← Watch feed
Update python/pinserver libwally to 1.5.3
Public commit record
45/100 · Thin
What the developer wrote
Authored by Jon Griffiths
Update python/pinserver libwally to 1.5.3
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
What changed, and why it matters
This commit simply updates a dependency called wallycore (a cryptography library used by Blockstream Jade) from version 1.5.1 to 1.5.3 in the Python pinserver requirements. The diff only changes pinned package hashes; there is no code change or explanation of why the update was made. Without a vendor security advisory or changelog, we cannot tell whether this fixes a security issue or is just routine maintenance.
Recommended action
Review the wallycore 1.5.2 and 1.5.3 release notes or changelog to determine whether this update addresses any security-relevant bug. If it does, assess whether the pinserver or Jade firmware is exposed to the fixed issue and consider expediting deployment.
Security signals we found
01
Dependency version bump of a cryptographic library (wallycore)
02
No commit message detail or CVE reference provided
03
No source code changes visible in the diff
04
Pinserver submodule pointer updated without shown content
Evidence from the diff
The commit updates the pinned wallycore package in requirements.txt from 1.5.1 to 1.5.3, replacing all SHA-256 hashes accordingly. The submodule reference ‘pinserver’ is also updated (binary change, no diff content shown). No source code modifications, vulnerability descriptions, or release notes are present in the supplied materials.
Changed components
requirements.txtpinserver submodulewallycore Python packageInspect captured patch +38 / −38
diff --git a/requirements.txt b/requirements.txt
index f388e63..3030d0e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -49,43 +49,43 @@ cbor2==5.9.0 \
pycodestyle==2.8.0 \
--hash=sha256:720f8b39dde8b293825e7ff02c475f3077124006db4f440dcbc9a20b76548a20 \
--hash=sha256:eddd5847ef438ea1c7870ca7eb78a9d47ce0cdb4851a5523949f2601d0cbbe7f
-wallycore==1.5.1 \
- --hash=sha256:018f2a6cc53b8465f4ed9f519f4b4bf14914588ca1f28bd2ca69cef8ebad7c6d \
- --hash=sha256:0b932510c859ac3e1fc57161420ecb2bb9b6562fce7acd1d9351337cc2cc3515 \
- --hash=sha256:15f4c1d77134794535177bd5b5ca63865fcff953995e6fc3b1d26bc586585353 \
- --hash=sha256:16a379613493bbcf0964a3a53b1f41b1c591e8f88156b2c96290e1fafeb4c4c0 \
- --hash=sha256:216e2e7d2e573c5e81b175c66db1dbf63b8932fda084c1f4b3ea6463ba754445 \
- --hash=sha256:2a4ee4da8aeefaa04d9199b634155b51fd6a8c93c7d1b8d5ec4507c3d89d248a \
- --hash=sha256:2e86a45232f7dc9c306903b261ac08fa4090cf9396cfb45f355e23e3a5b9cd8d \
- --hash=sha256:515344c0e85811473bac64f67f19baebdc829b649a9a2e85552f0b4b0394b205 \
- --hash=sha256:53057128f787ac34b33f45cc9754b7a828c5717802991921a135832cace1d8f9 \
