upgrade kmp-tor to fix file deletion issue on windows
What the developer wrote
Authored by Craig Raw
upgrade kmp-tor to fix file deletion issue on windows
What changed, and why it matters
This commit updates the kmp-tor library dependency in Sparrow Wallet from version 408.16.3 to 408.21.0 (and runtime from 2.2.1 to 2.5.0). The stated reason is to fix a file deletion problem on Windows. The change itself is just a version bump in the build file; there is no code change in Sparrow itself. We cannot see what exactly was fixed in the upstream library from this commit alone, and no security relevance is claimed by the project.
Review the upstream kmp-tor release notes for versions 408.21.0 and 2.5.0 to confirm whether the Windows file-deletion fix has any security implications, and update if the new version resolves a relevant issue. No immediate Sparrow code change is needed beyond the version bump already applied.
Security signals we found
Dependency version bump for kmp-tor, a Tor networking component
Commit message references a Windows file-deletion bug, which could imply resource cleanup or denial-of-service conditions
No explicit security claim or CVE in commit or supplied references
No Sparrow source-code changes; risk depends entirely on upstream kmp-tor changelog
Evidence from the diff
The diff only modifies build.gradle, bumping two kmp-tor coordinates: the Gradle plugin io.matthewnelson.kmp.tor.resource-filterjar to 408.21.0, the runtime dependency to 2.5.0, and the resource-exec-tor-gpl artifact to 408.21.0. The commit message says this is to ‘fix file deletion issue on windows’. No diff of the lark file is shown despite being listed as changed. No CVE, advisory, or security explanation is present in the commit or supplied references.
Changed components
build.gradle dependency declarationskmp-tor runtime and resource-exec-tor-gpl artifactsWindows-specific file deletion behavior in Tor resource managementInspect captured patch +4 / −4
diff --git a/build.gradle b/build.gradle
index 2d5c3b7..b93ad6c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -3,7 +3,7 @@ plugins {
id 'org-openjfx-javafxplugin'
id 'org.beryx.jlink' version '3.2.1'
id 'org.gradlex.extra-java-module-info' version '1.13.1'
- id 'io.matthewnelson.kmp.tor.resource-filterjar' version '408.16.3'
+ id 'io.matthewnelson.kmp.tor.resource-filterjar' version '408.21.0'
}
def os = org.gradle.internal.os.OperatingSystem.current()
@@ -74,8 +74,8 @@ dependencies {
implementation('com.sparrowwallet:hummingbird:1.7.4')
implementation('co.nstant.in:cbor:0.9')
implementation('org.openpnp:openpnp-capture-java:0.0.30-1')
- implementation("io.matthewnelson.kmp-tor:runtime:2.2.1")
- implementation("io.matthewnelson.kmp-tor:resource-exec-tor-gpl:408.16.3")
+ implementation("io.matthewnelson.kmp-tor:runtime:2.5.0")
+ implementation("io.matthewnelson.kmp-tor:resource-exec-tor-gpl:408.21.0")
implementation('org.jetbrains.kotlinx:kotlinx-coroutines-javafx:1.10.1') {
exclude group: 'org.jetbrains.kotlin', module: 'kotlin-stdlib-common'
}
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.