← Watch feed

Low 25 Monero Committed Sep 18, 2026 · 19:33 UTC

Update monero_c pin

MAGIC Grants/Skylight Wallet

f8ca4c37 View source ↗

Public commit record

What the developer wrote

Authored by Keeqler

28/100 · Opaque

Update monero_c pin

✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change

The short version

What changed, and why it matters

This commit updates a dependency pin for the core Monero library used by the Skylight Wallet app and switches several wallet helper packages from remote Git downloads to local file paths. The change itself is a routine dependency bump and local development path change. There is no direct evidence in the commit that this fixes a security vulnerability, but updating a pinned cryptographic/wallet library can sometimes include security fixes from upstream. We cannot confirm that without inspecting the upstream library changes, which are not provided.

Recommended action

Review the upstream `monero_c` commit range `075265e...de1f52c` to determine whether it contains security fixes. If it does, ensure the new pin is included in the next release and document the security relevance in release notes. The local path changes for wallet-core packages should be verified to ensure they do not accidentally ship a development configuration in production builds.

Security signals we found

Dependency pin update for core Monero cryptographic library (`monero_c`)

No explicit security fix, CVE, or vulnerability description in commit message or diff

Wallet helper packages moved from remote Git SHA-pinned sources to local path dependencies

No code-level security patch visible in the supplied diff

Technical analysis

Evidence from the diff

The diff updates the Git ref for the monero_c dependency from 075265e24bbf3628d6ce0407c7d1bb7945aa48e7 to de1f52cafd0e0ab7057e63994bc751af81f9ca76 in both pubspec.yaml and pubspec.lock. It also changes multiple wallet_* packages from Git source (SHA-pinned to 6860cbd8eaca4c2e1f9b1487ec8292592fdc205f on https://github.com/MAGICGrants/wallet-core) to local path dependencies (../wallet-core/packages/...). The monero_c pin change is the only potentially security-relevant alteration, but the diff does not show what changed in that upstream repository. The wallet-core path changes are build/workflow changes, not runtime security changes.

Changed components

pubspec.yamlpubspec.lockmonero_c dependency (impls/monero.dart)

wallet-core packages (wallet_background, wallet_domain, wallet_fiat, wallet_infra, wallet_monero, wallet_openalias, wallet_ui)

Inspect captured patch +25 / −39

### monero_c
@@ -1 +1 @@
-Subproject commit 075265e24bbf3628d6ce0407c7d1bb7945aa48e7
+Subproject commit de1f52cafd0e0ab7057e63994bc751af81f9ca76

### pubspec.lock
@@ -666,8 +666,8 @@ packages:
     dependency: "direct main"
     description:
       path: "impls/monero.dart"
-      ref: "075265e24bbf3628d6ce0407c7d1bb7945aa48e7"
-      resolved-ref: "075265e24bbf3628d6ce0407c7d1bb7945aa48e7"
+      ref: de1f52cafd0e0ab7057e63994bc751af81f9ca76
+      resolved-ref: de1f52cafd0e0ab7057e63994bc751af81f9ca76
       url: "https://github.com/magicgrants/monero_c"
     source: git
     version: "0.0.0"
@@ -1232,65 +1232,51 @@ packages:
   wallet_background:
     dependency: "direct main"
     description:
-      path: "packages/wallet_background"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_background"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_domain:
     dependency: "direct main"
     description:
-      path: "packages/wallet_domain"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_domain"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_fiat:
     dependency: "direct main"
     description:
-      path: "packages/wallet_fiat"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_fiat"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_infra:
     dependency: "direct main"
     description:
-      path: "packages/wallet_infra"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_infra"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_monero:
     dependency: "direct main"
     description:
-      path: "packages/wallet_monero"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_monero"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_openalias:
     dependency: "direct main"
     description:
-      path: "packages/wallet_openalias"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_openalias"
+      relative: true
+    source: path
     version: "0.1.0"
   wallet_ui:
     dependency: "direct main"
     description:
-      path: "packages/wallet_ui"
-      ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      resolved-ref: "6860cbd8eaca4c2e1f9b1487ec8292592fdc205f"
-      url: "https://github.com/MAGICGrants/wallet-core"
-    source: git
+      path: "../wallet-core/packages/wallet_ui"
+      relative: true
+    source: path
     version: "0.1.0"
   web:
     dependency: transitive

### pubspec.yaml
@@ -57,7 +57,7 @@ dependencies:
   monero:
     git:
       url: https://github.com/magicgrants/monero_c
-      ref: 075265e24bbf3628d6ce0407c7d1bb7945aa48e7
+      ref: de1f52cafd0e0ab7057e63994bc751af81f9ca76
       path: impls/monero.dart
 
   # wallet-core packages; SHA-pinned for release, redirected to the local sibling

Risk score

Why this scored 25/100

Our methodology →

Potential impact 5/30

Exploitability 5/25

Stealth signal 5/15

Affected reach 5/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 25/100

Community notes

Related watches

Merge pull request #178 from MAGICGrants/2.1.0-release-fixes

Update pins

Merge branch 'main' into 2.1.0-release-fixes