Informational 13 Monero Committed Feb 7, 2026 · 14:09 UTC

v5.9.0 Release Candidate (#2871)

174216df View source ↗

Public commit record

What the developer wrote

Authored by Omar Hatem

76/100 · Adequate

v5.9.0 Release Candidate (#2871)

* v5.9.0 Release Candidate
- Zashi migration
- BSC integration
- Prefetch All evm tokens that the user has
- Bug fixes

* Add new monero nodes
Update app versions

* update zkool fork
update release notes

✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This is a routine version-bump release candidate for Cake Wallet/Monero.com (5.8.0 → 5.9.0). It adds BNB Smart Chain support, swaps a Zcash library dependency from a personal GitHub fork to a Cake Labs fork, updates the bundled Monero node list, and bumps build numbers across Android, iOS, Linux, macOS, and Windows. The changes are mostly configuration and dependency metadata; there is no direct evidence in the diff of a security vulnerability or a security fix.

Recommended action

Treat as a normal release-candidate review. Verify the new `cake-tech/zkool2` fork does not introduce unexpected code changes compared with the previous `hhanh00/zkool2` commit; review the trustworthiness and TLS configuration of the newly added Monero nodes; confirm the new iOS plugins (`local_auth_darwin`, `rive_common`, `rlz`, `flutter_native_splash`) are intentional and sourced from trusted packages. No immediate security patch or incident response is indicated by this diff alone.

Security signals we found

Dependency source changed for zkool Zcash library (hhanh00/zkool2 → cake-tech/zkool2)

Default Monero node list updated; one previous default node removed and several new nodes added

New iOS native plugins introduced in Podfile.lock (local_auth_darwin, rive_common, rlz, flutter_native_splash)

No explicit security fix or CVE reference present in commit message or diff

Technical analysis

Evidence from the diff

The commit is a release-candidate packaging change. Notable technical deltas: (1) cw_zcash/pubspec.yaml changes the zkool dependency from hhanh00/zkool2@5d53a3f5 to cake-tech/zkool2@b1642f26; (2) assets/node_list.yml replaces nodes.hashvault.pro:18081 with several community Monero nodes and removes isEnabledForAutoSwitching from the new entries; (3) cakewallet.bat adds --bsc to the Windows build feature flags; (4) version/build numbers are incremented in platform app_env.sh scripts and the Windows installer; (5) ios/Podfile.lock adds entries for flutter_native_splash, local_auth_darwin, rive_common, and rlz plugins. No code-level security fixes or vulnerability-inducing logic are visible in the supplied diff.

Changed components

Cake Wallet / Monero.com v5.9.0 release packagingcw_zcash Zcash module dependency (zkool)assets/node_list.yml Monero node defaultsiOS CocoaPods lockfile (Podfile.lock)Windows build configuration (cakewallet.bat)Cross-platform version/build environment scripts

Inspect captured patch +62 / −22

diff --git a/assets/node_list.yml b/assets/node_list.yml
index 851d6904..568bffb2 100644
--- a/assets/node_list.yml
+++ b/assets/node_list.yml
@@ -13,6 +13,22 @@
   is_default: false
   isEnabledForAutoSwitching: true
 -
-  uri: nodes.hashvault.pro:18081
+  uri: node.monerodevs.org:18089
+  useSSL: true
+  is_default: false
+-
+  uri: node2.monerodevs.org:18089
+  useSSL: true
+  is_default: false
+-
+  uri: node3.monerodevs.org:18089
+  useSSL: true
+  is_default: false
+-
+  uri: selsta1.featherwallet.net:18081
+  useSSL: true
+  is_default: false
+-
+  uri: xmr.stormycloud.org:18089
+  useSSL: true
   is_default: false
-  isEnabledForAutoSwitching: true
diff --git a/assets/text/Release_Notes.txt b/assets/text/Release_Notes.txt
index 2bd37c16..fd5850ef 100644
--- a/assets/text/Release_Notes.txt
+++ b/assets/text/Release_Notes.txt
@@ -1,5 +1,4 @@
-Add Arbitrum
+Add BNB Smart Chain
 Zcash improvements
 EVM chains enhancements
-Integrate Jupiter swaps for Solana
 Bug fixes
\ No newline at end of file
diff --git a/cakewallet.bat b/cakewallet.bat
index d601741d..60b562c0 100644
--- a/cakewallet.bat
+++ b/cakewallet.bat
@@ -1,5 +1,5 @@
 @echo off
-set cw_win_app_config=--monero --bitcoin --ethereum --polygon --nano --bitcoinCash --solana --tron --dogecoin --base --arbitrum
+set cw_win_app_config=--monero --bitcoin --ethereum --polygon --nano --bitcoinCash --solana --tron --dogecoin --base --arbitrum --bsc
 set cw_root=%cd%
 set cw_archive_name=Cake Wallet.zip
 set cw_archive_path=%cw_root%\%cw_archive_name%
diff --git a/cw_zcash/pubspec.yaml b/cw_zcash/pubspec.yaml
index 1a153f9f..37dbb8d6 100644
--- a/cw_zcash/pubspec.yaml
+++ b/cw_zcash/pubspec.yaml
@@ -21,8 +21,8 @@ dependencies:
   flat_buffers: any
   zkool:
     git:
-      url: https://github.com/hhanh00/zkool2
-      ref: 5d53a3f5a2d8f5b0619248384d7431f0a185e171
+      url: https://github.com/cake-tech/zkool2
+      ref: b1642f260da4fa00dd2f8d4dd689073d0b56960a
 
