Bisq

Recent Commits

• HenrikJannsen (10 Jul 26)

  Merge pull request #7959 from HenrikJannsen/Fix-test Fix TradeStatistics3 hash validation test fixture

• HenrikJannsen (10 Jul 26)

  Fix TradeStatistics3 hash validation test fixture TradeStatistics3 only enforces proto hash validation for trades after the strict hash-check date. The test helper used date=1, so wrong-hash fixtures bypassed the validation path they were meant to cover. Use a deterministic post-cutoff timestamp for helper-created trade statistics so invalid-hash tests exercise the expected strict validation behavior.

• HenrikJannsen (10 Jul 26)

  Merge pull request #7958 from HenrikJannsen/Revert-hash-check-in-TradeStatistics3 Only do strict hash check for items after STRICT_HASH_CHECK_DATE

• HenrikJannsen (10 Jul 26)

  Merge pull request #7957 from HenrikJannsen/Add-signature-pub-key-dump-script Add signature pub key dump script

• HenrikJannsen (10 Jul 26)

  Only do strict hash check for items after STRICT_HASH_CHECK_DATE

• HenrikJannsen (10 Jul 26)

  Add signature pub key dump script Add a JDK-only script that reads Bisq's PKCS#8 DSA sig.key, derives the DSA public key the same way KeyStorage does, and prints the X.509 public key bytes as lowercase hex to match dumpSignaturePubKey.

• HenrikJannsen (08 Jul 26)

  Merge pull request #7953 from KimStrand/fix-installer-evidence-path Fix installer evidence artifact lookup path

• HenrikJannsen (08 Jul 26)

  Merge pull request #7951 from fenlark/resend-payment-started-msg-at-startup Re-send payment started message at startup when it was never ACKed

• KimStrand (08 Jul 26)

  Fix installer evidence artifact lookup path

• HenrikJannsen (08 Jul 26)

  Merge pull request #7952 from HenrikJannsen/Improve-DisputeManager Improve dispute manager

• HenrikJannsen (08 Jul 26)

  Merge pull request #7938 from bisq-network/dependabot/github_actions/actions/cache-6.1.0 Bump actions/cache from 5.0.5 to 6.1.0

• HenrikJannsen (08 Jul 26)

  Merge pull request #7946 from bisq-network/dependabot/github_actions/docker/setup-buildx-action-4.2.0 Bump docker/setup-buildx-action from 4.1.0 to 4.2.0

• HenrikJannsen (08 Jul 26)

  Merge pull request #7937 from bisq-network/dependabot/github_actions/actions/setup-java-5.4.0 Bump actions/setup-java from 5.3.0 to 5.4.0

• HenrikJannsen (08 Jul 26)

  Merge pull request #7923 from HenrikJannsen/remove-arbitrator-data-from-various-domain-objects Remove arbitrator data from various domain objects

• HenrikJannsen (08 Jul 26)

  Remove duplicated code

• HenrikJannsen (08 Jul 26)

  Fail closed when validating new dispute openings Validate the embedded dispute support type and NEW state before accepting an OpenNewDisputeMessage, and route opener-signature failures through the same validation exception path as other pre-persistence failures. Include the incoming dispute in replay checks before it is persisted so the first legitimate dispute for a trade is still accepted.

• HenrikJannsen (08 Jul 26)

  Refactor: Rename to make more clear what the method does.

• fenlark (07 Jul 26)

  Re-send payment started message at startup when it was never ACKed The buyer re-sends CounterCurrencyTransferStartedMessage on a timer until the seller ACKs it. The timer only lives in memory, so a restart kills it. The STARTUP rule in BuyerProtocol#onInitialized re-ran the send task only for the STORED_IN_MAILBOX and SEND_FAILED states. It skipped BUYER_SENT_FIAT_PAYMENT_INITIATED_MSG (sent, but no ACK yet). Such a trade never re-sent the message. The buyer stayed stuck at "Please send confirmation again". The seller never learned the payment was started. This often ended in needless mediation. Fix: include BUYER_SENT_FIAT_PAYMENT_INITIATED_MSG in the STARTUP re-send condition. Re-sending is safe: the message has a deterministic uid, so re-sends deduplicate, and the seller side tolerates repeated delivery. Also skip the send when the persisted message state is already ACKNOWLEDGED. That happens when the ACK arrives while no task is listening (right after a restart). In that case only apply the BUYER_SAW_ARRIVED state transition. Fixes the buyer side of #7243. Also reported in #6715 and #3372.

• HenrikJannsen (07 Jul 26)

  Merge pull request #7949 from HenrikJannsen/Add-option-for-removing-all-alerts Add option for removing all alerts

• HenrikJannsen (07 Jul 26)

  Add option for removing all alerts which have been created by the alert author. Track alert creation timestamps inside AlertManager. Only newer alerts replace the current alert, startup hydration keeps the newest storage entry selected, and removing the current alert falls back to the next newest tracked alert.

• HenrikJannsen (07 Jul 26)

  Merge pull request #7948 from HenrikJannsen/cherrypicked-1.10.3-commits Cherrypicked 1.10.3 commits

• dependabot[bot] (06 Jul 26)

  Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• HenrikJannsen (06 Jul 26)

  Use v1.10.3 instead of v1.10.2 in comments, build and sh script

• Alejandro García (05 Jul 26)

  hardening-of-dispute-agent-messages-min-package

• Alejandro García (05 Jul 26)

  harden-validation-of-peers-deposit-tx-DPT-binding

• HenrikJannsen (06 Jul 26)

  Add v1.10.3 release notes Document the release range from 358b546526 through v1.10.3, covering filter deactivation, failed-trade API guarding, deposit/DPT binding hardening, and support/dispute message authentication.

• Alejandro García (05 Jul 26)

  Bump version number for v1.10.3

• HenrikJannsen (04 Jul 26)

  Prevent that a failed trade can move forward to payment started state in CoreTradesService used in the api.

• HenrikJannsen (04 Jul 26)

  Merge pull request #7939 from wodoro/fix/mediation-dispute-validation fix: broken mediation on master

• wodoro (02 Jul 26)

  fix: restore mediation broken by fail-closed dispute validation Commit 8b432c6e94 moved DisputeValidation ahead of the side effects in onOpenNewDisputeMessage and made every failure fail-closed. Two problems: 1. testIfDisputeTriesReplay assumed the dispute under test was already in the list (pre-1.10.3 order validated after disputeList.add). Run before the add, the first legitimate dispute for a trade hit a null trade-id set and threw "more then 2 disputes", so the agent silently dropped it and mediation never progressed. 2. Fail-closing on advisory data checks (donation address, node address) silently discarded legitimate disputes and stopped surfacing the agent popup those cases rely on, while still exposing a popup-flood vector for incorrect payloads. Fixes: - testIfDisputeTriesReplay now counts the dispute under test via an idempotent uid injection, so the <= 2 limit holds regardless of whether the caller validates before or after adding to the list. - Split ingest validation: integrity checks (contract data, replay) stay fail-closed and drop silently (log only, no popup); advisory checks (node/donation address) store and forward the dispute and alert the agent via validationExceptions, matching pre-1.10.3 behavior and the sibling peerOpenedDisputeForTrade handler. Tests: DisputeValidationTest replay regressions; DisputeManagerAuthTest hard-drop vs advisory-store paths.