Merge pull request #7035 from str4d/fix-wtx-is-from-me-orchard

wallet: Check spent Orchard notes in `CWallet{Tx}::IsFromMe`
2025-06-13 17:23:30 +01:00 · 2025-06-13 15:10:45 +01:00 · 2025-06-13 15:03:12 +01:00 · 2025-05-20 16:31:44 +01:00 · 2025-05-20 10:40:28 +01:00 · 2025-05-19 13:21:37 +01:00
20 changed files with 729 additions and 363 deletions
--- a/.github/workflows/ci-skip.yml
+++ b/.github/workflows/ci-skip.yml
@ -45,9 +45,9 @@ jobs:
          fetch-depth: 0

      - name: Fetch the commits for the PR branch
-        run: git fetch $HEAD_REPO $HEAD_SHA
+        run: git fetch "${HEAD_REPO}" "${HEAD_SHA}"
        env:
-          HEAD_REPO: ${{ github.event.pull_request.head.repo }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.clone_url }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

      - name: Check whether the changes are only to the set of filtered paths
@ -74,7 +74,11 @@ jobs:
          ]
          paths_regex = '(?:%s)' % '|'.join(paths)

-          changed_files = shlex.split(os.environ["CHANGED_FILES"])
+          lex = shlex.shlex(posix = True)
+          lex.whitespace = '\n\r'
+          lex.whitespace_split = True
+          lex.commenters = ''
+          changed_files = list(lex)
          if len(changed_files) == 0:
              sys.exit(1)

@ -85,9 +89,8 @@ jobs:

          print('result=verified' if verified else 'result=skipped')
          EOF
-          CHANGED_FILES=$(git diff --name-only ${{ github.sha }}...$HEAD_SHA --)
-          echo $CHANGED_FILES
-          CHANGED_FILES=$CHANGED_FILES python3 ./subclass.py >> $GITHUB_OUTPUT
+
+          git diff --name-only ${{ github.sha }}...$HEAD_SHA -- | python3 ./subclass.py >> $GITHUB_OUTPUT
        env:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

--- a/Cargo.lock
+++ b/Cargo.lock
@ -151,9 +151,9 @@ dependencies = [

 [[package]]
 name = "bip0039"
-version = "0.10.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef0f0152ec5cf17f49a5866afaa3439816207fd4f0a224c0211ffaf5e278426"
+checksum = "568b6890865156d9043af490d4c4081c385dd68ea10acd6ca15733d511e6b51c"
 dependencies = [
 "hmac",
 "pbkdf2",
@ -325,9 +325,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "cfg_aliases"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

 [[package]]
 name = "chacha20"
@ -392,23 +392,24 @@ checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"

 [[package]]
 name = "clearscreen"
-version = "3.0.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f8c93eb5f77c9050c7750e14f13ef1033a40a0aac70c6371535b6763a01438c"
+checksum = "8c41dc435a7b98e4608224bbf65282309f5403719df9113621b30f8b6f74e2f4"
 dependencies = [
 "nix",
 "terminfo",
- "thiserror",
+ "thiserror 2.0.12",
 "which",
- "winapi",
+ "windows-sys 0.59.0",
 ]

 [[package]]
 name = "codespan-reporting"
-version = "0.11.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+checksum = "fe6d2e5af09e8c8ad56c969f2157a3d4238cebc7c55f0a517728c38f7b200f81"
 dependencies = [
+ "serde",
 "termcolor",
 "unicode-width",
 ]
@ -522,9 +523,9 @@ dependencies = [

 [[package]]
 name = "cxx"
-version = "1.0.136"
+version = "1.0.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad7c7515609502d316ab9a24f67dc045132d93bfd3f00713389e90d9898bf30d"
+checksum = "a71ea7f29c73f7ffa64c50b83c9fe4d3a6d4be89a86b009eb80d5a6d3429d741"
 dependencies = [
 "cc",
 "cxxbridge-cmd",
@ -536,9 +537,9 @@ dependencies = [