- --hash=sha256:5ce19b90bb153f25f4e6c18cee23b6b0517791b9dfb6c462d7620fe79598258b \
- --hash=sha256:5f19e8fd45933d4780ed2fcb7c23105156860bffadeb61e54fa4cd81b93ccd43 \
- --hash=sha256:619e5239dda0f2cc681942a8cde0a6f04809ed7f3982f19063c75dc820625abb \
- --hash=sha256:6535e9315aff369224ca57f0cb8ecd68e7134fa34762211c05ee7150bb03566e \
- --hash=sha256:6c7249cb0dc28891ef0df3467eee97b9195caf04a3bcce253af3a5782713e2f0 \
- --hash=sha256:6ff57f863bebacaba2d065062de76ce35913fba1968b3c0eb4729696d9450f8e \
- --hash=sha256:78635dcd112604ad86067d79bcb1dc834342f95da1481ccabaf23aba85be08b1 \
- --hash=sha256:856af4c3c17c4d57f2b61cec248925302b9cdde1898f6553257f96ca55d7293b \
- --hash=sha256:90d39b0bf204426da3123b1428bb416d809bd29889b7b2f3edc929df98b70a6d \
- --hash=sha256:94c4669c8721e1750d3c1580de892aba1aa69f5cbda348b881e0606ac27eca0d \
- --hash=sha256:9bd07a3197a3c11966bd49c781a26c6cc3c50d26261db87af1a6986d4c98e9f3 \
- --hash=sha256:a3ef45c05501f1953ae37a7e19a8c0d9ce48275a3acb883f95e67fce37f0c8b6 \
- --hash=sha256:aa85dbd16e0506aae6accc8c9d71706f5f895f3143d3ec35160aaec94c29bc57 \
- --hash=sha256:acc59c95a3959121bac558581218647589836839a5a592cdb123e88dffbc3409 \
- --hash=sha256:bcc23a01efa070a88fa4952369d7e064d6a8e70f8cc11b8a2d2ab5140675343b \
- --hash=sha256:c460c8111e26fb9aab3ba548f1ad989c88364b2e7154d8b7f285696bddd3a14d \
- --hash=sha256:c7baa21ac524e130a8800d4ba173668f7164ed6c884bbafe431a9ec8a9bd5fde \
- --hash=sha256:c996234733929e757b60132a0583f481e5561b7aa73abb9602bb36380fe39b66 \
- --hash=sha256:cb5fdcee29453541361782d4a22164299c3468cea142bbe380fe0f405f836955 \
- --hash=sha256:d30ab245d761b62139c29cf3b1e7a2c186d63c4e586871b3a41e52b6a2e4b698 \
- --hash=sha256:d365c7453ea2abeed668800b3fac5c8ab4971add26904ab667fbd962053a4147 \
- --hash=sha256:d3cc73efd8156c1e844c97c228c38cf89175d55936591e34e32e9bb3dfe8d507 \
- --hash=sha256:d8303a7fbc48def1a070b54f88104782a469ac71b10c1e8dcc30afe562aab265 \
- --hash=sha256:e691d713d449c5fcf91703dd7af9b0c7262db70abd4f69d3242b4fbe63bd7490 \
- --hash=sha256:ef5b127dc5ad6fd77519b2595b1f15e1610dd38f8c6bb9cc23b2f91b593e582f \
- --hash=sha256:f18854f4e474792db71894a11ce697979e73782173d6917e6bfff778eebd0224 \
- --hash=sha256:fb72f18f90e85cb8fbd423d7ffa04037221290be4965a42e657516bd2b4a916f
+wallycore==1.5.3 \
+ --hash=sha256:01fd8497bd005c4222ef628742eacb5325d47f647763ce6bdd4f189da11503b1 \
+ --hash=sha256:042aaf0c24da8fec6e479a37f17855fcc9ce866ce4aeb76da82cee9c46cc157d \
+ --hash=sha256:04f48b6790835eea74805ac8b75e53dd487b7ab61daf83d9fac14ee77236582f \
+ --hash=sha256:09037840cba79f68723b2fa06b41b3c131a142d239d57681c63d26e207d7a6f5 \
+ --hash=sha256:0cd5c5a060e09931d06527c6065c4e6b47424e68bbc192015f0b17049a1c0496 \
+ --hash=sha256:0e8103ecdde64e6d5a00bfe2ddca35ba290d4c8c55ca2c4c97a865d0ab474f5f \