 dependency_overrides:
   decimal: ^2.3.3
diff --git a/ios/Podfile.lock b/ios/Podfile.lock
index b9a91958..ab068954 100644
--- a/ios/Podfile.lock
+++ b/ios/Podfile.lock
@@ -65,6 +65,8 @@ PODS:
     - Flutter
   - flutter_mailer (0.0.1):
     - Flutter
+  - flutter_native_splash (2.4.3):
+    - Flutter
   - flutter_secure_storage (6.0.0):
     - Flutter
   - fluttertoast (0.0.2):
@@ -75,6 +77,9 @@ PODS:
     - Flutter
   - integration_test (0.0.1):
     - Flutter
+  - local_auth_darwin (0.0.1):
+    - Flutter
+    - FlutterMacOS
   - OrderedSet (6.0.3)
   - package_info_plus (0.4.5):
     - Flutter
@@ -89,6 +94,10 @@ PODS:
   - reown_yttrium (0.0.1):
     - Flutter
     - YttriumWrapper (= 0.8.35)
+  - rive_common (0.0.1):
+    - Flutter
+  - rlz (0.0.1):
+    - Flutter
   - SDWebImage (5.21.2):
     - SDWebImage/Core (= 5.21.2)
   - SDWebImage/Core (5.21.2)
@@ -162,17 +171,21 @@ DEPENDENCIES:
   - flutter_local_authentication (from `.symlinks/plugins/flutter_local_authentication/ios`)
   - flutter_local_notifications (from `.symlinks/plugins/flutter_local_notifications/ios`)
   - flutter_mailer (from `.symlinks/plugins/flutter_mailer/ios`)
+  - flutter_native_splash (from `.symlinks/plugins/flutter_native_splash/ios`)
   - flutter_secure_storage (from `.symlinks/plugins/flutter_secure_storage/ios`)
   - fluttertoast (from `.symlinks/plugins/fluttertoast/ios`)
   - image_picker_ios (from `.symlinks/plugins/image_picker_ios/ios`)
   - in_app_review (from `.symlinks/plugins/in_app_review/ios`)
   - integration_test (from `.symlinks/plugins/integration_test/ios`)
+  - local_auth_darwin (from `.symlinks/plugins/local_auth_darwin/darwin`)
   - package_info_plus (from `.symlinks/plugins/package_info_plus/ios`)
   - path_provider_foundation (from `.symlinks/plugins/path_provider_foundation/darwin`)
   - payjoin_flutter (from `.symlinks/plugins/payjoin_flutter/ios`)
   - permission_handler_apple (from `.symlinks/plugins/permission_handler_apple/ios`)
   - quick_actions_ios (from `.symlinks/plugins/quick_actions_ios/ios`)
   - reown_yttrium (from `.symlinks/plugins/reown_yttrium/ios`)
+  - rive_common (from `.symlinks/plugins/rive_common/ios`)
+  - rlz (from `.symlinks/plugins/rlz/ios`)
   - sensitive_clipboard (from `.symlinks/plugins/sensitive_clipboard/ios`)
   - share_plus (from `.symlinks/plugins/share_plus/ios`)
   - shared_preferences_foundation (from `.symlinks/plugins/shared_preferences_foundation/darwin`)
@@ -228,6 +241,8 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/flutter_local_notifications/ios"
   flutter_mailer:
