setup.py: "qml_gui" extra: restrict pyqt to "6.10.x"
What the developer wrote
Authored by SomberNight
setup.py: "qml_gui" extra: restrict pyqt to "6.10.x"
I had misunderstood how "~=" works.
Previous meant >=6.10, but any 6.x.
While I actually wanted 6.10.0<=v<6.11.
follow-up 96a3345ab5a3c41c89b4b5bac2d8bde12d753392
ref https://peps.python.org/pep-0440/#compatible-release
What changed, and why it matters
This commit tightens a Python package version pin. The developer had accidentally allowed any PyQt 6.x release (e.g., 6.11, 6.12) to be installed for the optional QML GUI, when they only wanted the 6.10.x line. The change itself is a preventive dependency fix, not a patch for an active vulnerability in Electrum's code. It reduces the risk that a future, incompatible, or buggy PyQt release could break or destabilize the QML GUI.
Treat as a routine dependency hygiene fix. If auditing, verify that the chosen 6.10.2 version has no known unfixed CVEs and that the QML GUI tests pass with this pin. No urgent security response is indicated by the commit itself.
Security signals we found
Dependency version constraint correction
Preventive supply-chain/dependency risk reduction
No mention of CVE, exploit, vulnerability, or security bug in commit message or diff
Evidence from the diff
In setup.py the ‘qml_gui’ extras_require entries were changed from ‘pyqt6~=6.10’ and ‘pyqt6-qt6~=6.10’ to ‘pyqt6~=6.10.2’ and ‘pyqt6-qt6~=6.10.2’. Under PEP 440, ~=6.10 means >=6.10.0, ==6. (any 6.x), while ~=6.10.2 means >=6.10.2, ==6.10.. This is a dependency-range correction to align with the Android build’s PyQt version and avoid unintended future upgrades. No Electrum source code is modified, and no specific CVE or exploit is referenced.
Changed components
setup.py extras_require['qml_gui']PyQt6 / PyQt6-Qt6 dependency specification for optional QML GUIInspect captured patch +1 / −1
diff --git a/setup.py b/setup.py
index 99cb955..1f81681 100755
--- a/setup.py
+++ b/setup.py
@@ -45,7 +45,7 @@ extras_require = {
'gui': ['pyqt6'],
'crypto': ['cryptography>=2.6'],
'tests': ['pycryptodomex>=3.7', 'cryptography>=2.6', 'pyaes>=0.1a1'],
- 'qml_gui': ['pyqt6~=6.10', 'pyqt6-qt6~=6.10'], # should be same-ish version as Android build uses?
+ 'qml_gui': ['pyqt6~=6.10.2', 'pyqt6-qt6~=6.10.2'], # should be same-ish version as Android build uses?
}
# 'full' extra that tries to grab everything an enduser would need (except for libsecp256k1...)
extras_require['full'] = [pkg for sublist in
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.