Skip to content

chore: bump github.com/21-dot-dev/swift-secp256k1 from 0.17.0 to 0.23.2 in the swift group - #710

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/swift/swift-82f8efd203
Open

chore: bump github.com/21-dot-dev/swift-secp256k1 from 0.17.0 to 0.23.2 in the swift group#710
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/swift/swift-82f8efd203

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the swift group with 1 update: github.com/21-dot-dev/swift-secp256k1.

Updates github.com/21-dot-dev/swift-secp256k1 from 0.17.0 to 0.23.2

Release notes

Sourced from github.com/21-dot-dev/swift-secp256k1's releases.

0.23.2

Highlights

Other Changes

Dev-tooling Bumps

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.1...0.23.2

0.23.1

What's Changed

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.0...0.23.1

0.23.1-prerelease-3

What's Changed

Full Changelog: 21-DOT-DEV/swift-secp256k1@0.23.1-prerelease-2...0.23.1-prerelease-3

0.23.1-prerelease-2

What's Changed

... (truncated)

Changelog

Sourced from github.com/21-dot-dev/swift-secp256k1's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.23.2] - 2026-05-22

Added

  • WorkingWithKeys DocC article consolidating the previous KeyFormats, SerializingKeys, and TweakingKeys articles into a single key-handling guide covering compressed/uncompressed/x-only encoding, PEM/DER serialization, and additive/multiplicative tweak operations (#1128)
  • ECDSASigningAndBitcoinTransactions DocC article covering DER and compact encoding, low-S normalization, and a BIP-143 sighash recipe (#1128)
  • Taproot key-path spend example using SHA256.taggedHash(tag: "TapSighash", ...) and BIP-341 reference in the Schnorr documentation (#1128)
  • SharedSourcesPlugin trust note in the README installation section (#1106)

Changed

  • Moved CocoaPods, Arena, and Xcode plugin-trust instructions out of README.md into the Getting Started article; trimmed the README install section to a minimal SPM snippet and a link to the full guide (#1128)
  • Tightened DocC terminology across the catalog (e.g., "public key" → "verifying key" where used for verification; "envelope" → "wrapper"/"form" for ASN.1 structures; "party" → "co-signer" in MuSig2 contexts) and replaced plain-text BIP/RFC/paper references with inline markdown links (#1126)
  • Updated Docker base image from Swift 6.3.1 to 6.3.2 (#1119)
  • Dropped the scheduled trigger from check-subtree-updates.yml; subtree updates now run only on manual dispatch or push (#1116)

[0.23.1] - 2026-04-29

Added

  • DocC catalog articles: KeyFormats, MuSig2MultiSignatures, RecoveringPublicKeys, and SecurityConsiderations covering key representations, BIP-327 multi-signatures, ECDSA public-key recovery, and context randomization / nonce reuse / constant-time guidance (#1079)
  • EllipticCurveDiffieHellman and SilentPayments DocC articles with cross-linked examples; DocC links added throughout the README usage snippets (#1103)
  • ChoosingP256KvsZKP article and expanded ZKP landing page in the ZKP DocC catalog (#1096)
  • docc-release.yml workflow to build and upload DocC archives on tagged releases (#1096)
  • DocC validation job in apple-builds.yml (generate-documentation --warnings-as-errors) (#1096)
  • Expanded /// doc comments across Sources/Shared/ with upstream citations to libsecp256k1/secp256k1-zkp headers and BIPs 32/137/146/322/324/327/340/341/352, plus Topics sections on major types (#1096)

Changed

  • Package.swift now excludes development-only dependencies (SwiftFormat, SwiftLint, Tuist, Lefthook, swift-plugin-subtree, swift-docc-plugin) at tagged releases via Context.gitInformation?.currentTag, so consumers resolving a tagged version no longer download dev tooling (#1082)
  • Hardened workflow env usage in xcframework-release.yml and update-subtree.yml by moving ${{ github.ref_name }} / ${{ inputs.subtree_name }} into step-level env blocks (#1082)
  • Refreshed all six AGENTS.md files to focus on non-inferable content (commands, gotchas, boundaries) (#1082)
  • Adopted org-level community health defaults: project now relies on 21-DOT-DEV/.github for CODE_OF_CONDUCT.md and CONTRIBUTING.md; project-specific contributor onboarding moved to AGENTS.md (#1088)
  • Bumped SECURITY.md Supported Versions from 0.22.x to 0.23.x (#1088)
  • Updated vendored swift-crypto from 4.3.0 to 4.5.0 (#1072, #1086, #1094)
  • Updated vendored secp256k1-zkp to latest upstream (#1069)
  • Updated Docker base image from Swift 6.3.0 to 6.3.1 (#1090)
  • Updated swift-docc-plugin dev dependency from 1.4.6 to 1.5.0 (#1098)
  • Updated actions/upload-artifact from 4 to 7 and actions/download-artifact from 4 to 8 in benchmark workflows (#1066, #1067)

