6.13.0

b3b1605

Full Changelog: v6.12.2...v6.13.0

6.13.0

Important Upgrade Note

• Android installations from the pre-v5 Hive-storage era no longer attempt the removed legacy migration. Before startup, the app displays a protected backup screen containing every recoverable phrase and passphrase, then instructs the user to reinstall and recover. Current installations are unaffected. Do not uninstall before completing the displayed backup. (#2559)

New Features

• Temporary replacement for unavailable Boltz swaps: Lightning sends, Lightning receives, Bitcoin ↔ Liquid transfers, and automatic Liquid-to-Bitcoin transfers now use a temporary replacement service while Boltz is unavailable. Orders are persisted before funds move, interrupted broadcasts can resume safely, and completed swaps appear in transaction history with their labels. (#2563)
• Payjoin across wallet and Exchange flows: Payjoin can be enabled for Bitcoin sends and receives, with configurable minimum amounts and session lifetimes. Supported Buy payouts and Sell/Pay payins can negotiate Payjoin, with recovery and fallback handling for interrupted sessions. (#2499, #2509, #2545)
• Liquid UTXO consolidation: Liquid wallets approaching the confidential-transaction input limit now show a warning and offer a guided self-transfer to consolidate UTXOs. (#2465)
• Checksum-aware recovery phrase entry: The final BIP39 word now offers checksum-valid suggestions. Recovery entry also received improved inline validation, secret-safe errors, and screen-capture protection. (#2551)
• BTC Map: A themed BTC Map is now available from Settings without requesting device location. Navigation is restricted to BTC Map hosts. (#1461, #2411, #2423)
• Home update warning: The wallet displays a dismissible warning when the swap API reports that the app must be updated. (#2563)
• Liquid risk information: Liquid wallet and Liquid-backed Lightning receive screens now link to a disclosure covering custody, privacy, fees, and automatic transfers. (#2253)

Security and Privacy

• Hardened transaction review and broadcast so cached payloads are invalidated when payment details change and signed transactions are checked against the reviewed transaction. (#2578, #2669)
• Enforced PIN retry cooldowns across restarts and added PIN re-authentication before revealing all recovery phrases. (#2578)
• Strengthened wallet and label imports with private-key rejection, network and descriptor checks, duplicate detection, ownership validation, and orphan-seed cleanup. (#2324, #2325, #2669)
• Hardened Electrum, fee, and mempool connections with stricter certificate, URL, timeout, redirect, and Tor handling. (#2557, #2669)
• Hardened QR, UR, BBQR, BIP21, PSBT, transaction-parent, and label parsing against malformed or mismatched input. (#2669)
• Reduced sensitive information in logs and error reporting and protected additional secret screens from capture. (#2578, #2669)
• Added a warning before sending to an unconfidential Liquid address. (#2578)

Reliability and UX

• Payjoin sessions now recover after restarts, serialize competing operations, expire cleanly, and avoid duplicate or conflicting broadcasts.
• Replacement-service swap records preserve their original payment contract through refreshes, and funded failures remain visible and reconcilable.
• Buy, Sell, and Pay flows received lifecycle, fee-selection, price-lock, and duplicate-settlement fixes.
• Wallet deletion no longer leaves an orphaned seed that blocks importing the same recovery phrase again. (#2324, #2325)
• Startup failures can now share or export logs as a file. (#2565)
• Filled the translation backlog across all 26 non-English locales and repaired missing placeholders and untranslated copies. (#2463)

Under the Hood

• Upgraded to Flutter 3.44.9 and Dart 3.12.2. (#2670)
• Extracted the Payjoin engine, persistence, and public contract into the bull_payjoin workspace package and added a shared primitives package. (#2545)
• Added database schema 14 for announcement dismissals and replacement-service swap orders.
• Removed the unreleased experimental Ark implementation and its dependency. No user migration is required. (#2561)
• Strengthened reproducible Android builds, dependency pinning, format enforcement, and CI verification. (#2418, #2419, #2436)
• Android release version: 6.13.0+214.

Android APK Verification

The GitHub release provides a universal APK containing all supported Android ABIs.

• Signed APK SHA-256: 33791c805cf4ffc15bf73c96de709ecf651224bea88f5df3c2ff5a0bf3d0ef8f
• Signing certificate SHA-256: 9e1394519875c7a92e00f137a711df3c66684dd1f47db91817501c68a8e63ed8
• Reproducible unsigned APK SHA-256: 56ad3c6dabf80465c4a2628a61216a02ba6fe797741c82cefca6c07e98cfec0f

The unsigned APK was reproduced byte-for-byte from the same source revision on GitHub Actions and an independent local build.

New Contributors

• @thibistaken made their first contribution in #2411
• @spacebear21 made their first contribution in #2041
• @github-actions[bot] made their first contribution in #2497
• @leesalminen made their first contribution in #2554