Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit tidies up how Electrum handles extra spaces around Bitcoin addresses, messages, and signatures when signing or verifying messages. Previously, different parts of the program (desktop GUI, mobile-style GUI, command line) behaved…
Behavior normalization across GUI and CLI interfacesNo cryptographic primitive changedNo privilege boundary crossed
This commit fixes a minor consistency bug in Electrum's newer QML (mobile-style) user interface. When signing a message, the app now removes accidental spaces at the start or end of the message and address, just like the older desktop Qt i…
Behavioral inconsistency between GUI implementations could cause user confusion or failed verificationNo cryptographic weakness introduced; change is input normalizationNo memory-unsafe code, no privilege changes, no network changes
This commit fixes a bug in Electrum's support for Trezor hardware wallets. After a Trezor session times out or is closed, Electrum now forgets the old session ID. Previously it kept the stale session ID, so the next attempt to sign a trans…
Fixes a stale-session reference that caused InvalidSessionError on re-authenticationEnsures PIN re-prompt after session timeout/closureFailure mode was denial-of-service (transaction signing crash), not unauthorized signing
This is a small user-interface fix for the Electrum mobile/QML app. When sweeping private keys, the confirmation dialog that shows how much money will be moved initially displayed an amount of 0 because it did not refresh after the transac…
This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was th…
Sighash sanity check could be bypassed for beyond-gap-limit wallet inputsFix adds defensive deep-copy and wallet-info population inside check_sighashRegression test demonstrates dangerous sighash is now caught even with gap_limit=2
This commit is a user-interface performance and polish fix for Electrum's hardware wallet integration. It stops the app from destroying and recreating the same on-screen prompt every time a hardware wallet asks the user to confirm a transa…
This commit adds new Lightning Network message handling code to Electrum. It introduces a new BIP-340 Schnorr signature field type, computes Merkle roots over TLV (type-length-value) records, signs and verifies those roots, and adds implic…
New cryptographic signing/verification path addedNew BIP-340 tagged-hash Merkle root constructionSignature TLVs excluded from the Merkle root they sign
This change fixes a potential denial-of-service weakness in Electrum's Lightning network peer handling. Previously, when Electrum replied to a peer's 'ping' message, it would add the reply to the outgoing socket buffer without waiting to c…
memory exhaustion / DoS mitigationunbounded outbound buffer growth preventedbackpressure added to peer ping/pong handling
This commit changes Electrum's automated CI security-review bot so that the Claude AI assistant is allowed to run shell commands and modify files on its own, rather than only answering questions. The change is intentional and runs inside a…
New command-line flag named `--dangerously-skip-permissions` introducedCI script now permits an AI agent to execute commands and modify files without interactive permission checksExecution context changed from root to unprivileged `node` user to satisfy Claude's refusal to run as root
This commit only changes a test script. It adds a wait helper so a test that opens two Lightning channels in a row does not fail randomly on continuous integration. There is no change to Electrum's actual wallet or Lightning code, so users…
This commit is a routine user-interface refresh for Electrum's mobile/desktop QML app, adjusting colors, spacing, button containers, and placeholder text to match newer Qt 6.10 styling. There is no security-relevant change and no indicatio…
This commit changes how the Electrum mobile/desktop QML GUI passes custom data objects between Python and the user interface. It switches many typed properties to the generic QVariant/'var' type and adds runtime type checks (asserts) in Py…
Type system relaxation: custom typed QML/Python properties changed to generic QVariant/varRuntime type enforcement added via assert statements in Python settersNo explicit security framing in commit message or diff
This commit is purely a user-interface styling refresh for Electrum's QML (mobile/desktop) GUI. It swaps some visual components (highlight panes, button containers, padding, colors) and introduces a new shared 'DialogHighlightPane' control…
This commit fixes a known Bitcoin weakness (CVE-2012-2459) in Electrum's light-client verification. Because Bitcoin's Merkle tree duplicates the last hash when a level has an odd number of items, an attacker can craft a block proof that ma…
Electrum's background daemon runs a local control server using a Unix domain socket. Previously, that socket file was created with permissions 0775, meaning any user in the same group could connect to it and potentially control the wallet.…
permission tightening on local RPC socketacknowledged race condition between socket creation and chmodlocal privilege boundary issue (group-writable socket)
This commit reduces the attack surface of Electrum's built-in remote-control server when running in normal GUI mode. Previously, the RPC server exposed many wallet-related commands; now, in GUI mode on mainnet, it only exposes two safe com…
Reduction of RPC attack surface in GUI modeUnencrypted localhost RPC with config-stored passwordWindows localhost TCP exposure of RPC server
