2.5.4

• Always require anti-klepto on the BitBox02, raising the minimum firmware version to 9.4.0, and warn on a taproot signing issue with older firmware
• Add a BitBox02 attestation failed dialog, reporting an unattestable version or a short attestation response as a failed check
• Register the wallet policy again and retry when the Ledger rejects a stored registration, and check HID read and write results in the Ledger transport
• Serialise USB device access so the periodic enumeration cannot interrupt an operation in progress, and isolate a misbehaving device from the rest of the enumeration
• Reject truncated and oversized TLV lengths when parsing keycard responses, and fail rather than loop indefinitely on an unsuccessful card wait or repeated secure channel resets
• Gate the display address, sign message and keystore discovery panes on a fingerprint resolved after in-app PIN entry
• Improve validation of BIP129, descriptor and Unchained wallet imports, and detect legacy multisig descriptors case insensitively when warning about key sorting
• Confirm the imported quorum and cosigners before completing an incomplete multisig wallet
• Improve max cosigner handling in the Settings tab, reducing the maximum to 15 for legacy P2SH multisig wallets
• Confirm the passphrase in the wallet-level and terminal seed imports, and clarify that the SLIP39 import passphrase applies to all shares and not individual ones
• Warn before creating a keystore from a scanned seed with an invalid checksum
• Name the conflicting keystore when an entered extended key is not unique, and ensure imported keystore labels are truncated and unique
• Reject extended private keys when creating a terminal watch only wallet, and show import errors
• Check and reprompt for the BIP38 passphrase rather than clearing the encrypted key
• Improve validation of legacy multipart QR part numbers, and catch any parse failure when opening pasted or server-fetched transactions
• Fall back to the next usable camera instead of failing the QR scan on one reporting no resolutions
• Improve randomization for UTXO selection, input and output shuffling, and anti-fee-sniping
• Clear silent payment, DNSSEC proof and taproot keypath fields from public PSBT copies used in payjoins
• Improve validation of payjoin proposals, accepting a substituted payment output where a change output is present
• Scope payjoin endpoints to the payment tab and transaction instead of the destination address, and disable payjoin on transactions with silent payment outputs
• Disable transaction version and locktime editing once signed
• Skip malformed silent payment tweak values rather than aborting the scan batch
• Show the resource an auth47 challenge is signed for
• Always check and restrict existing wallets and backup directories to owner only permissions
• Retain the existing wallet encryption when a password change is cancelled, and release the reference to the derived encryption key when clearing a loaded wallet
• Compare the ECIES MAC in constant time
• Redact the Bitcoin Core credentials from the BWT debug log, and secret-bearing messages and CPace pairing values from Trezor debug logs
• Support additional Electrum server RPC methods with configurable batch paging, and document the server RPC method contracts
• Bound the Electrum read timeout across the wait for a response, not just acquiring the read lock, and bound the Bitcoin Core RPC connect and read timeouts, exempting the methods that rescan synchronously
• Range check the server supplied minimum relay fee
• Verify that fetched transactions match the requested txid
• Maintain a verified block header store anchored at pinned per-network checkpoints, refreshing affected wallets on a reorg
• Verify merkle inclusion proofs for newly confirmed transactions, leaving them unconfirmed where they cannot be proved
• Verify proof of work on chain tips and warn when a tip goes stale
• Warn when a Bitcoin Core node is neither local nor onion, and report failed Bitcoin Core descriptor imports instead of only logging them
• Close remaining local DNS resolution gaps when classifying hostnames and connecting via Tor
• Resolve BIP353 HRNs over TCP via the SOCKS proxy when one is configured, reusing the connection between queries
• Eliminate DNS payment resolution races by matching the currently entered recipient
• Disable the proxy setting when a blank proxy server is configured
• Only save certificates passing hostname verification as CA validated, and retain not yet valid certificates
• Verify the version check signature before assigning the current version used in the download verifier
• Report an oversized download manifest instead of verifying the signature alone, and ignore the results of superseded download verifications
• Pin the Gradle distribution checksum in the wrapper properties
• Fix the skipInstallers property being ignored and document its use
• Upgrade hummingbird to v1.7.5
• Bug fix: Fix wallets sharing a filename prefix having their backups deleted, or being re-encrypted on a password change
• Bug fix: Fix preserving leading zero bytes when decoding SLIP39 share values
• Bug fix: Fix handling an absent final scriptSig or witness when restoring the original payjoin inputs
• Bug fix: Fix storage left open when testing schema validation (@nzb-tuxxx)
• Bug fix: Fix detecting notification transactions where an OP_RETURN output has no push data
• Bug fix: Fix compressed key encoding round trips and verify the BIP38 address hash

