upgrade jzbar to v0.3.1 to fix library load from application image
What the developer wrote
Authored by Craig Raw
upgrade jzbar to v0.3.1 to fix library load from application image
What changed, and why it matters
This commit updates a dependency called jzbar from version 0.3.0 to 0.3.1 and changes how its native code is packaged into Sparrow Wallet's application bundle. The commit title says it fixes loading the jzbar library from the application image. There is no direct evidence in the commit or supplied references that this is a security vulnerability; it appears to be a build/packaging fix. However, native library loading can have security implications if done incorrectly, so it warrants a low-key review.
Treat as a routine dependency/build fix unless additional information emerges. Review the jzbar 0.3.1 release notes or changelog for any security-related fixes. Verify that the new --enable-native-access grant is necessary and scoped correctly, and that native library extraction does not introduce path-traversal or unsafe-loading risks.
Security signals we found
Native library loading path changed
Dependency version bump with stated fix
New --enable-native-access grant added for com.sparrowwallet.sparrow
jzbar native libraries now extracted and excluded from jlink image
Evidence from the diff
The build.gradle change bumps io.github.doblon8:jzbar from 0.3.0 to 0.3.1. It also removes a TODO comment and now excludes jzbar’s bundled native libraries from the jlink image, adds –enable-native-access=com.sparrowwallet.sparrow, and registers jzbar native jars for extraction into the application image. The commit message frames this as fixing ‘library load from application image.’ No CVE, advisory, or vendor security statement is present in the supplied materials. The change is consistent with a packaging/loading bug fix rather than a disclosed security issue.
Changed components
build.gradlejzbar dependency (io.github.doblon8:jzbar)Sparrow Wallet application image / native library packagingjlink configurationInspect captured patch +5 / −4
diff --git a/build.gradle b/build.gradle
index 137055a..742cf59 100644
--- a/build.gradle
+++ b/build.gradle
@@ -109,7 +109,7 @@ dependencies {
implementation('com.github.hervegirod:fxsvgimage:1.1')
implementation('com.sparrowwallet:toucan:0.9.0')
implementation('com.jcraft:jzlib:1.1.3')
- implementation('io.github.doblon8:jzbar:0.3.0')
+ implementation('io.github.doblon8:jzbar:0.3.1')
testImplementation('org.junit.jupiter:junit-jupiter-api:5.14.1')
testRuntimeOnly('org.junit.jupiter:junit-jupiter-engine:5.14.1')
testRuntimeOnly('org.junit.platform:junit-platform-launcher')
@@ -206,8 +206,8 @@ jlink {
'glob:/org.hid4java/win32-*/**,' +
'glob:/openpnp.capture.java/darwin-*/**,' +
'glob:/openpnp.capture.java/linux-*/**,' +
- 'glob:/openpnp.capture.java/win32-*/**']
- // TODO: exclude glob:/io.github.doblon8.jzbar/native/** once jzbar supports pre-loaded natives
+ 'glob:/openpnp.capture.java/win32-*/**,' +
+ 'glob:/io.github.doblon8.jzbar/native/**']
launcher {
name = 'sparrow'
jvmArgs = ["--enable-native-access=com.sparrowwallet.drongo",
@@ -217,6 +217,7 @@ jlink {
"--enable-native-access=com.fazecast.jSerialComm",
"--enable-native-access=org.usb4java",
"--enable-native-access=io.github.doblon8.jzbar",
+ "--enable-native-access=com.sparrowwallet.sparrow",
"--add-opens=javafx.graphics/com.sun.javafx.css=org.controlsfx.controls",
"--add-opens=javafx.graphics/javafx.scene=org.controlsfx.controls",
"--add-opens=javafx.controls/com.sun.javafx.scene.control.behavior=org.controlsfx.controls",
@@ -401,7 +402,7 @@ def nativeLibJars = [
'openpnp-capture-java': "${jnaPlatform}/*",
'jSerialComm-' : "${serialOs}/${serialArch}/*",
'usb4java-' : "org/usb4java/${jnaPlatform}/*",
- // TODO: add 'jzbar-' once jzbar supports pre-loaded natives
+ 'jzbar-' : "native/${osName}/${osArch}/*",
]
tasks.register('extractNativeLibraries') {
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.