setup.py: "qml_gui" extra: update pyqt version
What the developer wrote
Authored by SomberNight
setup.py: "qml_gui" extra: update pyqt version
What changed, and why it matters
This commit updates the recommended PyQt6 version for Electrum's newer QML-based graphical interface. It loosens the version pin from below 6.6 to approximately 6.10, and removes notes saying 6.4 worked best because 6.5 was needed for a missing module. On its own, this is a routine dependency bump, not a clear security fix. However, pinning to an older PyQt6 branch can carry unpatched Qt/PyQt bugs, so moving to a newer supported line is generally healthier for security.
Treat as a maintenance/dependency update. Verify that PyQt6 6.10.x and the matching PyQt6-Qt6 wheels work correctly with the QML GUI on supported platforms. Review Qt 6.10 release notes for any security fixes compared to 6.5/6.6, and consider whether users on the old pin need guidance to upgrade. No urgent security response is indicated by this commit alone.
Security signals we found
Dependency version pin changed for PyQt6 / PyQt6-Qt6
Older version constraint (<6.6) removed
No CVE, advisory, or security wording in commit message or diff
No code-level vulnerability fix present
Evidence from the diff
The change modifies setup.py extras_require[‘qml_gui’] from [‘pyqt6<6.6’, ‘pyqt6-qt6<6.6’] to [‘pyqt6~=6.10’, ‘pyqt6-qt6~=6.10’] and deletes two explanatory lines in contrib/android/Readme.md about PyQt 6.4/6.5 compatibility. The diff shows no code-level vulnerability fix, no CVE reference, and no security-related wording from the vendor. The update likely aligns the QML GUI dependency with the Android build’s Qt version. Security relevance is indirect: staying on an older minor version branch may leave users exposed to known Qt/PyQt issues, but the commit itself does not patch, disclose, or acknowledge any specific vulnerability.
Changed components
setup.py extras_require['qml_gui']contrib/android/Readme.md documentationElectrum QML GUI dependency resolutionInspect captured patch +1 / −3
diff --git a/contrib/android/Readme.md b/contrib/android/Readme.md
index e9ccf87..6e348ef 100644
--- a/contrib/android/Readme.md
+++ b/contrib/android/Readme.md
@@ -108,8 +108,6 @@ Run electrum with the `-g` switch: `electrum -g qml`
Notes:
-- pyqt ~6.4 would work best, as the gui has not yet been adapted to styling changes in 6.5
-- However, pyqt6 as distributed on PyPI does not include a required module (PyQt6.QtQml) until 6.5
- Installing these deps from your OS package manager should also work,
except many don't distribute pyqt6 yet.
For pyqt5 on debian-based distros, this used to look like this:
diff --git a/setup.py b/setup.py
index ba15de1..99cb955 100755
--- a/setup.py
+++ b/setup.py
@@ -45,7 +45,7 @@ extras_require = {
'gui': ['pyqt6'],
'crypto': ['cryptography>=2.6'],
'tests': ['pycryptodomex>=3.7', 'cryptography>=2.6', 'pyaes>=0.1a1'],
- 'qml_gui': ['pyqt6<6.6', 'pyqt6-qt6<6.6']
+ 'qml_gui': ['pyqt6~=6.10', 'pyqt6-qt6~=6.10'], # should be same-ish version as Android build uses?
}
# 'full' extra that tries to grab everything an enduser would need (except for libsecp256k1...)
extras_require['full'] = [pkg for sublist in
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.