What the developer wrote
Authored by Jon Griffiths
Update CHANGELOG.md
What changed, and why it matters
This commit only updates the project's CHANGELOG.md file to add release notes for version 1.0.41. It does not change any source code, build scripts, or configuration. The changelog text itself states that version 1.0.41 contains important security updates and thanks several security researchers, but this commit is purely documentation and does not implement any of those updates.
No action is required for this documentation commit. Users and operators should follow the changelog's advice to upgrade to firmware 1.0.41 or later, and reviewers should inspect the actual code changes that implement the listed security updates separately.
Security signals we found
Changelog describes prior security fixes in release 1.0.41
Mentions external security researchers and tools (Loupe, Kvazar)
References security-relevant improvements: stack protection, entropy, secure version, memory scrubbing, thread safety
Evidence from the diff
The diff is limited to CHANGELOG.md, adding a new section for release 1.0.41. The added text mentions security-related items such as improved stack protection, additional per-device entropy, secure-version increment, memory-scrubbing improvements, and validation/error-handling/thread-safety improvements. However, none of these changes are present in this commit; they are only described in the changelog. Therefore, this commit has no direct security effect and cannot be exploited or patched by itself.
Changed components
CHANGELOG.mdInspect captured patch +49 / −0
### CHANGELOG.md
@@ -4,6 +4,55 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [1.0.41] - 2026-08-22
+
+Note: This release contains important security updates; All users should
+upgrade as soon as possible. The developers would like to thank:
+
+- Jordan Mecom from Spiral for developing Loupe and reporting issues to us
+ for this and previous releases. You can read more about the Loupe project
+ here: https://spiralbtc.substack.com/p/meet-loupe-ai-powered-vulnerability.
+- 0xaudron (@0xaudron)for developing Kvazar (@kvazar_ai), an agentic security
+ harness, and reporting issues to us for this release.
+- Damir, odudex, ZatoshiX, @erickcestari, @popodai and Bitcoin Red Team for
+ help investigating and fixing several important issues for this release.
+
+Added:
+- Improve stack protection for production devices.
+- Add support for registering and signing with Liquid descriptors (development devices only).
+- Add support for custom genesis blockhashes when signing Liquid transactions.
+- Add support for running libjade with GUI/input/nvs/camera support.
+- Add a libjade GUI example runnable as a desktop application.
+- Add additional per-device entropy to the initial random seed.
+- Increment secure version to prevent firmware downgrades from this release.
+
+Changed:
+- Update IDF framework to version 5.5.4.
+- Update Python dependencies to the latest known-good versions.
+- Update libwally and libsecp256k1-zkp to their latest releases.
+- Create new docker build images to ensure consistent builds.
+- Rename displayed L-BTC asset issuer from 'peg-in' to 'federation' for clarity.
+- Update message handling to use less memory and be more robust with slow or flaky connections.
+- Optimizations for qr mode processing and smoother display updates.
+- Optimizations to reduce firmware size, stack and memory usage.
+- Bump jadepy to release 1.0.41.
+
+Fixed:
+- Fix device reboot when restarting while connected to an overly-chatty host.
+- Fix jade_ota.py in "download-only" mode.
+- Fix device hang instead of reboot in certain circumstances.
+- Fix `sign_tx` call in `jade_cli.py`.
+- Various documentation fixes.
+- Work around ABI differences in cbor2 versions to make installation/packaging easier.
+- Improved defense-in-depth internal memory scrubbing of sensitive data.
+- Fix DIY M5StickC Plus 2 PIN navigation.
+- GUI spelling fixes.
+- QEMU fixes and helper script updates.
+- Many build and test infrastructure cleanups and fixes.
+- Various internal improvements for validation, error handling and thread safety.
+- Various minor bug fixes resulting from build/test infrastructure improvements.
+- Clean up large GUI activities sooner to prevent memory fragmentation.
+
## [1.0.40] - 2026-04-30
### AddedWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.