This commit removes a hard crash (assertion) in Electrum's wallet code when a user loads a partially-signed Bitcoin transaction (PSBT) whose calculated fee is negative. Instead of crashing, Electrum now logs a warning and continues. A nega…
assertion replaced with warning lognegative transaction fee handlingPSBT loading robustness
This commit fixes a security issue in Electrum's background daemon (the program that stays running to serve wallet requests). Previously, a user could run a command that would instantly strip the RPC password from a running daemon, leaving…
Authentication bypass via empty RPC passwordIn-flight weakening of daemon security settingsInconsistent security state across daemon restart
This commit fixes a bug in Electrum's wallet setup wizard. Previously, if a user tried to import an individual private key for an unusual script type (like p2wsh), the wizard would crash with an internal error instead of showing a friendly…
Unhandled exception converted to user-facing errorImproves input validation and error handling in wallet import pathNo memory corruption, privilege escalation, or cryptographic weakness evident
This commit is a minor code cleanup. It replaces a locally-defined placeholder fake cryptographic signature with a shared constant from another file. The placeholder is only used to estimate transaction size and is never broadcast or used …
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Lower-priorityrelease notes: bump 4.8.0 date for second attemptby SomberNight · 8c0adcda · Jul 8, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · SomberNight
release notes: bump 4.8.0 date for second attempt
We failed to get a full quorum to reproduce the prior git tag. The android apks were problematic to reproducibly build. should be fixed by https://github.com/spesmilo/electrum/pull/10739
here we go again
76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
android build: cache p4a recipe downloads even for FRESH_CLONE builds
I propose we cache some downloads even for "fresh clone" builds (that have `ELECBUILD_COMMIT` env var set), with an opt-out reusing the existing `ELECBUILD_NOCACHE` env var. Currently `ELECBUILD_NOCACHE` only opts-out from the docker build cache, now I would reuse it for p4a recipe downloads.
`qt-everywhere-src-6.10.2.tar.xz` [0] is 1.3 GiB, and we download it twice per arch. (once for the qt6 recipe, once for the hostqt6 recipe) It seems to me, download.qt.io is heavily rate-limiting downloads from some IPs.
When doing a release, we build 3 archs, so we download Qt six times. With this patch, we would only download it twice. (note: I see no need to have separate caches per arch atm.)
Also, when doing multiple builds to debug reproducibility, with this patch, only the first attempt needs to download Qt (twice). Subsequent attempts hit the cache.
---
note: the git tag is part of the cache key out of cache-staleness paranoia. It is not the full commit though, as that would kill the reproducibility-debugging use case.
android build: patch hostpython3 to not install setuptools
Add a patch to the hostpython3 p4a recipe to prevent it from installing setuptools as part of the ensurepip invocation. Setuptools is later installed from a hash-pinned recipe.
---
NOTE(ghost43): this is a workaround for reproducible-build issues we ran into during the 4.8.0 release. see https://github.com/spesmilo/electrum/pull/10739#issuecomment-4904680121
Since the last p4a rebase, p4a is installing some python packages using "pip install --target". We noticed that hostpython had two different versions of setuptools installed at the same time (two dist-info folders in site-packages/). This is due to the `--target` option for `pip install`. We are calling it with `--upgrade` too, but even then apparently it does not remove old versions. Indeed, when testing locally in a venv it leaves all .dist-infos there hanging. According to https://github.com/pypa/pip/issues/13763#issuecomment-3783977222, `--target` is not suitable or intended for this usecase at all.
Current patch is only focused on setuptools, as a minimal workaround. Ultimately the same issue could arise with any other package. For example, still with ensurepip itself, we could be left with multiple versions of pip installed. Or anything we install via hostpython_prerequisites could have duplicate versions installed...
100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
build: move default FRESH_CLONE location from /tmp to /var/tmp
Apparently many distros these days mount /tmp as RAM-disk. Even debian (starting with 13) does this now. The Android build needs to store dozens of gigs, so RAM is often not sufficiently large.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
android build: forbid buildozer to install unversioned deps of p4a
While p4a itself does not need ninja in our usage, to build Qt6, we need ninja. However instead of installing it from PyPI, I think debian main is much more trustworthy.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
util.make_aiohttp_session: wrap aiohttp-socks 0.11+ excs to ClientError
older versions of aiohttp-socks and python-socks used to raise - ProxyConnectionError(OSError) - ProxyTimeoutError(TimeoutError) - ProxyError(Exception)
now they raise: - ProxyConnectionError(Exception) - ProxyTimeoutError(Exception) - ProxyError(Exception)
In many call sites, we currently handle OSError and TimeoutError, usually by simply logging the error or showing it to the user. Another exceptions our call sites handle similarly is aiohttp.ClientError, which is the aiohttp base class for any client connection error.
