wallet-cli-4.9.9

Notice

Recommended upgrade

Bug Fixes

Change

1. Harden fastjson deserialization by enabling safe mode globally at CLI startup. fastjson 1.x honors the @type hint in JSON.parseObject/parseArray even when the declared target is a JSONObject, which is the entry point for autoType gadget chains. wallet-cli feeds remote HTTP and WebSocket payloads (GasFree, multi-sign) into those calls and never relies on @type itself, so safe mode now rejects the hint outright and removes the remote-code-execution surface. Regression tests cover both the global parser configuration and transaction JSON parsing. (#955)

Integrity Check

All jar files available in this release are signed via this GPG key:

• PUB: 1254 F859 D2B1 BD9F 66E7 107D F859 BCB4 4A28 290B
• UID: build@tron.network

From the download listings below you should see links to the downloadable jar files as well as sig signature files. To verify the authenticity of any jar file, grab the jar and sig files with the same prefix name and then execute the verification process: GPG signature verification