deps: bump libsecp256k1 version (0.6.0->0.7.0) and electrum-ecc
What the developer wrote
Authored by SomberNight
deps: bump libsecp256k1 version (0.6.0->0.7.0) and electrum-ecc
What changed, and why it matters
This commit updates the cryptographic library (libsecp256k1) used by Electrum from version 0.6.0 to 0.7.0, and also bumps the related Python wrapper package (electrum-ecc) from 0.0.5 to 0.0.6. These are dependency version bumps in build scripts and pinned requirements. The commit itself does not describe any security bug, and no independent security references were provided. Version bumps in cryptographic libraries can sometimes include security fixes, but this diff alone does not prove a vulnerability exists or was fixed.
Review the libsecp256k1 v0.7.0 release notes and electrum-ecc 0.0.6 changelog for any security fixes. If this bump addresses a known vulnerability, ensure the updated dependencies are shipped promptly and consider disclosing the relevance to users. Otherwise, treat as routine maintenance.
Security signals we found
Cryptographic dependency version bump (libsecp256k1 0.6.0 -> 0.7.0)
Related wrapper package bump (electrum-ecc 0.0.5 -> 0.0.6)
No security-relevant description in commit message
No CVE or advisory referenced in commit or supplied materials
Evidence from the diff
The diff changes three files: (1) the Android build recipe pins a new libsecp256k1 git commit and SHA-512 hash, (2) the deterministic requirements file pins a new electrum-ecc wheel hash, and (3) the shell script that builds libsecp256k1 updates the LIBSECP_VERSION variable and its comment from v0.6.0 to v0.7.0. No source code logic is modified. The commit message is purely a dependency bump with no mention of CVEs, advisories, or security issues.
Changed components
contrib/android/p4a_recipes/libsecp256k1/__init__.pycontrib/deterministic-build/requirements.txtcontrib/make_libsecp256k1.shlibsecp256k1 dependencyelectrum-ecc dependencyInspect captured patch +6 / −6
diff --git a/contrib/android/p4a_recipes/libsecp256k1/__init__.py b/contrib/android/p4a_recipes/libsecp256k1/__init__.py
index b60e35f..6fd8177 100644
--- a/contrib/android/p4a_recipes/libsecp256k1/__init__.py
+++ b/contrib/android/p4a_recipes/libsecp256k1/__init__.py
@@ -6,9 +6,9 @@ assert LibSecp256k1Recipe.python_depends == []
class LibSecp256k1RecipePinned(LibSecp256k1Recipe):
- version = "0cdc758a56360bf58a851fe91085a327ec97685a"
+ version = "a660a4976efe880bae7982ee410b9e0dc59ac983"
url = "https://github.com/bitcoin-core/secp256k1/archive/{version}.zip"
- sha512sum = "d8b133770db9badffba87a22eabb794ce99081429c61b1c8032eaed26039e514cfdae18f81ef1ea4a77f278477fd899dfcce2b772a011ae2ec5514c68b6e453a"
+ sha512sum = "13f8f9d51fba5a38f591d770c7f39a1266a041be59a850d83cf62fb0de0274ed3a34c56ba8393d6f611e522cdbd798cb7ccbb2a6b03f2e5898a3b1080ea01874"
recipe = LibSecp256k1RecipePinned()
diff --git a/contrib/deterministic-build/requirements.txt b/contrib/deterministic-build/requirements.txt
index 828219c..58857f6 100644
--- a/contrib/deterministic-build/requirements.txt
+++ b/contrib/deterministic-build/requirements.txt
@@ -18,8 +18,8 @@ dnspython==2.4.2 \
--hash=sha256:8dcfae8c7460a2f84b4072e26f1c9f4101ca20c071649cb7c34e8b6a93d58984
electrum-aionostr==0.0.11 \
--hash=sha256:0eeb1d01e55d4bab2c116268965a0b2c11490659e969fd864c453104558bcf81
-electrum-ecc==0.0.5 \
- --hash=sha256:f733b8596a0f7b25c8371d08af61ef79c7b871d5b40f05a5b95d2d05eb2fb7d2
+electrum-ecc==0.0.6 \
+ --hash=sha256:6360c71fb08b51d80a455e938f126ba4c790be74ba226461d54d7a3aa6890b89
frozenlist==1.6.0 \
--hash=sha256:b99655c32c1c8e06d111e7f41c06c29a5318cb1835df23a45518e02a47c63b68
idna==3.10 \
diff --git a/contrib/make_libsecp256k1.sh b/contrib/make_libsecp256k1.sh
index d5bfbf7..3d8d916 100755
--- a/contrib/make_libsecp256k1.sh
+++ b/contrib/make_libsecp256k1.sh
@@ -14,8 +14,8 @@
# sudo apt-get install gcc-multilib g++-multilib
# $ AUTOCONF_FLAGS="--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32" ./contrib/make_libsecp256k1.sh
-LIBSECP_VERSION="0cdc758a56360bf58a851fe91085a327ec97685a"
-# ^ tag "v0.6.0"
+LIBSECP_VERSION="a660a4976efe880bae7982ee410b9e0dc59ac983"
+# ^ tag "v0.7.0"
# note: this version is duplicated in contrib/android/p4a_recipes/libsecp256k1/__init__.py
# (and also in electrum-ecc, for the "secp256k1" git submodule)
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.