A simple "fix" for us to restore the old behaviour is converting the new aiohttp_socks exception types to aiohttp.ClientError.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-priorityqetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.by Sander van Grieken · 11155fdf · Jul 2, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · Sander van Grieken
qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.
fixes #10714
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran
Sighash warnings/errors might in theory not be triggered for inputs owned by the wallet but which are beyond the gap limit. tx.add_info_from_wallet(wallet) side-effects the wallet state so that wallet.is_mine() learns derivation paths for beyond-gap-limit addresses.
In practice both GUIs currently call tx.add_info_from_wallet before check_sighash runs, so this was not exploitable.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
explicit security languagesigning or wallet path
AI analysis · Low 42/100
This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was that this safety check could be skipped for wallet addresses that were beyond the user's configured gap limit, because the wallet had not yet learned those addresses belonged to it. The fix makes the check self-contained by first asking the transaction to teach the wallet about any relevant addresses, using a copy so the original transaction is not changed. The commit message says the current graphical interfaces already performed this step, so the bug was not exploitable in practice through normal use.
cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 diff --git a/contrib/requirements/requirements-binaries.txt b/contrib/requirements/requirements-binaries.txt index b41089680..5771aef24 100644 --- a/contrib/requirements/requirements-binaries.txt +++ b/contrib/requirements/requirements-binaries.txt @@ -3,3 +3,12 @@ PyQt6 # we need at least cryptography>=2.1 for electrum.crypto, # and at least cryptography>=2.6 for dnspython[DNSSEC] cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +PyQt6==6.9.1 diff --git a/contrib/requirements/requirements-build-android.txt b/contrib/requirements/requirements-build-android.txt index e9d272837..4bf6cc1fc 100644 --- a/contrib/requirements/requirements-build-android.txt +++ b/contrib/requirements/requirements-build-android.txt @@ -20,3 +20,10 @@ toml # needed for the Qt/QML Android GUI: # TODO double-check this typing-extensions + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +sh==2.2.2 diff --git a/contrib/requirements/requirements-build-appimage.txt b/contrib/requirements/requirements-build-appimage.txt index ee8b4aa89..d79cd93b6 100644 --- a/contrib/requirements/requirements-build-appimage.txt +++ b/contrib/requirements/requirements-build-appimage.txt @@ -7,4 +7,11 @@ wheel # The pinned Cython must be installed before hidapi is built; # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 -Cython>=0.27 \ No newline at end of file +Cython>=0.27 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 diff --git a/contrib/requirements/requirements-build-base.txt b/contrib/requirements/requirements-build-base.txt index 5bfea96fe..6cc7d303c 100644 --- a/contrib/requirements/requirements-build-base.txt +++ b/contrib/requirements/requirements-build-base.txt @@ -28,3 +28,12 @@ flit_core>=3.4,<4 # aio-libs/frozenlist and aio-libs/propcache needs: # https://github.com/aio-libs/frozenlist/blob/c28f32d6816ca0fa56a5876e84831c46084bb85d/pyproject.toml#L6 expandvars + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 +setuptools-scm<9 + +expandvars==1.0.0 +poetry-core==2.1.3 diff --git a/contrib/requirements/requirements-build-mac.txt b/contrib/requirements/requirements-build-mac.txt index 5504223d3..583c91170 100644 --- a/contrib/requirements/requirements-build-mac.txt +++ b/contrib/requirements/requirements-build-mac.txt @@ -15,3 +15,12 @@ packaging>=22.0 # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 Cython>=0.27 + + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-build-wine.txt b/contrib/requirements/requirements-build-wine.txt index 80cccba33..647a90acb 100644 --- a/contrib/requirements/requirements-build-wine.txt +++ b/contrib/requirements/requirements-build-wine.txt @@ -9,3 +9,10 @@ altgraph pywin32-ctypes>=0.2.1 pyinstaller-hooks-contrib>=2025.2 packaging>=22.0 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-hw.txt b/contrib/requirements/requirements-hw.txt index 5dfb0290e..3c4955eb6 100644 --- a/contrib/requirements/requirements-hw.txt +++ b/contrib/requirements/requirements-hw.txt @@ -30,3 +30,13 @@ pyserial>=3.5.0,<4.0.0 # prefer older urllib3 to avoid needing hatchling # (pulled in via trezor -> requests -> urllib3) urllib3<2 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +libusb1<3.4 +protobuf==3.20.3 diff --git a/contrib/requirements/requirements.txt b/contrib/requirements/requirements.txt index e9963c12c..da9ab8cde 100644 --- a/contrib/requirements/requirements.txt +++ b/contrib/requirements/requirements.txt @@ -18,3 +18,15 @@ attrs>=20.1.0,<23 # - upper limit to avoid needing hatchling at build-time :/ # (however newer versions should work at runtime) dnspython>=2.2,<2.5 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +aiohappyeyeballs<2.7 +jsonpatch==1.33 +jsonpointer==3.0.0 +propcache==0.3.1 +protobuf==3.20.3 +python-socks==2.8.1 ```
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
note: 3.12 is in security-only status, so can't bump win/mac binaries without switching to 3.13 (as we don't compile our own cpython for those) we should bump those to at least 3.13...