 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.136"
+version = "1.0.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c33fd49f5d956a1b7ee5f7a9768d58580c6752838d92e39d0d56439efdedc35"
+checksum = "4f44296c8693e9ea226a48f6a122727f77aa9e9e338380cb021accaeeb7ee279"
 dependencies = [
 "clap",
 "codespan-reporting",
@ -549,15 +550,15 @@ dependencies = [

 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.136"
+version = "1.0.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be0f1077278fac36299cce8446effd19fe93a95eedb10d39265f3bf67b3036c9"
+checksum = "c42f69c181c176981ae44ba9876e2ea41ce8e574c296b38d06925ce9214fb8e4"

 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.136"
+version = "1.0.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da7e4d6e74af6b79031d264b2f13c3ea70af1978083741c41ffce9308f1f24f"
+checksum = "8faff5d4467e0709448187df29ccbf3b0982cc426ee444a193f87b11afb565a8"
 dependencies = [
 "proc-macro2",
 "quote",
@ -595,26 +596,6 @@ dependencies = [
 "subtle",
 ]

-[[package]]
-name = "dirs"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
 [[package]]
 name = "document-features"
 version = "0.2.10"
@ -657,6 +638,12 @@ version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"

+[[package]]
+name = "env_home"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
+
 [[package]]
 name = "equihash"
 version = "0.2.0"
@ -669,12 +656,12 @@ dependencies = [

 [[package]]
 name = "errno"
-version = "0.3.9"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@ -804,6 +791,18 @@ dependencies = [
 "wasi",
 ]

+[[package]]
+name = "getset"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3586f256131df87204eb733da72e3d3eb4f343c639f4b7be279ac7c48baeafe"
+dependencies = [
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.94",
+]
+
 [[package]]
 name = "gimli"
 version = "0.31.0"
@ -1104,9 +1103,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.159"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"

 [[package]]
 name = "libm"
@ -1114,16 +1113,6 @@ version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"

-[[package]]
-name = "libredox"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
-dependencies = [
- "bitflags 2.6.0",
- "libc",
-]
-
 [[package]]
 name = "librustzcash"
 version = "0.2.0"
@ -1149,6 +1138,7 @@ dependencies = [
 "ipnet",
 "jubjub",
 "libc",
+ "macro_find_and_replace",
 "memuse",
 "metrics",
 "metrics-exporter-prometheus",
@ -1164,7 +1154,7 @@ dependencies = [
 "secp256k1",
 "secrecy",
 "subtle",
- "thiserror",
+ "thiserror 2.0.12",
 "time",
 "tokio",
 "tracing",
@ -1179,6 +1169,7 @@ dependencies = [
 "zcash_primitives",
 "zcash_proofs",
 "zcash_protocol",
+ "zcash_transparent",
 "zeroize",
 ]

@ -1197,6 +1188,12 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"

+[[package]]
+name = "linux-raw-sys"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+
 [[package]]
 name = "litrs"
 version = "0.4.1"
@ -1218,6 +1215,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "macro_find_and_replace"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c5eef824b07f20e21212f95520a9b29007258680db871e2a146d7accc0dca6"
+
 [[package]]
 name = "matchers"
 version = "0.1.0"
@ -1248,9 +1251,6 @@ name = "memuse"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d97bbf43eb4f088f8ca469930cde17fa036207c9a5e02ccc5107c4e8b17c964"
-dependencies = [
- "nonempty",
-]

 [[package]]
 name = "metrics"
@ -1276,7 +1276,7 @@ dependencies = [
 "metrics",
 "metrics-util",
 "quanta",
- "thiserror",
+ "thiserror 1.0.64",
 "tokio",
 "tracing",
 ]
@ -1337,9 +1337,9 @@ dependencies = [

 [[package]]
 name = "nix"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
 "bitflags 2.6.0",
 "cfg-if",
@ -1440,17 +1440,20 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"

