Sparrow Wallet 2.5.6 adds signature verification for unconfirmed transactions and block checks during reorganizations

In release 2.5.6, Sparrow verifies the signatures of its own inputs before adding an unconfirmed transaction to the wallet history — the fix was ported from Electrum following its security advisory (the release is linked in the post). Other additions include: verifying recipient input signatures in payjoin before checking the proposal fee, comparing saved block hashes with the header store on the wallet's first load and re-querying the script hash during a reorganization, marking a confirmation as unverified if its block has been replaced, rejecting output descriptors without extended public keys (including addr()), checking the claimed number of cosigners when importing Electrum multisig wallets, extending the wallet lock to label imports, sweep, message signing and password requests, deleting a backup only after saving a password change, and additional checks for Satscard, Tapsigner and Satschip operations. Separately, the bundled Tor has been updated to meet network requirements, and eMudhra root certificates have been removed from the bundled Java trust store.