Electrum

Recent Commits

• SomberNight (10 Jul 26)

  contrib/make_download: fix imports not sure why this was not an issue before(?) perhaps due to python version differences ``` $ ./contrib/make_download /home/user/wspace/electrum-web Traceback (most recent call last): File "/home/user/wspace/electrum/./contrib/make_download", line 17, in <module> version_spec = importlib.util.spec_from_file_location('version', 'electrum/version.py') ^^^^^^^^^^^^^^ AttributeError: module 'importlib' has no attribute 'util' ```

• SomberNight (08 Jul 26)

  release notes: bump 4.8.0 date for second attempt We failed to get a full quorum to reproduce the prior git tag. The android apks were problematic to reproducibly build. should be fixed by https://github.com/spesmilo/electrum/pull/10739 here we go again

• ghost43 (07 Jul 26)

  Merge pull request #10743 from SomberNight/202607_fresh_clone_vartmp build: move default FRESH_CLONE location from /tmp to /var/tmp

• ghost43 (07 Jul 26)

  Merge pull request #10739 from SomberNight/202607_android_build android build: use --no-isolation, hash-pin more deps, only one install of setuptools

• f321x (07 Jul 26)

  android build: patch hostpython3 to not install setuptools Add a patch to the hostpython3 p4a recipe to prevent it from installing setuptools as part of the ensurepip invocation. Setuptools is later installed from a hash-pinned recipe. --- NOTE(ghost43): this is a workaround for reproducible-build issues we ran into during the 4.8.0 release. see https://github.com/spesmilo/electrum/pull/10739#issuecomment-4904680121 Since the last p4a rebase, p4a is installing some python packages using "pip install --target". We noticed that hostpython had two different versions of setuptools installed at the same time (two dist-info folders in site-packages/). This is due to the `--target` option for `pip install`. We are calling it with `--upgrade` too, but even then apparently it does not remove old versions. Indeed, when testing locally in a venv it leaves all .dist-infos there hanging. According to https://github.com/pypa/pip/issues/13763#issuecomment-3783977222, `--target` is not suitable or intended for this usecase at all. Current patch is only focused on setuptools, as a minimal workaround. Ultimately the same issue could arise with any other package. For example, still with ensurepip itself, we could be left with multiple versions of pip installed. Or anything we install via hostpython_prerequisites could have duplicate versions installed...

• SomberNight (07 Jul 26)

  build: move default FRESH_CLONE location from /tmp to /var/tmp Apparently many distros these days mount /tmp as RAM-disk. Even debian (starting with 13) does this now. The Android build needs to store dozens of gigs, so RAM is often not sufficiently large.

• SomberNight (04 Jul 26)

  android build: forbid buildozer to install unversioned deps of p4a While p4a itself does not need ninja in our usage, to build Qt6, we need ninja. However instead of installing it from PyPI, I think debian main is much more trustworthy.

• SomberNight (04 Jul 26)

  android build: build p4a recipes with --no-isolation the core change is https://github.com/spesmilo/python-for-android/commit/8c0fcc9ef2e559918ca96ecde6e09fe521bb1427 the rest here just follow that

• SomberNight (04 Jul 26)

  release notes: mention increased min android version ref https://github.com/spesmilo/electrum/pull/10485

• ghost43 (02 Jul 26)

  Merge pull request #10734 from f321x/qml_people qml: add myself to About page

• f321x (02 Jul 26)

  qml: add myself to About page

• ThomasV (02 Jul 26)

  update locale

• ThomasV (02 Jul 26)

  Merge pull request #10719 from f321x/release_v4.8.0 Release v4.8.0

• ThomasV (02 Jul 26)

  Merge pull request #10727 from SomberNight/202607_deps build: update some dependencies, all over

• ThomasV (02 Jul 26)

  Merge pull request #10733 from SomberNight/202607_aiohttp_proxyerror util.make_aiohttp_session: wrap aiohttp-socks 0.11+ excs to ClientError

