What the developer wrote
Authored by Craig Raw
upgrade dnsjava to v3.6.4
What changed, and why it matters
This commit updates a dependency called dnsjava from an unspecified older version to version 3.6.4. dnsjava is a library used to handle DNS (Domain Name System) lookups in Java applications. Version 3.6.4 was released as a security fix for a known vulnerability in earlier versions of dnsjava. Without seeing the actual code diff, we cannot confirm what vulnerability is being fixed or how severe it is for Sparrow Wallet specifically, but dependency upgrades to patched security versions are generally done to close known security holes.
Verify that dnsjava v3.6.4 is now the resolved dependency across all build configurations and transitive dependencies. Review the dnsjava 3.6.4 release notes and associated CVEs (e.g., CVE-2024-25638) to understand the specific risk to Sparrow Wallet. If the prior version was vulnerable, consider whether a security advisory or release note should be published for users.
Security signals we found
Dependency upgrade to a security-patched version of dnsjava (v3.6.4)
dnsjava v3.6.4 is associated with fixes for known DNSSEC/DNS parsing vulnerabilities
No explicit CVE or security advisory referenced in the commit message
Diff content is unavailable, limiting verification
Evidence from the diff
The commit bumps the dnsjava dependency to v3.6.4. dnsjava versions prior to 3.6.3/3.6.4 are known to have had security issues, including CVE-2024-25638 (a DNSSEC validation bypass due to a flaw in the NSEC3 hashing implementation) and possibly others. The commit message alone does not state which vulnerability is addressed. The file changed is named ‘drongo’, which appears to be a dependency/version file in the Sparrow Wallet build. No diff content is available, so we cannot verify whether this is a straightforward version bump or part of a larger remediation.
Changed components
dnsjava dependencySparrow Wallet DNS resolution functionality (potentially used for server discovery, Tor/clearnet hostname resolution, or wallet network operations)Inspect captured patch +1 / −1
Diff not available from the source API.Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.