2.5.3

• Add opt-in XDG base directory support on macOS and Linux, resolved independently per category
• Add support for the ERA hardware wallet
• Add an option to ignore dust on private key sweeps (@nroktib)
• Verify that scanned or loaded transactions match the originating PSBT, checking all open tabs
• Update external Tor SOCKS proxy control port authentication to support safe cookie authentication
• Use an owner-only temporary directory for wallet import and export
• Update scanned keystores to the importer type and model on wallet import
• Replace the openpnp-capture-java dependency with an FFM-based implementation (@doblon8)
• Add Gradle dependency verification metadata, and a workflow to keep it updated (@nzb-tuxxx)
• SHA pin all GitHub actions used in workflows
• Update the WiX installer template to match the stock JDK 25 template plus registry entries
• Change the BIP329 wallet labels export to only assert spendable false for frozen coins, and omit otherwise
• Treat whitespace-only BIP329 labels as blank on label import and export
• Align the error message for connected devices without silent payments support with other related exceptions
• Upgrade lanterna to v3.1.5
• Upgrade the beryx jlink plugin to v4.0.2
• Bug fix: Fix a regression from the JDK 25 update causing silent skips when importing JSONL wallet label lines
• Bug fix: Fix a regression of JSON wallet serialization with JDK 25
• Bug fix: Fix an NPE comparing an unresolved silent payment output
• Bug fix: Fix a potential date formatting concurrency issue on backup

2.5.2

• Improve verification of loaded PSBTs to warn on non-default sighash types
• Warn on loading transactions with non-zero outputs of an unknown script type
• Improve BIP375 verification of precomputed SP outputs in PSBTs
• Implement dust detection for SP wallets on received UTXOs at a higher default limit of 5000 sats (configurable with dustAttackThresholdSp)
• Use the configured unit format in the Send To Many dialog instead of the JVM default
• Improve URL validation for auth47 and lnurl-auth
• Add a custom context menu to the signature text area in the Message Sign dialog
• Show the full year on the balance chart x-axis (@PeterXMR)
• Update hid4java on Linux x86 to remove the native library rpath
• Bug fix: Fix a potential off-by-1-sat rounding error on imported amounts in the Send To Many dialog
• Bug fix: Fix potential NPEs resulting from issues fetching transactions

2.5.1

• Update the BIP322 implementation to match the Completed specification
• Bug fix: Fix incorrect script type selected in the Settings tab on loading a wallet with a non-default script type
• Bug fix: Fix a potential NPE on the transaction entry tooltip

