What the developer wrote
Authored by julian
update tor lib
What changed, and why it matters
This commit updates the Tor networking library used by Stack Wallet to a newer version. The change itself only swaps one pinned code reference for another and adds a Kotlin build directory to the ignore list. There is no direct evidence in the commit that this fixes a security vulnerability, but updating a privacy-critical networking component like Tor is commonly done to pick up bug or security fixes in the upstream library.
Review the changelog and diff of the referenced Tor library commits (`16c9e709...` to `21077186...`) to determine whether this update addresses any security or privacy issues. If it does, ensure the updated version is included in the next release and consider disclosing the security relevance to users.
Security signals we found
Dependency update for a privacy-critical networking component (Tor)
Pinned git reference changed in both lockfile and build template
No explicit security-related commit message or changelog entry
Evidence from the diff
The diff updates the git reference for the tor_ffi_plugin dependency from commit 16c9e709e984ec89e8715ce378b038c93ad7add3 to 21077186e6bf773ec8a7cd57ef149b2cee5daa7b in both pubspec.lock and the pubspec.template build script. It also adds /.kotlin/ to android/.gitignore. The actual code changes in the referenced cypherstack/tor repository are not included in the supplied materials, so the specific nature of the Tor library update cannot be assessed from this commit alone.
Changed components
tor_ffi_plugin dependencypubspec.lockscripts/app_config/templates/pubspec.templateandroid/.gitignoreInspect captured patch +5 / −4
diff --git a/android/.gitignore b/android/.gitignore
index bb7ef20..d4a6340 100644
--- a/android/.gitignore
+++ b/android/.gitignore
@@ -7,4 +7,5 @@ gradle-wrapper.jar
/key.properties
app/upload-keystore-campfire.jks
app/upload-keystore-stackwallet.jks
-GeneratedPluginRegistrant.java
\ No newline at end of file
+GeneratedPluginRegistrant.java
+/.kotlin/
diff --git a/pubspec.lock b/pubspec.lock
index dd619b2..f294896 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -2209,8 +2209,8 @@ packages:
dependency: "direct main"
description:
path: "."
- ref: "16c9e709e984ec89e8715ce378b038c93ad7add3"
- resolved-ref: "16c9e709e984ec89e8715ce378b038c93ad7add3"
+ ref: "21077186e6bf773ec8a7cd57ef149b2cee5daa7b"
+ resolved-ref: "21077186e6bf773ec8a7cd57ef149b2cee5daa7b"
url: "https://github.com/cypherstack/tor.git"
source: git
version: "0.0.1"
diff --git a/scripts/app_config/templates/pubspec.template b/scripts/app_config/templates/pubspec.template
index 03c8ac3..06f48c2 100644
--- a/scripts/app_config/templates/pubspec.template
+++ b/scripts/app_config/templates/pubspec.template
@@ -68,7 +68,7 @@ dependencies:
tor_ffi_plugin:
git:
url: https://github.com/cypherstack/tor.git
- ref: 16c9e709e984ec89e8715ce378b038c93ad7add3
+ ref: 21077186e6bf773ec8a7cd57ef149b2cee5daa7b
fusiondart:
git:
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.