     :path: ".symlinks/plugins/flutter_mailer/ios"
+  flutter_native_splash:
+    :path: ".symlinks/plugins/flutter_native_splash/ios"
   flutter_secure_storage:
     :path: ".symlinks/plugins/flutter_secure_storage/ios"
   fluttertoast:
@@ -238,6 +253,8 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/in_app_review/ios"
   integration_test:
     :path: ".symlinks/plugins/integration_test/ios"
+  local_auth_darwin:
+    :path: ".symlinks/plugins/local_auth_darwin/darwin"
   package_info_plus:
     :path: ".symlinks/plugins/package_info_plus/ios"
   path_provider_foundation:
@@ -250,6 +267,10 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/quick_actions_ios/ios"
   reown_yttrium:
     :path: ".symlinks/plugins/reown_yttrium/ios"
+  rive_common:
+    :path: ".symlinks/plugins/rive_common/ios"
+  rlz:
+    :path: ".symlinks/plugins/rlz/ios"
   sensitive_clipboard:
     :path: ".symlinks/plugins/sensitive_clipboard/ios"
   share_plus:
@@ -294,11 +315,13 @@ SPEC CHECKSUMS:
   flutter_local_authentication: 1172a4dd88f6306dadce067454e2c4caf07977bb
   flutter_local_notifications: ff50f8405aaa0ccdc7dcfb9022ca192e8ad9688f
   flutter_mailer: 2ef5a67087bc8c6c4cefd04a178bf1ae2c94cd83
+  flutter_native_splash: df59bb2e1421aa0282cb2e95618af4dcb0c56c29
   flutter_secure_storage: 23fc622d89d073675f2eaa109381aefbcf5a49be
   fluttertoast: 21eecd6935e7064cc1fcb733a4c5a428f3f24f0f
   image_picker_ios: c560581cceedb403a6ff17f2f816d7fea1421fc1
   in_app_review: 436034b18594851a7328d7f1c2ed5ec235b79cfc
   integration_test: 252f60fa39af5e17c3aa9899d35d908a0721b573
+  local_auth_darwin: fa4b06454df7df8e97c18d7ee55151c57e7af0de
   OrderedSet: e539b66b644ff081c73a262d24ad552a69be3a94
   package_info_plus: c0502532a26c7662a62a356cebe2692ec5fe4ec4
   path_provider_foundation: 2b6b4c569c0fb62ec74538f866245ac84301af46
@@ -306,6 +329,8 @@ SPEC CHECKSUMS:
   permission_handler_apple: 9878588469a2b0d0fc1e048d9f43605f92e6cec2
   quick_actions_ios: 56f3cbaa71e94f212838d1f9fe354bd0734779bf
   reown_yttrium: c0e87e5965fa60a3559564cc35cffbba22976089
+  rive_common: 4743dbfd2911c99066547a3c6454681e0fa907df
+  rlz: d9288e8760ae2d7494b56d63cda672cfb21b8d61
   SDWebImage: 9f177d83116802728e122410fb25ad88f5c7608a
   sensitive_clipboard: d4866e5d176581536c27bb1618642ee83adca986
   share_plus: 8b6f8b3447e494cca5317c8c3073de39b3600d1f
diff --git a/scripts/android/app_env.sh b/scripts/android/app_env.sh
index f4e50e42..8e19bd1d 100644
--- a/scripts/android/app_env.sh
+++ b/scripts/android/app_env.sh
@@ -14,15 +14,15 @@ TYPES=($MONERO_COM $CAKEWALLET)
 APP_ANDROID_TYPE=$1
 
