f5d0a5a891bcda8d725f1dd03d4b7642e186b2533ec21 \
- --hash=sha256:7a1d2f40b55e14bf6a62beb513c3490ed109247d518ec6f82d645f07533a5a0b \
- --hash=sha256:7f5707fa58ed3bb01fa3bbe184fd3b4ccd67522573b91ed5f09898e9f4bc0969 \
- --hash=sha256:93d9041f9d0746c423144d8ccb5c5e958ce2c241dc3f849817a23b62015922c2 \
- --hash=sha256:95bc3552f7af76ddb5305d88a93ad0dc65a8149c1bab00ce42cec9efb5d76620 \
- --hash=sha256:9dfad024afd331e8d440b778ef1d68caeca13166927d004c43a69a1593945636 \
- --hash=sha256:a17ac294c5a9275c17d7eb059b4e61fdff6e7ce24c474cd5495038605a443239 \
- --hash=sha256:a3bfa201eef45f2ae5de800a85ca755802c2a22950fa73fad4dfb6d8e424519f \
- --hash=sha256:a9afb4a31f8bd195d2c8cc3deb1366dc3ca4f0589c9fa3df0a66d9e5b93537ee \
- --hash=sha256:b00ec029192a4f9f2d0c74a86b01cfd4b3977cfe230d33f333dc6e0f686321da \
- --hash=sha256:b3f3762775826f5dcdc075b52a35fce510eb566c5db6d1d90247e13731a368c8 \
- --hash=sha256:b4093227825370f3fc0c4efef533032cb6c0ff309400e95b1389ed244898d8cb \
- --hash=sha256:c3bb72edbce21b1b4b826a02414a2bd5eda34b7fda714f9244fb1f7323bff982 \
- --hash=sha256:c6191074a3cf57df1f6deee5e2e2a505cd170f9e77b9219b6b26d3117e0d509c \
- --hash=sha256:c95abd953b5675f6fb0d57043ba864af09b4fd240a76b788a22a995968db7fa1 \
- --hash=sha256:ca0b04a0ded7916a000e4c71d7327bb097230216d98b712cbcd013679490cafa \
- --hash=sha256:cb6e6e0dc9a6faafb393bd6558124aa078ffc338f437960d1a40c38a9f004554 \
- --hash=sha256:d8c5971e141c48c2ad59ed95dc43b709f343784587cdecf94e3ef608dfa5b2cb \
- --hash=sha256:e3889c8476974f350c23233b5a42ee9fc4ca570749d3b74eea4fd978376d83f9 \
- --hash=sha256:eec91092f43da69493c02b8658f9cfd055a9b60ba85a506ffc135b94cc4cf157 \
- --hash=sha256:f2cb5d38bf278605987c3436c7015976f4f2412244de4e239073f326ef6f73ed
+wallycore==1.5.1 \
+ --hash=sha256:018f2a6cc53b8465f4ed9f519f4b4bf14914588ca1f28bd2ca69cef8ebad7c6d \
+ --hash=sha256:0b932510c859ac3e1fc57161420ecb2bb9b6562fce7acd1d9351337cc2cc3515 \
+ --hash=sha256:15f4c1d77134794535177bd5b5ca63865fcff953995e6fc3b1d26bc586585353 \
+ --hash=sha256:16a379613493bbcf0964a3a53b1f41b1c591e8f88156b2c96290e1fafeb4c4c0 \
+ --hash=sha256:216e2e7d2e573c5e81b175c66db1dbf63b8932fda084c1f4b3ea6463ba754445 \
+ --hash=sha256:2a4ee4da8aeefaa04d9199b634155b51fd6a8c93c7d1b8d5ec4507c3d89d248a \
+ --hash=sha256:2e86a45232f7dc9c306903b261ac08fa4090cf9396cfb45f355e23e3a5b9cd8d \
+ --hash=sha256:515344c0e85811473bac64f67f19baebdc829b649a9a2e85552f0b4b0394b205 \
+ --hash=sha256:53057128f787ac34b33f45cc9754b7a828c5717802991921a135832cace1d8f9 \
