Bump minimum required version of ledger_bitcoin (build-time and runtime)
What the developer wrote
Authored by Ilya Artemov
Bump minimum required version of ledger_bitcoin (build-time and runtime)
What changed, and why it matters
This commit simply raises the minimum required version of the ledger_bitcoin library that Electrum uses to talk to Ledger hardware wallets. It does not by itself fix any specific bug; it is a dependency version bump that may be a follow-up to a security fix in the upstream library, but the commit message gives no details.
Treat as a routine dependency bump unless paired with a security advisory for ledger-bitcoin <0.4.1. Users relying on Ledger hardware wallets should ensure they are running ledger-bitcoin >=0.4.1. Review the ledger-bitcoin changelog between 0.2.0 and 0.4.1 for any security-relevant fixes.
Security signals we found
Dependency minimum version raised, which can be a response to a security fix in the upstream library
No direct code-level security fix is visible in the diff
No vendor security explanation is present in the commit message
Evidence from the diff
The change updates ledger-bitcoin from >=0.2.0 to >=0.4.1 in requirements-hw.txt and sets the runtime minimum_library tuple to (0, 4, 1) in electrum/plugins/ledger/ledger.py. No code logic is modified. The commit message does not state a CVE, vulnerability, or security reason for the bump.
Changed components
Ledger hardware wallet pluginelectrum/plugins/ledger/ledger.pycontrib/requirements/requirements-hw.txtInspect captured patch +2 / −2
diff --git a/contrib/requirements/requirements-hw.txt b/contrib/requirements/requirements-hw.txt
index 2a6f7d9..a0a8a4c 100644
--- a/contrib/requirements/requirements-hw.txt
+++ b/contrib/requirements/requirements-hw.txt
@@ -14,7 +14,7 @@ hidapi>=0.7.99.post15
libusb1>=1.6
# device plugin: ledger
-ledger-bitcoin>=0.2.0,<1.0
+ledger-bitcoin>=0.4.1,<1.0
hidapi
# device plugin: coldcard
diff --git a/electrum/plugins/ledger/ledger.py b/electrum/plugins/ledger/ledger.py
index 5dcc56c..f00497f 100644
--- a/electrum/plugins/ledger/ledger.py
+++ b/electrum/plugins/ledger/ledger.py
@@ -1251,7 +1251,7 @@ class Ledger_KeyStore(Hardware_KeyStore):
class LedgerPlugin(HW_PluginBase):
keystore_class = Ledger_KeyStore
- minimum_library = (0, 2, 0)
+ minimum_library = (0, 4, 1)
maximum_library = (1, 0)
DEVICE_IDS = [(0x2581, 0x1807), # HW.1 legacy btchip # not supported anymore (but we log an exception)
(0x2581, 0x2b7c), # HW.1 transitional production # not supported anymore
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.