• SomberNight (02 Jul 26)

  util.make_aiohttp_session: wrap aiohttp-socks 0.11+ excs to ClientError older versions of aiohttp-socks and python-socks used to raise - ProxyConnectionError(OSError) - ProxyTimeoutError(TimeoutError) - ProxyError(Exception) now they raise: - ProxyConnectionError(Exception) - ProxyTimeoutError(Exception) - ProxyError(Exception) In many call sites, we currently handle OSError and TimeoutError, usually by simply logging the error or showing it to the user. Another exceptions our call sites handle similarly is aiohttp.ClientError, which is the aiohttp base class for any client connection error. A simple "fix" for us to restore the old behaviour is converting the new aiohttp_socks exception types to aiohttp.ClientError. ref https://github.com/romis2012/aiohttp-socks/commit/db4235c2b9805f088e47074647c946873a231487 ref https://github.com/romis2012/python-socks/commit/50a3024a8ac10888085f963e44ab3a79d6574703

• accumulator (02 Jul 26)

  Merge pull request #10731 from accumulator/fix_10714 qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.

• Sander van Grieken (02 Jul 26)

  qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter. fixes #10714

• f321x (30 Jun 26)

  increase ELECTRUM_VERSION to 4.8.0

• f321x (30 Jun 26)

  add release notes for version 4.8.0

• ghost43 (01 Jul 26)

  Merge pull request #10729 from SomberNight/202606_sighash wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran

• SomberNight (01 Jul 26)

  wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran Sighash warnings/errors might in theory not be triggered for inputs owned by the wallet but which are beyond the gap limit. tx.add_info_from_wallet(wallet) side-effects the wallet state so that wallet.is_mine() learns derivation paths for beyond-gap-limit addresses. In practice both GUIs currently call tx.add_info_from_wallet before check_sighash runs, so this was not exploitable.

• ghost43 (01 Jul 26)

  Merge pull request #10728 from SomberNight/202607_header_checkpoints update block header checkpoints

• SomberNight (01 Jul 26)

  update block header checkpoints ``` >>> network.export_checkpoints(f"/home/user/wspace/electrum/electrum/chains/{electrum.constants.net.NET_NAME}/checkpoints.json") ```

• SomberNight (01 Jul 26)