2.5.0

• Add Silent Payments (SP) receiving wallets, including support for airgapped hardware wallet signers
• Add frigate.2140.dev as an SP-capable public Electrum server and auto-select it as required
• Add a BIP32 derivation fallback when retrieving signing nodes for high-index inputs
• Add bitview.space as a fee rates source
• Extend the post-broadcast mempool poll timeout to support Bitcoin Core privatebroadcast
• Improve handling of connected non-Jade ESP32 devices
• Improve the Trezor error message when the non-witness UTXO field is not provided
• Validate BIP129 headers on import and fix importing unencrypted BSMS files with a wallet already open
• Switch Electrum server notification detection to a streaming JSON token parse
• Release the Electrum transport read lock during socket reads to avoid client request starvation
• Discard stale Electrum responses with mismatched ids
• Increase read timeouts when Tor is configured
• Remove the Bisq broadcast source
• Add the Specter Signer 2026 firmware signing key for download verification
• Hide the wallet rescan hyperlink when nothing further can be scanned
• Use PSBTv0 for BIP322 PSBT QR and file exports
• Refactor the transaction diagram to dispatch on output wrapper types
• Improve the appearance of app notifications after the ControlsFX upgrade
• Load native libraries directly from the application image
• Upgrade JavaFX to v26 (with the headless platform)
• Upgrade jzbar to v0.4.0
• Upgrade usb4java to v1.3.6
• Bug fix: Finalize external inputs in cross-wallet PSBTs to avoid empty witnesses
• Bug fix: Only allow sending to payment codes where a notification transaction has previously been sent, even when already linked
• Bug fix: Fix concurrent modification of descriptor maps in cormorant
• Bug fix: Fix a regression to restore the Save PDF button on the descriptor QR display dialog

2.4.2

• Support for loading v3 transactions in the transaction editor
• Use CA validation or TOFU pinning for public servers depending on the certificate type
• Implement TOFU certificate pinning for TLS Bitcoin Core connections
• Bind Cormorant server to localhost only
• Escape backticks in the schema name for DROP SCHEMA statement
• Support QR and file methods for signing messages via PSBT when BIP-322 is selected
• Add tests for descriptor import and export, and handle multiline descriptors
• Improve reset instructions for Trezor passphrase change
• Upgrade SLF4J API and jul-to-slf4j to v2.0.17
• Upgrade JNA to v5.18.1
• Upgrade OpenPDF to v1.3.43
• Upgrade HikariCP to v7.0.2
• Upgrade JDBI to v3.51.0
• Upgrade Commons Lang3 to v3.20.0
• Upgrade Commons Compress to v1.28.0
• Upgrade Commons Codec to v1.21.0
• Upgrade Argon2 JVM to v2.12
• Upgrade RxJava 2 to v2.2.21
• Upgrade dnsjava to v3.6.4
• Upgrade Caffeine to v3.2.3
• Upgrade ZXing to v3.5.4
• Upgrade JCommander to v3.0
• Upgrade Thumbnailator to v0.4.21
• Upgrade JetBrains Annotations to v26.0.2
• Upgrade JUnit to v5.14.1
• Upgrade Kotlinx Coroutines JavaFX to v1.10.2
• Upgrade ControlsFX to v11.2.3
• Upgrade Bouncy Castle to v1.82
• Upgrade PGPainless to v1.7.7
• Upgrade Protobuf to v4.34.0
• Upgrade Gson to v2.13.2
• Upgrade Jackson Databind to v2.21.1
• Bug fix: Fix PSBTv2 and DST-related transaction editor issues around tx version and locktime
• Bug fix: Fix possible DB corruption on password removal by reordering database file and row updates
• Bug fix: Fix the non-default split menu button text color on the dark theme

2.4.1

• Suggest configuring a custom wallets directory when opening a wallet from a non-default location
• Handle import of a Samourai wallet backup file with extraneous appended data (@ottosch)
• Add KeepKey passphrase support (@BitHighlander)
• Bug fix: Avoid triggering repeated layout passes in address chunking skins
• Bug fix: Recognise renamed Linux packages for file verify drag and drop

