Bump and update pins

MAGIC Grants/Skylight Wallet

6fd9bf0b View source ↗

Public commit record

What the developer wrote

Authored by Keeqler

28/100 · Opaque

Bump and update pins

✓ Subject identifies a change! No meaningful explanatory body

The short version

What changed, and why it matters

This commit simply updates version numbers and switches several software dependencies to newer pinned versions. There is no visible code change in the app itself, and the commit message gives no indication that any security problem is being fixed. Without inspecting the actual contents of the updated dependency versions, we cannot tell whether this update addresses a security issue or is just routine maintenance.

Recommended action

Treat this as a routine dependency bump unless the changelogs or diffs of the newly pinned monero_c and wallet-core commits indicate a security fix. If this is a release build, verify the updated dependency commits against their upstream release notes and consider whether the major version bump to 2.0.0 warrants user-facing release notes.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The diff updates pubspec.yaml and pubspec.lock: the app version is bumped from 1.0.12+404 to 2.0.0+405, the monero_c git ref is moved from 757bf8ef… to 1b073ce7…, and all wallet-core package refs are moved from f674cb90… to cf9c5946.... These are SHA-pinned dependency updates only; no application source code is modified in this commit.

Changed components

pubspec.yaml dependency pinspubspec.lock dependency pinsmonero_c dependency (external git repository)

wallet-core dependencies: wallet_infra, wallet_domain, wallet_monero, wallet_openalias, wallet_background, wallet_fiat, wallet_ui (external git repository)

Inspect captured patch +12 / −12

diff --git a/pubspec.lock b/pubspec.lock
index c6bdba3..96db04b 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -666,8 +666,8 @@ packages:
     dependency: "direct main"
     description:
       path: "impls/monero.dart"
-      ref: "757bf8ef3874953a076b07a2407b17bf9eeef5c0"
-      resolved-ref: "757bf8ef3874953a076b07a2407b17bf9eeef5c0"
+      ref: "1b073ce7c6f74944474d26bd0f1dc4c9d89253ac"
+      resolved-ref: "1b073ce7c6f74944474d26bd0f1dc4c9d89253ac"
       url: "https://github.com/magicgrants/monero_c"
     source: git
     version: "0.0.0"
diff --git a/pubspec.yaml b/pubspec.yaml
index c3be022..7103a0d 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -16,7 +16,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.12+404
+version: 2.0.0+405
 
 environment:
   sdk: 3.11.5
@@ -57,7 +57,7 @@ dependencies:
   monero:
     git:
       url: https://github.com/magicgrants/monero_c
-      ref: 757bf8ef3874953a076b07a2407b17bf9eeef5c0
+      ref: 1b073ce7c6f74944474d26bd0f1dc4c9d89253ac
       path: impls/monero.dart
 
   # wallet-core packages; SHA-pinned for release, redirected to the local sibling
@@ -65,37 +65,37 @@ dependencies:
   wallet_infra:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_infra
   wallet_domain:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_domain
   wallet_monero:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_monero
   wallet_openalias:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_openalias
   wallet_background:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_background
   wallet_fiat:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_fiat
   wallet_ui:
     git:
       url: https://github.com/MAGICGrants/wallet-core
-      ref: f674cb907ab971126a88dcc78c33b549b630f58f
+      ref: cf9c5946905ad37f4043e7c06e421b1f4c6fa4e4
       path: packages/wallet_ui
 
   cupertino_icons: 1.0.8

Risk score

Why this scored 6/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 5/10

Evidence quality 1/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 6/100

Community notes

Related watches

Screenshot and store updates

Merge pull request #178 from MAGICGrants/2.1.0-release-fixes

Update pins