build: update pinned ledger-bitcoin (partial rerun freeze_packages)
What changed, and why it matters
This commit simply bumps the pinned version of the ledger-bitcoin Python package from 0.4.0 to 0.4.1 in Electrum's deterministic build requirements file. It updates the package hash fingerprints accordingly. There is no code change, no disclosed security fix, and no independent security analysis provided. On its own, this is a routine dependency maintenance patch with no identifiable security relevance.
No immediate security action is indicated by this commit alone. If reviewing for supply-chain risk, verify the ledger-bitcoin 0.4.1 release notes for any security fixes and confirm the published hashes match the new pinned values.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff updates contrib/deterministic-build/requirements-hw.txt to pin ledger-bitcoin==0.4.1 instead of 0.4.0, replacing the two expected SHA-256 hashes. This is a deterministic-build pin update for a hardware-wallet dependency. The commit message frames it as a partial rerun of freeze_packages. No vulnerability details, CVE, advisory, or security rationale is present in the commit or supplied references.
Changed components
contrib/deterministic-build/requirements-hw.txtledger-bitcoin dependency pinInspect captured patch +3 / −3
diff --git a/contrib/deterministic-build/requirements-hw.txt b/contrib/deterministic-build/requirements-hw.txt
index 7e9f6d3..99956bb 100644
--- a/contrib/deterministic-build/requirements-hw.txt
+++ b/contrib/deterministic-build/requirements-hw.txt
@@ -349,9 +349,9 @@ hidapi==0.14.0.post4 \
idna==3.10 \
--hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \
--hash=sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3
-ledger-bitcoin==0.4.0 \
- --hash=sha256:2242452e78cf4b57c8b8d3509e831860fd4851b0a1bfab95f2f5e3f47d4d1500 \
- --hash=sha256:a33e78710671ec21e1003d0483406e955b48866ccf515fd8e7d8d81f4e1c1cf9
+ledger-bitcoin==0.4.1 \
+ --hash=sha256:3cb4297ed7e557ef98349cdcbd667ef7368c047d6818c7cdcbca7af98b8006b6 \
+ --hash=sha256:b1fe1cdfd0f869f1e27968118832b11708904f71840b0a97219a0492ce1a7002
ledgercomm==1.2.1 \
--hash=sha256:015cfc05f16b8c59f8cc1d9fc0b8935923f1fcc3806d33eeb6b0e055b44f5a91 \
--hash=sha256:8ffef5703355b8ec7b73bca325f70288f4d0dafcb299c09833de9c197fb6dd34
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.