BitBox02

Recent Commits

• benma (09 Jul 26)

  Merge pull request #4231 from benma-agent/simulator/add-v9.26.3 simulator: add firmware v9.26.3

• Marko Bencun (09 Jul 26)

  Merge remote-tracking branch 'pull/merge-release-v4.51.2'

• benma's agent (09 Jul 26)

  simulator: add firmware v9.26.3 Add the v9.26.3 BitBox02 simulator release to the simulator test data. Simulator tests pass with the updated list.

• Marko Bencun (08 Jul 26)

  Merge remote-tracking branch 'benma/fix/restrict-config-permissions'

• Marko Bencun (08 Jul 26)

  Merge branch 'merge-master-into-release-v4.51.2' into release-v4.51.2

• Marko Bencun (08 Jul 26)

  merge master into release v4.51.2 Conflict resolution summary: - backend/coins/btc/coin.go: took pull/master; it already has the headers-status backport plus the Initialize() error refactor. - backend/handlers/handlers.go: took pull/master; it has the same response-shape fix on the generic /coins/{coinCode}/headers/status route. - backend/coins/btc/transactions/transactions.go: took pull/master; it already has the BTC transaction-sync backports plus later notifier and verification refactors. - backend/devices/bitbox02bootloader/handlers/handlers.go: kept the release bitbox02bootloader.Status return type and master success and error response wrappers. - frontends/web/src/components/devices/bitbox02bootloader/bitbox02bootloader.tsx: kept the release deferred /info loading while preserving master request-error handling.

• Marko Bencun (05 Jul 26)

  backend: restrict config file permissions Create app-private directories with 0700 and write wallet config files with 0600. Migrate existing broad config and log files on startup while leaving symlinks untouched.

• Jad (09 May 26)

  clear cache function add clear cache button in advanced settings so users don't need to manually navigate folders to delete them.

• Nikolas De Giorgis (07 Jul 26)

  tests: add playwright test for clearing cache.

• benma (06 Jul 26)

  Merge pull request #3896 from BitBoxSwiss/dependabot/go_modules/github.com/ethereum/go-ethereum-1.17.0 build(deps): bump github.com/ethereum/go-ethereum from 1.17.0 to 1.17.4

• dependabot[bot] (06 Jul 26)

  build(deps): bump github.com/ethereum/go-ethereum from 1.17.0 to 1.17.4 Bumps [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) from 1.17.0 to 1.17.4. - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](https://github.com/ethereum/go-ethereum/compare/v1.17.0...v1.17.4) --- updated-dependencies: - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• benma (06 Jul 26)

  Merge pull request #3893 from BitBoxSwiss/dependabot/github_actions/actions/upload-artifact-7 build(deps): bump actions/upload-artifact from 6 to 7

• benma (06 Jul 26)

  Merge pull request #3894 from BitBoxSwiss/dependabot/go_modules/golang.org/x/net-0.51.0 build(deps): bump golang.org/x/net from 0.48.0 to 0.56.0

• benma (06 Jul 26)

  Merge pull request #3895 from BitBoxSwiss/dependabot/go_modules/github.com/decred/dcrd/dcrec/secp256k1/v4-4.4.1 build(deps): bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.4.0 to 4.4.1

• dependabot[bot] (06 Jul 26)

  build(deps): bump actions/upload-artifact from 6 to 7 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (06 Jul 26)

  build(deps): bump golang.org/x/net from 0.48.0 to 0.56.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.48.0 to 0.56.0. - [Commits](https://github.com/golang/net/compare/v0.48.0...v0.56.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (06 Jul 26)

  build(deps): bump github.com/decred/dcrd/dcrec/secp256k1/v4 Bumps [github.com/decred/dcrd/dcrec/secp256k1/v4](https://github.com/decred/dcrd) from 4.4.0 to 4.4.1. - [Release notes](https://github.com/decred/dcrd/releases) - [Changelog](https://github.com/decred/dcrd/blob/master/CHANGES) - [Commits](https://github.com/decred/dcrd/compare/dcrec/secp256k1/v4.4.0...dcrec/secp256k1/v4.4.1) --- updated-dependencies: - dependency-name: github.com/decred/dcrd/dcrec/secp256k1/v4 dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

• benma (06 Jul 26)

  Merge pull request #4208 from BitBoxSwiss/dependabot/go_modules/go_modules-c7ca89b307 build(deps): bump the go_modules group across 1 directory with 2 updates

• benma (06 Jul 26)

  Merge pull request #4206 from BitBoxSwiss/dependabot/github_actions/actions/checkout-7 build(deps): bump actions/checkout from 6 to 7

• benma (06 Jul 26)

  Merge pull request #4207 from BitBoxSwiss/dependabot/github_actions/actions/cache-6 build(deps): bump actions/cache from 5 to 6

• Marko Bencun (06 Jul 26)

  Merge branch 'fix/webdev-lan-access'

• Marko Bencun (05 Jul 26)

  dev: bind servers to loopback by default servewallet and Vite should not listen on every host interface during normal local development. Dev mode exposes unauthenticated local services. Docker still needs BITBOX_DEV_BIND_HOST=0.0.0.0 inside the container because published ports are reached through the container's external interface. The published host ports are bound to 127.0.0.1 so they remain accessible from the host without exposing them to the LAN.

• Marko Bencun (06 Jul 26)

  Merge branch 'aopp-host'

• Marko Bencun (06 Jul 26)

  frontend: harden AOPP VASP matching AOPP requester branding matched known VASPs with a raw string suffix. A callback host like evilbitcoinsuisse.com could therefore render Bitcoin Suisse branding even though it is not that domain or one of its subdomains. Require an exact host match or a dot-boundary subdomain match, and keep the real callback host visible when branding a subdomain. Add regression tests for exact, subdomain, and suffix-spoof hosts.

• strmci (06 Jul 26)

  Merge branch 'move_insurance_to_marketplace'

• thisconnect (09 Jun 26)

  frontend: simplify market routing state Drop unnecessary supported-accounts state. Simplify routing without the layout wrapper. Move market logic into MarketContext. Drop the one-use tab reader because the tab is controlled by app. Treat account code as one of the account codes. Update market tab tests.

• strmci (11 May 26)

  frontend: move insurance into marketplace Route Bitsurance through the marketplace flow so tab navigation, account selection, and swap availability share one context.

• Marko Bencun (03 Jul 26)

  Merge remote-tracking branch 'benma/bb02update'

• sl (02 Jul 26)

  Merge branch 'frontend-back-chevron'

• sl (25 Jun 26)

  frontend: use mobile header for back navigation on mobile changed the previously used Back button on page body, to be the chevron back on mobile header.