+ --hash=sha256:5ce19b90bb153f25f4e6c18cee23b6b0517791b9dfb6c462d7620fe79598258b \
+ --hash=sha256:5f19e8fd45933d4780ed2fcb7c23105156860bffadeb61e54fa4cd81b93ccd43 \
+ --hash=sha256:619e5239dda0f2cc681942a8cde0a6f04809ed7f3982f19063c75dc820625abb \
+ --hash=sha256:6535e9315aff369224ca57f0cb8ecd68e7134fa34762211c05ee7150bb03566e \
+ --hash=sha256:6c7249cb0dc28891ef0df3467eee97b9195caf04a3bcce253af3a5782713e2f0 \
+ --hash=sha256:6ff57f863bebacaba2d065062de76ce35913fba1968b3c0eb4729696d9450f8e \
+ --hash=sha256:78635dcd112604ad86067d79bcb1dc834342f95da1481ccabaf23aba85be08b1 \
+ --hash=sha256:856af4c3c17c4d57f2b61cec248925302b9cdde1898f6553257f96ca55d7293b \
+ --hash=sha256:90d39b0bf204426da3123b1428bb416d809bd29889b7b2f3edc929df98b70a6d \
+ --hash=sha256:94c4669c8721e1750d3c1580de892aba1aa69f5cbda348b881e0606ac27eca0d \
+ --hash=sha256:9bd07a3197a3c11966bd49c781a26c6cc3c50d26261db87af1a6986d4c98e9f3 \
+ --hash=sha256:a3ef45c05501f1953ae37a7e19a8c0d9ce48275a3acb883f95e67fce37f0c8b6 \
+ --hash=sha256:aa85dbd16e0506aae6accc8c9d71706f5f895f3143d3ec35160aaec94c29bc57 \
+ --hash=sha256:acc59c95a3959121bac558581218647589836839a5a592cdb123e88dffbc3409 \
+ --hash=sha256:bcc23a01efa070a88fa4952369d7e064d6a8e70f8cc11b8a2d2ab5140675343b \
+ --hash=sha256:c460c8111e26fb9aab3ba548f1ad989c88364b2e7154d8b7f285696bddd3a14d \
+ --hash=sha256:c7baa21ac524e130a8800d4ba173668f7164ed6c884bbafe431a9ec8a9bd5fde \
+ --hash=sha256:c996234733929e757b60132a0583f481e5561b7aa73abb9602bb36380fe39b66 \
+ --hash=sha256:cb5fdcee29453541361782d4a22164299c3468cea142bbe380fe0f405f836955 \
+ --hash=sha256:d30ab245d761b62139c29cf3b1e7a2c186d63c4e586871b3a41e52b6a2e4b698 \
+ --hash=sha256:d365c7453ea2abeed668800b3fac5c8ab4971add26904ab667fbd962053a4147 \
+ --hash=sha256:d3cc73efd8156c1e844c97c228c38cf89175d55936591e34e32e9bb3dfe8d507 \
+ --hash=sha256:d8303a7fbc48def1a070b54f88104782a469ac71b10c1e8dcc30afe562aab265 \
+ --hash=sha256:e691d713d449c5fcf91703dd7af9b0c7262db70abd4f69d3242b4fbe63bd7490 \
+ --hash=sha256:ef5b127dc5ad6fd77519b2595b1f15e1610dd38f8c6bb9cc23b2f91b593e582f \
+ --hash=sha256:f18854f4e474792db71894a11ce697979e73782173d6917e6bfff778eebd0224 \
+ --hash=sha256:fb72f18f90e85cb8fbd423d7ffa04037221290be4965a42e657516bd2b4a916f
pycryptodome==3.20.0 \
--hash=sha256:ac1c7c0624a862f2e53438a15c9259d1655325fc2ec4392e66dc46cdae24d044 \
--hash=sha256:76658f0d942051d12a9bd08ca1b6b34fd762a8ee4240984f7c06ddfb55eaf15a \
Risk score
Our methodology →Why this scored 25/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.