+ --hash=sha256:10750069e04cf5875f3e2df50e3494b0f0bae4b79de80b5df7f00d3dd7705b9b \
+ --hash=sha256:146640621c4b1fa04b8ec6284fce84f6914982fe60da2b0d34cf5157f31627c7 \
+ --hash=sha256:20078d7ceee385971dd457f659097c8145c25c1b3abf006c425482721b13399c \
+ --hash=sha256:2a9e8e8b99995520818bea31f5fdfe76bf15f8a9c46d28b9fdd4ee3e1eb55a48 \
+ --hash=sha256:31383cdf4e6473dd2d99b62de3144e4b7c172ff317f646a90607e681305782d1 \
+ --hash=sha256:32c87a460e997097f094ce47e830605a4bfb6d43d9d7e1f7f6f98f2c5c6f8dba \
+ --hash=sha256:346309b1c491439338d63ed36bd25e448015cfe2da654908f5657bcc1d9076fc \
+ --hash=sha256:3d9bf4b45b390c7f01f83325057fd04b8bc64df63b75e87e421624c2ccb29ed3 \
+ --hash=sha256:3da743c065425cd4a3bb5c02157b558164d9100cd571fe11ed78774232717847 \
+ --hash=sha256:3dba21b8b16a484f873e5a32b7342407b4b38f5c2556e4212842359adb563aa3 \
+ --hash=sha256:4707fdc084e206384f8446780c03f8c60658e604edc10a17cb95859342d43a0c \
+ --hash=sha256:51c845bdb19063d5974591e7f8a9044845735c81bfebd6aa5fff34f9e5578f08 \
+ --hash=sha256:5fe110696bbd54c67fdff940d5319fd3b435f4d993969c0eb9dac5d4506933a7 \
+ --hash=sha256:66b33836b1bf6949d134ef914cb31d4c068fb2b3c2e403d4e1fb480cb580f45e \
+ --hash=sha256:7b55c7bca6bcae0b624463b5d4a051aa90edca030ec6f8bcfd18fa572023fe91 \
+ --hash=sha256:7f69e968b4486d100cd33e4c6a1a9cc1cb8bc19c7d6330aba23f6ffd6ba3f621 \
+ --hash=sha256:818d3d1fc90fd1312d622ceb743eb15910778b3b07bc9f958751129cf4a8fa35 \
+ --hash=sha256:85ad55687ee09ce64686e9f8a73967736897697b5e3f8ee0c92814cf180325bc \
+ --hash=sha256:9ae08d68215d6eb52fa295c632eb2a7f4e08115b6b8dde6d8582813569c04e05 \
+ --hash=sha256:a86225e290233f46f65837b957f84d5dd65d2844d9ca9bd0ebea5a3e4029797d \
+ --hash=sha256:ac1bd614605f58b89283cb69d8f2dfa90fccbc2c12893c675024d0dc518900c8 \
+ --hash=sha256:b5e1831802f6b0b87e2ce150b7e0fc80c5f4e647930f341e7878e66a0d571529 \
+ --hash=sha256:b689a7e13944acfaf5abe1ab70489a94842832f7043b6efc8f3ecf64da15e145 \
+ --hash=sha256:c00d6784a6328acbcab5ad36b4489976e8a93bbc662686a1eeb5563ba427f61f \
+ --hash=sha256:c3343a1df11a7ef4572521e002f4550a0157aea2c749dcfd9be62fb5babe0d03 \
+ --hash=sha256:d197e78aa6c0058f4fd5fac325ab0d6d71a066f9cf1022ea26e50bb8cc8eb84d \
+ --hash=sha256:dc2fad7db42482364e558a8c920f9d96879726ebeab8c10daa3a290beec36191 \
+ --hash=sha256:de2aa4f88deabf3a8e3dfcd85986a6023ba9c65e18df7ad3e01a5b6232fd147b \
+ --hash=sha256:e2ac7717c72a121f0c72e06e336b3d50b42bb3df780d0da91ade1958f6f6176b \
+ --hash=sha256:f9a7c29e9d63a07dd78b63e498cac65e014dc118536fc47be9616295c081c2f4
pycryptodome==3.20.0 \
--hash=sha256:ac1c7c0624a862f2e53438a15c9259d1655325fc2ec4392e66dc46cdae24d044 \
--hash=sha256:76658f0d942051d12a9bd08ca1b6b34fd762a8ee4240984f7c06ddfb55eaf15a \
Risk score
Our methodology →Why this scored 25/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.