 [[package]]
 name = "orchard"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f18e997fa121de5c73e95cdc7e8512ae43b7de38904aeea5e5713cc48f3c0ba"
+checksum = "f2f4cf75baf85bbd6f15eb919b7e70afdc4a311eef0a3e8a053e65542fe2b58e"
 dependencies = [
 "aes",
 "bitvec",
 "blake2b_simd",
+ "core2",
 "ff",
 "fpe",
+ "getset",
 "group",
 "halo2_gadgets",
+ "halo2_poseidon",
 "halo2_proofs",
 "hex",
 "incrementalmerkletree",
@ -1462,6 +1465,7 @@ dependencies = [
 "rand",
 "reddsa",
 "serde",
+ "sinsemilla",
 "subtle",
 "tracing",
 "visibility",
@ -1487,9 +1491,9 @@ dependencies = [

 [[package]]
 name = "password-hash"
-version = "0.3.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d791538a6dcc1e7cb7fe6f6b58aca40e7f79403c45b2bc274008b5e647af1d8"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
 "base64ct",
 "rand_core",
@ -1513,9 +1517,9 @@ dependencies = [

 [[package]]
 name = "pbkdf2"
-version = "0.10.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271779f35b581956db91a3e55737327a03aa051e90b1c47aeb189508533adfd7"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
 "digest",
 "password-hash",
@ -1623,6 +1627,28 @@ dependencies = [
 "uint",
 ]

+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.94",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.92"
@ -1771,7 +1797,7 @@ dependencies = [
 "pasta_curves",
 "rand_core",
 "serde",
- "thiserror",
+ "thiserror 1.0.64",
 "zeroize",
 ]

@ -1784,21 +1810,10 @@ dependencies = [
 "rand_core",
 "reddsa",
 "serde",
- "thiserror",
+ "thiserror 1.0.64",
 "zeroize",
 ]

-[[package]]
-name = "redox_users"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
-dependencies = [
- "getrandom",
- "libredox",
- "thiserror",
-]
-
 [[package]]
 name = "regex"
 version = "1.10.6"
@ -1876,10 +1891,23 @@ dependencies = [
 "bitflags 2.6.0",
 "errno",
 "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.14",
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "rustix"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.4",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.19"
@ -1900,9 +1928,9 @@ dependencies = [

 [[package]]
 name = "sapling-crypto"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfff8cfce16aeb38da50b8e2ed33c9018f30552beff2210c266662a021b17f38"
+checksum = "85c2acdbbab83d554fc2dceea5f7d6d3da71e57adb18a6c80b8901bd0eee54b0"
 dependencies = [
 "aes",
 "bellman",
@ -1914,6 +1942,7 @@ dependencies = [
 "document-features",
 "ff",
 "fpe",
+ "getset",
 "group",
 "hex",
 "incrementalmerkletree",
@ -2082,9 +2111,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "subtle"
-version = "2.4.1"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
@ -2123,7 +2152,7 @@ dependencies = [
 "cfg-if",
 "fastrand",
 "once_cell",
- "rustix",
+ "rustix 0.38.37",
 "windows-sys 0.59.0",
 ]

@ -2138,11 +2167,10 @@ dependencies = [

 [[package]]
 name = "terminfo"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666cd3a6681775d22b200409aad3b089c5b99fb11ecdd8a204d9d62f8148498f"
+checksum = "d4ea810f0692f9f51b382fff5893887bb4580f5fa246fde546e0b13e7fcee662"
 dependencies = [
- "dirs",
 "fnv",
 "nom",
 "phf",
@ -2155,7 +2183,16 @@ version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.64",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+dependencies = [
+ "thiserror-impl 2.0.12",
 ]

 [[package]]
@ -2169,6 +2206,17 @@ dependencies = [
 "syn 2.0.94",
 ]

+[[package]]
+name = "thiserror-impl"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.94",
+]
+
 [[package]]
 name = "thread_local"
 version = "1.1.8"
@ -2263,7 +2311,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3566e8ce28cc0a3fe42519fc80e6b4c943cc4c8cef275620eb8dac2d3d4e06cf"
 dependencies = [
 "crossbeam-channel",
- "thiserror",
+ "thiserror 1.0.64",
 "time",
 "tracing-subscriber",
 ]
@ -2531,13 +2579,13 @@ dependencies = [