2.4.0

• Add BIP375 PSBT fields and verify DLEQ proofs for hardware wallet support when sending to silent payments addresses
• Format display of addresses in 4 character chunks (disable via View > Bitcoin Addresses > Chunk Addresses)
• Add wallet discovery feature for connected devices with a configurable number of accounts to scan
• Use PSBTv2 as the default internal PSBT representation
• Add Codex32 (BIP93) importer to the software wallet keystore import options (@ikmckenz)
• Add Trezor Safe 7 support
• Add Keycard and Keycard Shell support (@bitgamma)
• Add Ledger Nano Gen5 support
• Use precise fee rates estimate from mempool.space
• Restore Coingecko access by adding a user agent to the exchange source request (@lnliz)
• Select the preferred QR encoding via a dropdown on the QR display dialog, and save the selection
• Add Raw to the QR encoding options for displaying transaction hex as raw bytes
• Add Frigate to the detected electrum server capabilities list
• Pass the existing keystore derivation if present to the connected device and card import panes
• Display a warning when entering SLIP132 extended keys into a watch-only wallet of a different script type
• Add any missing key path information to PSBTs once a signing wallet is chosen
• Add an additional fee rate limit check for high fee transactions
• Always show the Display Address button for watch-only wallets
• Add the block.xyz (Augur) fee estimator (@lnliz)
• Ensure plugdev is added as a system group on Linux if absent
• Delete the home folder on exit if empty
• Update to Java v25.0.2 and JavaFX v25.0.2
• Upgrade the internal Tor to v0.4.8.21
• Bug fix: Fix mnemonic words layout issue on 4k screens in Windows
• Bug fix: Fix handling of non-standard key derivations when writing output descriptors
• Bug fix: Fix Trezor change detection on signing for multisig wallets
• Bug fix: Respect the configured Bitcoin Unit on the transaction diagram

2.3.1

• Support hiding amounts via the View menu (@kwsantiago)
• Show the signing keystores in the transaction Blockchain form for spends from multisig wallets
• Update MJPG camera pixel format support on Linux
• Add YU12 camera pixel format support on Linux
• Add Ctrl+Shift+Left/Right keyboard shortcuts for moving tabs left and right
• Avoid using deprecated camera device type constants on recent macOS versions
• Bug fix: Include BIP32 derivations in PSBTs for consolidation outputs (regression)
• Bug fix: Update NSMenuFX to avoid occasional NPE on startup
• Bug fix: Don't show confirmations in a tooltip when showing inputs and outputs on the transactions table
• Bug fix: Use language-independent SID for Windows users group permission (@doblon8)
• Bug fix: Support non-standard derivation paths on Ledger devices by requesting display of the path when retrieving xpubs
• Bug fix: Fix occasional issue with cell reuse when avoiding updating cells during table size estimation

2.3.0

• Support sending to silent payment addresses, including those resolved through BIP353 HRNs
• Support sending to and displaying BIP353 human readable names and include DNSSEC proof in associated PSBTs
• Support creating transactions with the minimum relay fee rate set by the connected server or configured by the user (with minRelayFeeRate)
• Restore Coingecko historical rate support by limiting to the last 365 days
• Allow transaction diagram input and output labels to expand into available width
• Support zero in PIN keypad for Onekey Classic PIN entry
• Display a warning if an output descriptor provided in the wallet settings will be modified for use
• Display zero byte length witness elements as empty instead of as OP_0
• Compare on device unique id when choosing selected camera, and save this id to the config file
• Improve the error dialog on a Payjoin receiver error
• Add padding to JSON-RPC writes when connected over TLS
• Replace JNI-based ZBar wrapper with FFM-based jzbar (@doblon8)
• Upgrade to Gradle 9.1.0
• Bug fix: Handle NPE on connecting to Bitcoin Core with wallet functionality disabled
• Bug fix: Fix issue of including parent path elements in deterministic key when deriving child xpub from an output descriptor containing more than two child path elements
• Bug fix: Fix Jade configuration for signet and regtest networks
• Bug fix: Fix restart menu options on Linux standalone package
• Bug fix: Select first (instead of last) matching webcam
• Bug fix: Fix selection of nearest supported camera resolution where chosen resolution is not available
• Bug fix: Include child derivations in output descriptor for BIP 129 wallet export
• Bug fix: Do not change coin label unit on right click (@Radiokot)
• Bug fix: Fix BlueWallet spelling