85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
AI review queuedqt: fix crash through stale pi resolveby f321x · 299be410 · Jul 1, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · f321x
qt: fix crash through stale pi resolve
When multiple PIs get resolved consecutively through repeated editing of the PI field, and the `on_resolve_done` callback tries to access a PI that has been cleared by a previous, failed callback an exception is raised.
I was able to reproduce this somehow by adding a sleep to `PaymentIdentifier._do_resolve()` and entering lightning addresses.
When opening the 2fa app on an android phone the Electrum app gets killed, causing the user to lose the wizard state. This is quite annoying, so we should prevent this until there is a proper mechanism to keep the app alive.
76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queued(trivial) wallet: fix stale comment on on_event_invoice_statusby Sasha Zykov · 95317f4b · Jun 30, 2026 · 1 fileMessage 73 · AdequateTriage 12Details
Commit message · Sasha Zykov
(trivial) wallet: fix stale comment on on_event_invoice_status
The followup rename (_paid_invoice_keys -> _paid_invoice_keys_cache) and the de-sloppify left this comment referring to the old name and claiming the listener only tracks LN-driven changes; it is now the population path for onchain invoices too.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-priorityregtest: make extract_preimage less flakyby f321x · 2a321f08 · Jun 30, 2026 · 1 fileMessage 90 · StrongTriage 0Details
Commit message · f321x
regtest: make extract_preimage less flaky
Wait until the lnpay screen commands in the `extract_preimage` regtest return before checking their log output to prevent a race where the preimage becomes available but the log doesn't yet contain the success string.
``` ***** test_extract_preimage ****** initializing alice funding alice a6f8f660a3bab3c4af636849dae55f4c7d5d483289a5812c7efce19f4c701753 initializing bob funding bob b51eae095f875c7a796e74d87d6e4c21d42348272159ee30bd81ce7d9f18defe mining 1 blocks starting daemon (PID 5040) /tmp/alice/regtest/wallets/default_wallet true starting daemon (PID 5060) /tmp/bob/regtest/wallets/default_wallet true
alice opens channel 7cde6dcba2a0d033ecd40c1c7cb8eec4c554acb1a09099eb1206ba39a93728ae:1 mining 3 blocks wait until alice sees channel open. wait until alice sees channel open.. wait until alice sees channel open... 0caecfe64e319771d60f6f1e488f28d64667783432a15fccab534dfffb2096a4 mining 1 blocks wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728. wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728.. wait until alice has preimage for c217931809c870a8032d536e59ccf2399a5d96b937818c64ae60c7e7d5363728... wait until bob has preimage for c53556db6fcffcb2dd7c6b215e94d1af9c96e42c7170ae11e47b03a929917f28. bob payment failed Daemon stopped Daemon stopped ......F ====================================================================== FAIL: test_extract_preimage (tests.regtest.TestLightningAB) ```
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Lower-prioritytest_storage_upgrade: add upgrade from client_4_6_0_with_unfulfilled_htlcsby ThomasV · eff48a2d · Jun 30, 2026 · 3 filesMessage 50 · ThinTriage 0Details
Commit message · ThomasV
test_storage_upgrade: add upgrade from client_4_6_0_with_unfulfilled_htlcs
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