 [[package]]
 name = "which"
-version = "6.0.3"
+version = "7.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
+checksum = "24d643ce3fd3e5b54854602a080f34fb10ab75e0b813ee32d00ca2b44fa74762"
 dependencies = [
 "either",
- "home",
- "rustix",
+ "env_home",
+ "rustix 1.0.7",
 "winsafe",
 ]

@ -2725,9 +2773,9 @@ dependencies = [

 [[package]]
 name = "zcash_primitives"
-version = "0.19.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab47d526d7fd6f88b3a2854ad81b54757a80c2aeadd1d8b06f690556af9743c"
+checksum = "9b45f3ca3a9df34fcdbf036c2c814417bb417bde742812abc09d744bb3d7ed72"
 dependencies = [
 "aes",
 "bip32",
@ -2738,6 +2786,7 @@ dependencies = [
 "equihash",
 "ff",
 "fpe",
+ "getset",
 "group",
 "hex",
 "incrementalmerkletree",
@ -2760,14 +2809,15 @@ dependencies = [
 "zcash_note_encryption",
 "zcash_protocol",
 "zcash_spec",
+ "zcash_transparent",
 "zip32",
 ]

 [[package]]
 name = "zcash_proofs"
-version = "0.19.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daba607872e60d91a09248d8e1ea3d6801c819fb80d67016d9de02d81323c10d"
+checksum = "d5826910c516675eca1f34b3557e159f4e35a4a1711b39fa4f01fb0adb9a9c24"
 dependencies = [
 "bellman",
 "blake2b_simd",
@ -2810,6 +2860,31 @@ dependencies = [
 "blake2b_simd",
 ]

+[[package]]
+name = "zcash_transparent"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed0512e8e02af804e852fbbc4bd5db35a9037bc253d2ce396506293a6e7dd745"
+dependencies = [
+ "bip32",
+ "blake2b_simd",
+ "bs58",
+ "core2",
+ "document-features",
+ "getset",
+ "hex",
+ "proptest",
+ "ripemd",
+ "secp256k1",
+ "sha2",
+ "subtle",
+ "zcash_address",
+ "zcash_encoding",
+ "zcash_protocol",
+ "zcash_spec",
+ "zip32",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.35"
--- a/Cargo.toml
+++ b/Cargo.toml
@ -35,7 +35,7 @@ path = "src/rust/bin/wallet_tool.rs"

 [dependencies]
 bellman = "0.14"
-bip0039 = { version = "0.10.1", features = ["std", "all-languages"] }
+bip0039 = { version = "0.12", features = ["std", "all-languages"] }
 blake2b_simd = "1"
 blake2s_simd = "1"
 bls12_381 = "0.8"
@ -51,7 +51,7 @@ jubjub = "0.10"
 memuse = "0.2"
 nonempty = "0.7"
 orchard = "0.10"
-sapling = { package = "sapling-crypto", version = "0.3", features = ["temporary-zcashd"] }
+sapling = { package = "sapling-crypto", version = "0.4", features = ["temporary-zcashd"] }
 secp256k1 = "0.27"
 subtle = "2.2"
 rand_core = "0.6"
@ -59,12 +59,13 @@ redjubjub = "0.7"
 tracing = "0.1"
 tracing-core = "0.1"
 tracing-appender = "0.2"
+transparent = { package = "zcash_transparent", version = "0.1" }
 zcash_address = "0.6"
 zcash_encoding = "0.2.1"
 zcash_history = "0.4"
 zcash_note_encryption = "0.4"
-zcash_primitives = { version = "0.19", features = ["temporary-zcashd", "transparent-inputs"] }
-zcash_proofs = { version = "0.19", features = ["directories"] }
+zcash_primitives = { version = "0.21", features = ["temporary-zcashd", "transparent-inputs"] }
+zcash_proofs = { version = "0.21", features = ["directories"] }
 zcash_protocol = { version = "0.4", features = ["local-consensus"] }
 ed25519-zebra = "4"
 zeroize = "1.4.2"
@ -72,7 +73,7 @@ wagyu-zcash-parameters = "0.2"

