update CHANGES.md for release 1.5.5
What the developer wrote
Authored by Jon Griffiths
update CHANGES.md for release 1.5.5
What changed, and why it matters
This commit is just a changelog update for libwally-core version 1.5.5. It mentions that the release 'de-optimizes some memcpy calls on x86 to prevent leaks via extended registers.' That wording suggests a security-sensitive fix, but the actual code change is not shown in this commit—only the release note is. So we can flag the topic as potentially security-relevant, but we cannot verify the fix from this commit alone.
Locate and review the actual code commit(s) that implement the memcpy de-optimization to confirm the scope, correctness, and completeness of the fix. Do not rely solely on this changelog commit for security assessment.
Security signals we found
Changelog entry describes a security-motivated fix
Mentions prevention of information leaks via CPU extended registers
Relates to secure memory handling of cryptographic secrets
No actual code patch present in the supplied commit
Evidence from the diff
The diff adds a single entry to CHANGES.md under ‘Version 1.5.5 / Fixed’: ‘De-optimize some memcpy calls on x86 to prevent leaks via extended registers.’ This refers to a class of issues where compiler-optimized memcpy on x86-64 may leave fragments of sensitive data in SIMD/extended registers (e.g., YMM/ZMM) that are not cleared by normal zeroization routines, potentially leaking secrets across calls or to other code paths. The commit itself does not contain the implementation change, so classification relies entirely on the changelog text.
Changed components
libwally-core memory handling / secure zeroization routines on x86CHANGES.md release notesInspect captured patch +5 / −0
diff --git a/CHANGES.md b/CHANGES.md
index 35de086..ce7bbda 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,10 @@
# Changes
+## Version 1.5.5
+
+### Fixed
+- De-optimize some memcpy calls on x86 to prevent leaks via extended registers.
+
## Version 1.5.4
### Added
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.