deps: bump libsecp256k1 version (0.7.0->0.7.1) and electrum-ecc
What the developer wrote
Authored by SomberNight
deps: bump libsecp256k1 version (0.7.0->0.7.1) and electrum-ecc
What changed, and why it matters
This commit updates the cryptographic library (libsecp256k1) used by Electrum from version 0.7.0 to 0.7.1, and also updates the related Python wrapper package (electrum-ecc) from 0.0.6 to 0.0.7. It only changes version numbers and corresponding checksums in build scripts and dependency lists. There is no direct evidence in the commit itself that this fixes a specific security vulnerability, but updating a core cryptographic dependency is a routine security-hygiene change. Without a vendor reference linking this bump to a known bug, we cannot say it definitely fixes a security issue.
Treat as routine dependency maintenance with potential security benefit. Review the upstream libsecp256k1 v0.7.1 release notes and electrum-ecc 0.0.7 changelog for any security-relevant fixes. If deploying Electrum, apply this update as part of normal patch management, but no emergency response is warranted based solely on this commit.
Security signals we found
Dependency version bump for a core cryptographic library (libsecp256k1)
Dependency version bump for electrum-ecc, the Python ECC wrapper
No explicit security claim, CVE, or advisory referenced in commit materials
Evidence from the diff
The diff updates pinned versions of bitcoin-core/secp256k1 (commit a660a4976efe880bae7982ee410b9e0dc59ac983 to 1a53f4961f337b4d166c25fce72ef0dc88806618, tagged v0.7.0 to v0.7.1) and electrum-ecc (0.0.6 to 0.0.7) across Android build recipes, deterministic requirements, and a shell build script. The changes are purely version/hash bumps. No vulnerability details, CVE, or security advisory are mentioned in the commit message or diff.
Changed components
contrib/android/p4a_recipes/libsecp256k1/__init__.pycontrib/deterministic-build/requirements.txtcontrib/make_libsecp256k1.shlibsecp256k1 (bitcoin-core/secp256k1)electrum-ecc Python packageInspect captured patch +6 / −6
diff --git a/contrib/android/p4a_recipes/libsecp256k1/__init__.py b/contrib/android/p4a_recipes/libsecp256k1/__init__.py
index 6fd8177..35d171c 100644
--- a/contrib/android/p4a_recipes/libsecp256k1/__init__.py
+++ b/contrib/android/p4a_recipes/libsecp256k1/__init__.py
@@ -6,9 +6,9 @@ assert LibSecp256k1Recipe.python_depends == []
class LibSecp256k1RecipePinned(LibSecp256k1Recipe):
- version = "a660a4976efe880bae7982ee410b9e0dc59ac983"
+ version = "1a53f4961f337b4d166c25fce72ef0dc88806618"
url = "https://github.com/bitcoin-core/secp256k1/archive/{version}.zip"
- sha512sum = "13f8f9d51fba5a38f591d770c7f39a1266a041be59a850d83cf62fb0de0274ed3a34c56ba8393d6f611e522cdbd798cb7ccbb2a6b03f2e5898a3b1080ea01874"
+ sha512sum = "4072e45517bc1bb416250bc8e4fa4ed94f83b4eebbe25a70925fd7cc9759df3edbce64ab0116519c335f82353f6a029cde92018ed7116f2f85c8092a9adeb532"
recipe = LibSecp256k1RecipePinned()
diff --git a/contrib/deterministic-build/requirements.txt b/contrib/deterministic-build/requirements.txt
index 7481c4d..21b9a46 100644
--- a/contrib/deterministic-build/requirements.txt
+++ b/contrib/deterministic-build/requirements.txt
@@ -18,8 +18,8 @@ dnspython==2.4.2 \
--hash=sha256:8dcfae8c7460a2f84b4072e26f1c9f4101ca20c071649cb7c34e8b6a93d58984
electrum-aionostr==0.1.0 \
--hash=sha256:3774f8e8312388272e10851a869c9f4d3d4a54d8d564851c36e2dc40297bec84
-electrum-ecc==0.0.6 \
- --hash=sha256:6360c71fb08b51d80a455e938f126ba4c790be74ba226461d54d7a3aa6890b89
+electrum-ecc==0.0.7 \
+ --hash=sha256:ed4134e1dbff0fd83022764c6acc97a02cde3512927d7c41f4d48b9a06e91fb2
frozenlist==1.6.0 \
--hash=sha256:b99655c32c1c8e06d111e7f41c06c29a5318cb1835df23a45518e02a47c63b68
idna==3.10 \
diff --git a/contrib/make_libsecp256k1.sh b/contrib/make_libsecp256k1.sh
index 8b194c9..40326d9 100755
--- a/contrib/make_libsecp256k1.sh
+++ b/contrib/make_libsecp256k1.sh
@@ -14,8 +14,8 @@
# sudo apt-get install gcc-multilib g++-multilib
# $ AUTOCONF_FLAGS="--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32" ./contrib/make_libsecp256k1.sh
-LIBSECP_VERSION="a660a4976efe880bae7982ee410b9e0dc59ac983"
-# ^ tag "v0.7.0"
+LIBSECP_VERSION="1a53f4961f337b4d166c25fce72ef0dc88806618"
+# ^ tag "v0.7.1"
# note: this version is duplicated in contrib/android/p4a_recipes/libsecp256k1/__init__.py
# (and also in electrum-ecc, for the "secp256k1" git submodule)
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.