 # Rust/C++ interop
 # The version needs to match depends/packages/native_cxxbridge.mk
-cxx = { version = "=1.0.136", features = ["c++17"] }
+cxx = { version = "=1.0.158", features = ["c++17"] }

 # Rust threading
 rayon = "1.5"
@ -91,16 +92,19 @@ gumdrop = "0.8"
 # (also depends on tracing, and tracing-subscriber with "env-filter" and "fmt" features)
 anyhow = "1.0"
 backtrace = "0.3"
-clearscreen = "3"
+clearscreen = "4"
 rand = "0.8"
 secrecy = "0.8"
-thiserror = "1"
+thiserror = "2"
 time = { version = "0.3", features = ["formatting", "macros"] }

+# Macros
+macro_find_and_replace = "1"
+
 [dev-dependencies]
 incrementalmerkletree = { version = "0.7", features = ["test-dependencies"] }
 proptest = "1.0.0"
-zcash_primitives = { version = "0.19", features = ["temporary-zcashd", "transparent-inputs", "test-dependencies"] }
+zcash_primitives = { version = "0.21", features = ["temporary-zcashd", "transparent-inputs", "test-dependencies"] }

 [dependencies.tracing-subscriber]
 version = "0.3"
--- a/depends/packages/native_cxxbridge.mk
+++ b/depends/packages/native_cxxbridge.mk
@ -1,14 +1,14 @@
 package=native_cxxbridge
 # The version needs to match cxx in Cargo.toml
-$(package)_version=1.0.136
+$(package)_version=1.0.158
 $(package)_download_path=https://github.com/dtolnay/cxx/archive/refs/tags
 $(package)_file_name=native_cxxbridge-$($(package)_version).tar.gz
 $(package)_download_file=$($(package)_version).tar.gz
-$(package)_sha256_hash=a77e43f1e4f5bb6aba2e9a77ac928e63799d237cde6fe1aa2c26d3cc57c8ae74
+$(package)_sha256_hash=58a3c7b28033caeeb8a5e1f74c5124d63b1bfc8a67a5740c475c6d12d1bc7f4b
 $(package)_build_subdir=gen/cmd
 $(package)_dependencies=native_rust
 # This file is somewhat annoying to update, but can be done like so from the repo base:
-# $ export VERSION=1.0.136
+# $ export VERSION=1.0.158
 # $ rm .cargo/config.toml .cargo/.configured-for-offline
 # $ mkdir tmp
 # $ cd tmp
--- a/depends/patches/native_cxxbridge/Cargo.lock
+++ b/depends/patches/native_cxxbridge/Cargo.lock
@ -15,10 +15,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"

 [[package]]
-name = "cc"
-version = "1.2.6"
+name = "bitflags"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d6dbb628b8f8555f86d0323c2eb39e3ec81901f4b83e091db8a6a76d316a333"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+
+[[package]]
+name = "cc"
+version = "1.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
 dependencies = [
 "jobserver",
 "libc",
@ -33,9 +39,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "clang-ast"
-version = "0.1.27"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c01fb720699b43fbf9db04dbb8d2b5d037f38938e6b8153863db7532b24a86c"
+checksum = "0f215fa69fa4265fc39aef0b1a1e724e62392da3dcc8c08f892dd323107e9a8d"
 dependencies = [
 "foldhash",
 "serde",
@ -43,18 +49,18 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.23"
+version = "4.5.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
+checksum = "eccb054f56cbd38340b380d4a8e69ef1f02f1af43db2f0cc817a4774d80ae071"
 dependencies = [
 "clap_builder",
 ]

