update drongo and lark to require anti-klepto on bitbox02 and fix taproot signing issue
What the developer wrote
Authored by Craig Raw
update drongo and lark to require anti-klepto on bitbox02 and fix taproot signing issue
What changed, and why it matters
This commit updates two internal library submodules (drongo and lark) used by the Sparrow Wallet. The stated purpose is to require an anti-klepto protection feature for BitBox02 hardware wallets and to fix a Taproot signing issue. The actual code changes are not visible in this commit—only the submodule pointers were moved to new commits—so we cannot directly inspect what was fixed. Anti-klepto protections reduce the risk of a compromised hardware wallet leaking private key material through biased signatures. A Taproot signing issue could, in principle, affect the ability to spend or the validity of signatures, but the diff gives no details.
Review the actual commits referenced in the drongo and lark submodules (b38561072dab79188b3ec845a440735dbe0455ec and 9ea1b988062612df503ff8da8dffa35eff5b1c63) to determine the precise Taproot signing fix and confirm whether anti-klepto enforcement is correctly implemented. Users relying on BitBox02 or Taproot should update to the release containing this commit once the details are clarified.
Security signals we found
Submodule-only change with no visible source diff
Commit message references anti-klepto (anti-exfiltration) hardening for BitBox02
Commit message references a Taproot signing fix
No CVE, advisory, or vendor security disclosure supplied
Evidence from the diff
The commit is a submodule bump for drongo and lark. The commit message says the updates: (1) require anti-klepto (anti-exfiltration) on BitBox02, and (2) fix a Taproot signing issue. No diff of the underlying libraries is provided, so the exact nature of the Taproot bug, affected code paths, or whether it has security implications, cannot be determined from the supplied materials. The anti-klepto change is a hardening measure rather than a fix for an exploitable Sparrow vulnerability.
Changed components
drongo submodulelark submoduleBitBox02 hardware wallet integrationTaproot transaction signingInspect captured patch +2 / −2
### drongo
@@ -1 +1 @@
-Subproject commit 4336bbd469e9bdd91531f55ac0f2bdb3ca07efb4
+Subproject commit b38561072dab79188b3ec845a440735dbe0455ec
### lark
@@ -1 +1 @@
-Subproject commit 97be034d154676fee3d2d39d6fdd98d7576a00c5
+Subproject commit 9ea1b988062612df503ff8da8dffa35eff5b1c63Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.