  build: rerun freeze_packages somewhat conservative and paranoid... generated with patch: ``` user@debian:~/wspace/electrum$ git diff diff --git a/contrib/requirements/requirements-binaries-mac.txt b/contrib/requirements/requirements-binaries-mac.txt index ab8bd5f33..dfbd55c2b 100644 --- a/contrib/requirements/requirements-binaries-mac.txt +++ b/contrib/requirements/requirements-binaries-mac.txt @@ -5,3 +5,11 @@ PyQt6<6.7 PyQt6-Qt6<6.7,!=6.6.3 cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 diff --git a/contrib/requirements/requirements-binaries.txt b/contrib/requirements/requirements-binaries.txt index b41089680..5771aef24 100644 --- a/contrib/requirements/requirements-binaries.txt +++ b/contrib/requirements/requirements-binaries.txt @@ -3,3 +3,12 @@ PyQt6 # we need at least cryptography>=2.1 for electrum.crypto, # and at least cryptography>=2.6 for dnspython[DNSSEC] cryptography>=2.6 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +PyQt6==6.9.1 diff --git a/contrib/requirements/requirements-build-android.txt b/contrib/requirements/requirements-build-android.txt index e9d272837..4bf6cc1fc 100644 --- a/contrib/requirements/requirements-build-android.txt +++ b/contrib/requirements/requirements-build-android.txt @@ -20,3 +20,10 @@ toml # needed for the Qt/QML Android GUI: # TODO double-check this typing-extensions + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +sh==2.2.2 diff --git a/contrib/requirements/requirements-build-appimage.txt b/contrib/requirements/requirements-build-appimage.txt index ee8b4aa89..d79cd93b6 100644 --- a/contrib/requirements/requirements-build-appimage.txt +++ b/contrib/requirements/requirements-build-appimage.txt @@ -7,4 +7,11 @@ wheel # The pinned Cython must be installed before hidapi is built; # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 -Cython>=0.27 \ No newline at end of file +Cython>=0.27 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 diff --git a/contrib/requirements/requirements-build-base.txt b/contrib/requirements/requirements-build-base.txt index 5bfea96fe..6cc7d303c 100644 --- a/contrib/requirements/requirements-build-base.txt +++ b/contrib/requirements/requirements-build-base.txt @@ -28,3 +28,12 @@ flit_core>=3.4,<4 # aio-libs/frozenlist and aio-libs/propcache needs: # https://github.com/aio-libs/frozenlist/blob/c28f32d6816ca0fa56a5876e84831c46084bb85d/pyproject.toml#L6 expandvars + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 +setuptools-scm<9 + +expandvars==1.0.0 +poetry-core==2.1.3 diff --git a/contrib/requirements/requirements-build-mac.txt b/contrib/requirements/requirements-build-mac.txt index 5504223d3..583c91170 100644 --- a/contrib/requirements/requirements-build-mac.txt +++ b/contrib/requirements/requirements-build-mac.txt @@ -15,3 +15,12 @@ packaging>=22.0 # otherwise when installing hidapi, pip just downloads the latest Cython. # see https://github.com/spesmilo/electrum/issues/5859 Cython>=0.27 + + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +Cython<3.2 +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-build-wine.txt b/contrib/requirements/requirements-build-wine.txt index 80cccba33..647a90acb 100644 --- a/contrib/requirements/requirements-build-wine.txt +++ b/contrib/requirements/requirements-build-wine.txt @@ -9,3 +9,10 @@ altgraph pywin32-ctypes>=0.2.1 pyinstaller-hooks-contrib>=2025.2 packaging>=22.0 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +pyinstaller-hooks-contrib==2025.4 diff --git a/contrib/requirements/requirements-hw.txt b/contrib/requirements/requirements-hw.txt index 5dfb0290e..3c4955eb6 100644 --- a/contrib/requirements/requirements-hw.txt +++ b/contrib/requirements/requirements-hw.txt @@ -30,3 +30,13 @@ pyserial>=3.5.0,<4.0.0 # prefer older urllib3 to avoid needing hatchling # (pulled in via trezor -> requests -> urllib3) urllib3<2 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +cryptography==46.0.7 +pycparser==2.23 +libusb1<3.4 +protobuf==3.20.3 diff --git a/contrib/requirements/requirements.txt b/contrib/requirements/requirements.txt index e9963c12c..da9ab8cde 100644 --- a/contrib/requirements/requirements.txt +++ b/contrib/requirements/requirements.txt @@ -18,3 +18,15 @@ attrs>=20.1.0,<23 # - upper limit to avoid needing hatchling at build-time :/ # (however newer versions should work at runtime) dnspython>=2.2,<2.5 + + +pip==25.1.1 +setuptools==80.9.0 +wheel==0.45.1 + +aiohappyeyeballs<2.7 +jsonpatch==1.33 +jsonpointer==3.0.0 +propcache==0.3.1 +protobuf==3.20.3 +python-socks==2.8.1 ```

• SomberNight (01 Jul 26)

  android build: bump openssl (3.0.18 -> 3.0.21)

• SomberNight (01 Jul 26)

  build: bump python versions in binaries note: 3.12 is in security-only status, so can't bump win/mac binaries without switching to 3.13 (as we don't compile our own cpython for those) we should bump those to at least 3.13...

• ghost43 (01 Jul 26)

  Merge pull request #10722 from f321x/followup_10543 qml/2fa: partially reverse #10543

• ThomasV (01 Jul 26)

  Merge pull request #10726 from f321x/fix_10724 qt: fix crash through stale pi resolve

• f321x (01 Jul 26)

  qt: fix crash through stale pi resolve When multiple PIs get resolved consecutively through repeated editing of the PI field, and the `on_resolve_done` callback tries to access a PI that has been cleared by a previous, failed callback an exception is raised. I was able to reproduce this somehow by adding a sleep to `PaymentIdentifier._do_resolve()` and entering lightning addresses. Fixes https://github.com/spesmilo/electrum/issues/10724