 [[package]]
 name = "clap_builder"
-version = "4.5.23"
+version = "4.5.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
+checksum = "efd9466fac8543255d3b1fcad4762c5e116ffe808c8a3043d4263cd4fd4862a2"
 dependencies = [
 "anstyle",
 "clap_lex",
@ -69,10 +75,11 @@ checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"

 [[package]]
 name = "codespan-reporting"
-version = "0.11.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+checksum = "fe6d2e5af09e8c8ad56c969f2157a3d4238cebc7c55f0a517728c38f7b200f81"
 dependencies = [
+ "serde",
 "termcolor",
 "unicode-width",
 ]
@ -88,7 +95,7 @@ dependencies = [

 [[package]]
 name = "cxx"
-version = "1.0.136"
+version = "1.0.158"
 dependencies = [
 "cc",
 "cxx-build",
@ -105,7 +112,7 @@ dependencies = [

 [[package]]
 name = "cxx-build"
-version = "1.0.136"
+version = "1.0.158"
 dependencies = [
 "cc",
 "codespan-reporting",
@ -120,7 +127,7 @@ dependencies = [

 [[package]]
 name = "cxx-gen"
-version = "0.7.136"
+version = "0.7.158"
 dependencies = [
 "codespan-reporting",
 "proc-macro2",
@ -139,7 +146,7 @@ dependencies = [

 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.136"
+version = "1.0.158"
 dependencies = [
 "clap",
 "codespan-reporting",
@ -150,11 +157,11 @@ dependencies = [

 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.136"
+version = "1.0.158"

 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.136"
+version = "1.0.158"
 dependencies = [
 "clang-ast",
 "cxx",
@ -179,21 +186,21 @@ dependencies = [

 [[package]]
 name = "dissimilar"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59f8e79d1fbf76bdfbde321e902714bf6c49df88a7dda6fc682fc2979226962d"
+checksum = "8975ffdaa0ef3661bfe02dbdcc06c9f829dfafe6a3c474de366a8d5e44276921"

 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"

 [[package]]
 name = "flate2"
-version = "1.0.35"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
+checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
@ -201,9 +208,21 @@ dependencies = [

 [[package]]
 name = "foldhash"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "getrandom"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi",
+]

 [[package]]
 name = "glob"
@ -213,15 +232,15 @@ checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"

 [[package]]
 name = "hashbrown"
-version = "0.15.2"
+version = "0.15.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"

 [[package]]
 name = "indexmap"
-version = "2.7.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
+checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
 dependencies = [
 "equivalent",
 "hashbrown",
@ -229,30 +248,31 @@ dependencies = [

 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"

 [[package]]
 name = "jobserver"
-version = "0.1.32"
+version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
+ "getrandom",
 "libc",
 ]

 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"

 [[package]]
 name = "link-cplusplus"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d240c6f7e1ba3a28b0249f774e6a9dd0175054b52dfbb61b16eb8505c3785c9"
+checksum = "4a6f6da007f968f9def0d65a05b187e2960183de70c160204ecfccf0ee330212"
 dependencies = [
 "cc",
 ]
@ -275,69 +295,75 @@ dependencies = [

 [[package]]
 name = "miniz_oxide"
-version = "0.8.2"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ffbe83022cedc1d264172192511ae958937694cd57ce297164951b8b3568394"
+checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
 dependencies = [
 "adler2",
 ]

 [[package]]
 name = "pkg-config"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"

 [[package]]
 name = "proc-macro2"
-version = "1.0.92"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
 "proc-macro2",
 ]

 [[package]]
-name = "rustversion"
-version = "1.0.19"
+name = "r-efi"
+version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
+[[package]]
+name = "rustversion"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"

 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"

 [[package]]
 name = "scratch"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3cf7c11c38cb994f3d40e8a8cde3bbd1f72a435e4c49e85d6553d8312306152"
+checksum = "9f6280af86e5f559536da57a45ebc84948833b3bee313a7dd25232e09c878a52"

