Everything in 2.5.5-blake2b.21, plus one change. Signing is unchanged.
Only says replay protected when it checked
The transaction view could read Replay protected for a transaction carrying none. Any 64 or 65 byte push decodes as a signature whose hash type is its own last byte, so a taproot control block, an uncompressed public key, or a signature a stranger added and finalising drops all counted as an opt-in.
It now counts an opt-in only where a signature verifies against a key this wallet derives, for an input whose spent output matches the script this wallet derives for it. Keys are never taken from the transaction file, since whoever wrote the file wrote those too. What could not be checked reads as not checked rather than as protected.
A transaction signed only by a taproot script path also read as unsigned, so the label repeated what the file declared about itself. Those signatures are read now.
This matters most if someone hands you a transaction to sign: they can add a signature of their own that opts in, and finalising drops it, so what broadcasts carries no protection while the label said it did.
No warranty
This is unofficial, unaudited software provided as is, with no warranty and no liability, under the same Apache 2.0 license it inherits. It is not a Sparrow release and is neither affiliated with nor supported by the Sparrow project, nor by any hardware wallet manufacturer. Using it is entirely at your own risk, and you alone bear any loss of funds.
Verifying this release
If you already have Shrike installed, download SHA256SUMS, SHA256SUMS.asc and your install file into one folder, then drag any of them onto Shrike, or open Tools > Verify Download.
Otherwise, with gpg, adding privkeyio-signing-key.asc to that folder:
gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
Look for Good signature from "Kyle Santiago <kyle@privkey.io>" on key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38, and OK for your file. The warning that the key is not certified is expected: it means only that you have not marked it trusted yourself.