What the developer wrote
Authored by odudex
chore: bump version to 26.08.0
What changed, and why it matters
This commit is a routine version bump from 26.04.0 to 26.08.0. It only updates version strings in documentation, build files, and source metadata. No code behavior changes. The changelog text mentions a previously fixed heap buffer overflow, but that fix is not part of this diff.
No action needed for this commit. If reviewing the security fix referenced in the changelog, locate the commit that actually modified the Shannon entropy/camera module and assess it separately.
Security signals we found
Changelog references a prior heap buffer overflow in Shannon entropy module (camera frame copy into fixed 320x240 RGB565 buffer)
No actual code or security fix present in this commit
Evidence from the diff
The diff updates version identifiers in CHANGELOG.md, mkdocs.yml, pyproject.toml, src/krux/metadata.py, and uv.lock. There are no functional code changes. The CHANGELOG header is updated and its existing ‘Security Fixes’ entry describes a heap buffer overflow in camera entropy handling that was addressed in an earlier, unspecified commit (Maix Bit CIF frame overflow into a 320x240 RGB565 scratch buffer). This commit does not contain the fix.
Changed components
CHANGELOG.mdmkdocs.ymlpyproject.tomlsrc/krux/metadata.pyuv.lockInspect captured patch +5 / −5
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8efbc5..7656ca3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,4 @@
-# Changelog 26.05.0 - May 2025
+# Changelog 26.08.0 - May 2025
### Security Fixes
- Camera entropy: fix a heap buffer overflow in the Shannon entropy module. Only the Maix Bit could trigger it, a device discontinued in 25.09.0 with no known users; every other device feeds the module a frame that fits. The module copied the whole frame into a fixed 320x240 RGB565 (153,600 byte) scratch buffer, so the Maix Bit's larger CIF frames (352x288 RGB565, 202,752 bytes) wrote 49,152 bytes past the end. The scratch copy has been removed entirely, the read length is now capped and rounded to whole pixels, and the CIF path is gone along with the Maix Bit
diff --git a/mkdocs.yml b/mkdocs.yml
index 2633d4f..ca6ecfd 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -48,7 +48,7 @@ edit_uri: edit/main/docs
docs_dir: docs
site_dir: public
extra:
- latest_krux: krux-v26.04.0
+ latest_krux: krux-v26.08.0
latest_installer: v0.0.21
latest_installer_rpm: krux_installer-0.0.21-1.x86_64.rpm
latest_installer_deb: krux_installer_0.0.21_amd64.deb
diff --git a/pyproject.toml b/pyproject.toml
index 8293440..5fc06b1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,7 +22,7 @@
[project]
name = "krux"
-version = "26.04.0"
+version = "26.08.0"
description = "Open-source signing device firmware for Bitcoin"
authors = [{ name = "Jeff S", email = "jeffreesun@protonmail.com" }]
readme = "README.md"
diff --git a/src/krux/metadata.py b/src/krux/metadata.py
index 0dc9bdb..2908479 100644
--- a/src/krux/metadata.py
+++ b/src/krux/metadata.py
@@ -19,5 +19,5 @@
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
-VERSION = "26.04.0"
+VERSION = "26.08.0"
SIGNER_PUBKEY = "03339e883157e45891e61ca9df4cd3bb895ef32d475b8e793559ea10a36766689b"
diff --git a/uv.lock b/uv.lock
index 18600e0..f09467c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -263,7 +263,7 @@ wheels = [
[[package]]
name = "krux"
-version = "26.4.0"
+version = "26.8.0"
source = { virtual = "." }
dependencies = [
{ name = "embit" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.