 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
 "proc-macro2",
 "quote",
@ -346,9 +372,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.134"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d00f4175c42ee48b15416f6193a959ba3a0d67fc699a0db9ad12df9f83991c7d"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
 "itoa",
 "memchr",
@ -379,9 +405,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "syn"
-version = "2.0.94"
+version = "2.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "987bc0be1cdea8b10216bd06e2ca407d40b9543468fafd3ddfb02f36e77f71f3"
+checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
 dependencies = [
 "proc-macro2",
 "quote",
@ -390,9 +416,9 @@ dependencies = [

 [[package]]
 name = "target-triple"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42a4d50cdb458045afc8131fd91b64904da29548bcb63c7236e0844936c13078"
+checksum = "1ac9aa371f599d22256307c24a9d748c041e548cbf599f35d890f9d365361790"

 [[package]]
 name = "termcolor"
@ -405,9 +431,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.8.19"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+checksum = "05ae329d1f08c4d17a59bed7ff5b5a769d062e64a62d34a3261b219e62cd5aae"
 dependencies = [
 "serde",
 "serde_spanned",
@ -417,31 +443,38 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "0.6.8"
+version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+checksum = "3da5db5a963e24bc68be8b17b6fa82814bb22ee8660f192bb182771d498f09a3"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "toml_edit"
-version = "0.22.22"
+version = "0.22.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
+checksum = "310068873db2c5b3e7659d2cc35d21855dbafa50d1ce336397c666e3cb08137e"
 dependencies = [
 "indexmap",
 "serde",
 "serde_spanned",
 "toml_datetime",
+ "toml_write",
 "winnow",
 ]

 [[package]]
-name = "trybuild"
-version = "1.0.101"
+name = "toml_write"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dcd332a5496c026f1e14b7f3d2b7bd98e509660c04239c58b0ba38a12daded4"
+checksum = "bfb942dfe1d8e29a7ee7fcbde5bd2b9a25fb89aa70caea2eba3bee836ff41076"
+
+[[package]]
+name = "trybuild"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ae08be68c056db96f0e6c6dd820727cca756ced9e1f4cc7fdd20e2a55e23898"
 dependencies = [
 "dissimilar",
 "glob",
@ -455,15 +488,24 @@ dependencies = [

 [[package]]
 name = "unicode-ident"
-version = "1.0.14"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"

 [[package]]
 name = "unicode-width"
-version = "0.1.14"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+
+[[package]]
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+dependencies = [
+ "wit-bindgen-rt",
+]

 [[package]]
 name = "winapi"
@ -571,9 +613,18 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

 [[package]]
 name = "winnow"
-version = "0.6.21"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6f5bb5257f2407a5425c6e749bfd9692192a73e70a6060516ac04f889087d68"
+checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
 dependencies = [
 "memchr",
 ]
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags",
+]
--- a/doc/release-notes.md
+++ b/doc/release-notes.md
@ -4,3 +4,18 @@ release-notes at release time)
 Notable changes
 ===============

+Fixed Orchard bug in transparent balance APIs
+---------------------------------------------
+
+Several RPC methods inherited from Bitcoin Core internally rely on
+`CWalletTx::IsFromMe` for detecting involvement of the wallet in the input
+side of a transaction. For example:
+- The `getbalance` RPC method uses it as part of identifying "trusted"
+  zero-confirmation transactions to include in the balance calculation.
+- The `gettransaction` RPC method uses it to decide whether to include a
+  `fee` field in its response.
+
+When Orchard was integrated into `zcashd`, this method was not updated to
+account for it, meaning that unshielding transactions spending Orchard notes
+would not be correctly accounted for in transparent-specific RPC methods. A
+similar bug involving Sprout and Sapling spends was fixed in v4.5.1.
--- a/qa/rpc-tests/wallet_isfromme.py
+++ b/qa/rpc-tests/wallet_isfromme.py
@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# Copyright (c) 2021-2024 The Zcash developers
+# Copyright (c) 2021-2025 The Zcash developers
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or https://www.opensource.org/licenses/mit-license.php .