 MONERO_COM_NAME="Monero.com"
-MONERO_COM_VERSION="5.8.0"
-MONERO_COM_BUILD_NUMBER=4151
+MONERO_COM_VERSION="5.9.0"
+MONERO_COM_BUILD_NUMBER=4152
 MONERO_COM_BUNDLE_ID="com.monero.app"
 MONERO_COM_PACKAGE="com.monero.app"
 MONERO_COM_SCHEME="monero.com"
 
 CAKEWALLET_NAME="Cake Wallet"
-CAKEWALLET_VERSION="5.8.0"
-CAKEWALLET_BUILD_NUMBER=4301
+CAKEWALLET_VERSION="5.9.0"
+CAKEWALLET_BUILD_NUMBER=4302
 CAKEWALLET_BUNDLE_ID="com.cakewallet.cake_wallet"
 CAKEWALLET_PACKAGE="com.cakewallet.cake_wallet"
 CAKEWALLET_SCHEME="cakewallet"
diff --git a/scripts/ios/app_env.sh b/scripts/ios/app_env.sh
index 53a10bf2..e2049b3f 100644
--- a/scripts/ios/app_env.sh
+++ b/scripts/ios/app_env.sh
@@ -12,13 +12,13 @@ TYPES=($MONERO_COM $CAKEWALLET)
 APP_IOS_TYPE=$1
 
 MONERO_COM_NAME="Monero.com"
-MONERO_COM_VERSION="5.8.0"
-MONERO_COM_BUILD_NUMBER=155
+MONERO_COM_VERSION="5.9.0"
+MONERO_COM_BUILD_NUMBER=156
 MONERO_COM_BUNDLE_ID="com.cakewallet.monero"
 
 CAKEWALLET_NAME="Cake Wallet"
-CAKEWALLET_VERSION="5.8.0"
-CAKEWALLET_BUILD_NUMBER=368
+CAKEWALLET_VERSION="5.9.0"
+CAKEWALLET_BUILD_NUMBER=369
 CAKEWALLET_BUNDLE_ID="com.fotolockr.cakewallet"
 
 
diff --git a/scripts/linux/app_env.sh b/scripts/linux/app_env.sh
index b4bcb8ab..1c0b3776 100755
--- a/scripts/linux/app_env.sh
+++ b/scripts/linux/app_env.sh
@@ -14,8 +14,8 @@ if [ -n "$1" ]; then
 fi
 
 CAKEWALLET_NAME="Cake Wallet"
-CAKEWALLET_VERSION="5.8.0"
-CAKEWALLET_BUILD_NUMBER=76
+CAKEWALLET_VERSION="5.9.0"
+CAKEWALLET_BUILD_NUMBER=77
 
 if ! [[ " ${TYPES[*]} " =~ " ${APP_LINUX_TYPE} " ]]; then
     echo "Wrong app type."
diff --git a/scripts/macos/app_env.sh b/scripts/macos/app_env.sh
index 0d47299d..1df0e93b 100755
--- a/scripts/macos/app_env.sh
+++ b/scripts/macos/app_env.sh
@@ -16,13 +16,13 @@ if [ -n "$1" ]; then
 fi
 
 MONERO_COM_NAME="Monero.com"
-MONERO_COM_VERSION="5.8.0"
-MONERO_COM_BUILD_NUMBER=76
+MONERO_COM_VERSION="5.9.0"
+MONERO_COM_BUILD_NUMBER=77
 MONERO_COM_BUNDLE_ID="com.cakewallet.monero"
 
 CAKEWALLET_NAME="Cake Wallet"
-CAKEWALLET_VERSION="5.8.0"
-CAKEWALLET_BUILD_NUMBER=144
+CAKEWALLET_VERSION="5.9.0"
+CAKEWALLET_BUILD_NUMBER=145
 CAKEWALLET_BUNDLE_ID="com.fotolockr.cakewallet"
 
 if ! [[ " ${TYPES[*]} " =~ " ${APP_MACOS_TYPE} " ]]; then
diff --git a/scripts/windows/build_exe_installer.iss b/scripts/windows/build_exe_installer.iss
index ebc25bb3..aa717cd1 100644
--- a/scripts/windows/build_exe_installer.iss
+++ b/scripts/windows/build_exe_installer.iss
@@ -1,5 +1,5 @@
 #define MyAppName "Cake Wallet"
-#define MyAppVersion "5.8.0"
+#define MyAppVersion "5.9.0"
 #define MyAppPublisher "Cake Labs LLC"
 #define MyAppURL "https://cakewallet.com/"
 #define MyAppExeName "CakeWallet.exe"

Risk score

Why this scored 13/100

Our methodology →

Potential impact 2/30

Exploitability 2/25

Stealth signal 1/15

Affected reach 3/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 13/100

Community notes

Related watches

fix: add new images and fix integration tests (#3679)

Add Robinhood Chain (#3398)

chore: migrate to hosted scalable CI (#3620)