Fixed

... (truncated)

Commits
  • e70a10e docs: release version 0.23.2 with consolidated key-handling guide and termino...
  • 1914e20 docs: consolidate key-handling articles into unified WorkingWithKeys guide (#...
  • 64d58b9 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.3 to 4....
  • 81601da docs: clarify terminology and tighten phrasing across DocC catalog (#1126)
  • 1a8955f build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.2 to 4....
  • 0aa1d74 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.195.1 to 4....
  • 7f0f85f build(deps): Bump github.com/csjones/lefthook-plugin from 2.1.6 to 2.1.8 (#1123)
  • 29634a6 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.194.3 to 4....
  • 0cf4a80 build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.194.1 to 4....
  • 895983e build(deps): Bump github.com/21-dot-dev/swift-plugin-tuist from 4.193.4 to 4....
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump github.com/21-dot-dev/swift-secp256k1 in the swift group
f91382e 
Bumps the swift group with 1 update: [github.com/21-dot-dev/swift-secp256k1](https://github.com/21-DOT-DEV/swift-secp256k1).


Updates `github.com/21-dot-dev/swift-secp256k1` from 0.17.0 to 0.23.2
- [Release notes](https://github.com/21-DOT-DEV/swift-secp256k1/releases)
- [Changelog](https://github.com/21-DOT-DEV/swift-secp256k1/blob/main/CHANGELOG.md)
- [Commits](21-DOT-DEV/swift-secp256k1@0.17.0...e70a10e)

---
updated-dependencies:
- dependency-name: github.com/21-dot-dev/swift-secp256k1
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: swift
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependencies related swift_package_manager Pull requests that update swift_package_manager code labels Sep 1, 2026
@greptile-apps

greptile-apps Bot commented Sep 1, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

jvsena42
jvsena42 reviewed Sep 4, 2026
View reviewed changes

@jvsena42 jvsena42 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not build. Every build and test job on f91382e fails with Missing package product 'secp256k1' (exit 65) — the bump crosses 0.20.0, which renamed the module.

I verified the remediation against the upstream package: 0.23.2 exports only libsecp256k1, libsecp256k1_zkp, P256K and ZKP, no longer re-exports the C bindings, and P256K.KeyAgreement.PrivateKey / sharedSecretFromKeyAgreement(with:format:) both still exist, so no semantic change to the APIs Bitkit uses. It needs source changes dependabot cannot make.

Recommend closing this and bumping by hand. Since this is the crypto library behind recoverable-ECDSA backup auth and ECDH push decryption, re-run WatchOnlyAccountServiceTests and check a real push decrypt on device before shipping; Bitkit/Utilities/Keychain.swift also references secp and should be checked while you are in there.

Comment thread Bitkit.xcodeproj/project.pbxproj
requirement = {
kind = exactVersion;
version = 0.17.0;
version = 0.23.2;

@jvsena42 jvsena42 Sep 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 0.17.0 -> 0.23.2 crosses the 0.20.0 module rename; the app no longer builds

CI fails with Missing package product 'secp256k1' in Bitkit, BitkitTests and BitkitNotification. 0.20.0 renamed secp256k1 -> P256K and secp256k1_bindings -> libsecp256k1, and 0.23.2 no longer re-exports the C bindings. Needed alongside this bump: import P256K (+ P256K.KeyAgreement.*) in Crypto.swift and WatchOnlyAccountService.swift, import libsecp256k1 for the raw secp256k1_* calls in Crypto.swift, and the pbxproj product refs switched to P256K and libsecp256k1 for all three targets. Do this as a manual bump, not a dependabot merge, and re-run WatchOnlyAccountServiceTests plus a push-notification decrypt before shipping.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jvsena42 jvsena42 jvsena42 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependencies related swift_package_manager Pull requests that update swift_package_manager code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jvsena42