@ -8,6 +8,7 @@ from test_framework.util import (
    BLOSSOM_BRANCH_ID,
    CANOPY_BRANCH_ID,
    HEARTWOOD_BRANCH_ID,
+    NU5_BRANCH_ID,
    OVERWINTER_BRANCH_ID,
    SAPLING_BRANCH_ID,
    assert_equal,
@ -32,6 +33,7 @@ class WalletIsFromMe(BitcoinTestFramework):
            nuparams(BLOSSOM_BRANCH_ID, 1),
            nuparams(HEARTWOOD_BRANCH_ID, 1),
            nuparams(CANOPY_BRANCH_ID, 1),
+            nuparams(NU5_BRANCH_ID, 110),
            '-allowdeprecated=getnewaddress',
            '-allowdeprecated=z_getnewaddress',
        ]])
@ -85,5 +87,51 @@ class WalletIsFromMe(BitcoinTestFramework):
        # "getbalance '' 0" should count both outputs. The bug failed here.
        assert_equal(Decimal(node.getbalance('', 0)), Decimal('12.5') - coinbase_fee - fee)

+        # Mine the transaction; we get another coinbase output.
+        node.generate(8)
+        self.sync_all()
+        assert_equal(Decimal(node.getbalance('', 0)), Decimal('62.5') - coinbase_fee - fee)
+
+        # Send all available funds to an Orchard UA.
+        acct = node.z_getnewaccount()['account']
+        orchard_ua = node.z_getaddressforaccount(acct, ['orchard'])['address']
+        recipients = [{'address': orchard_ua, 'amount': Decimal('6.25') - coinbase_fee - 2*fee}]
+        # minconf = 1 is requires for `TransactionEffects::ApproveAndBuild`
+        # to use an Orchard anchor.
+        opid = node.z_sendmany(taddr, recipients, 1, fee, 'AllowRevealedSenders')
+        wait_and_assert_operationid_status(node, opid)
+        self.sync_all()
+        assert_equal(Decimal(node.getbalance('', 0)), Decimal('62.5') - Decimal('6.25'))
+
+        # Mine the transaction; we get another coinbase output.
+        node.generate(1)
+        self.sync_all()
+        assert_equal(Decimal(node.getbalance('', 0)), Decimal('68.75') - Decimal('6.25'))
+
+        # Now send the funds back to a new t-address.
+        taddr = node.getnewaddress()
+        recipients = [{'address': taddr, 'amount': Decimal('6.25') - coinbase_fee - 3*fee}]
+        # TODO: this fails for ZIP_317_FEE due to a dust threshold problem:
+        # "Insufficient funds: have 6.24985, need 0.00000054 more to surpass the dust
+        # threshold and avoid being forced to over-pay the fee. Alternatively, you could
+        # specify a fee of 0.0001 to allow overpayment of the conventional fee and have
+        # this transaction proceed.; note that coinbase outputs will not be selected if
+        # you specify ANY_TADDR, any transparent recipients are included, or if the
+        # `privacyPolicy` parameter is not set to `AllowRevealedSenders` or weaker."
+        opid = node.z_sendmany(orchard_ua, recipients, 1, fee, 'AllowRevealedRecipients')
+        wait_and_assert_operationid_status(node, opid)
+        self.sync_all()
+
+        # At this point we have created the conditions for the bug fixed in
+        # https://github.com/zcash/zcash/pull/5325.
+
+        # listunspent should show the coinbase outputs, and optionally the
+        # newly-received unshielding output.
+        assert_equal(len(node.listunspent()), 10)
+        assert_equal(len(node.listunspent(0)), 11)
+
+        # "getbalance '' 0" should count both outputs. The Orchard bug failed here.
+        assert_equal(Decimal(node.getbalance('', 0)), Decimal('68.75') - coinbase_fee - 3*fee)
+
 if __name__ == '__main__':
    WalletIsFromMe().main ()
--- a/qa/supply-chain/audits.toml
+++ b/qa/supply-chain/audits.toml
@ -800,6 +800,11 @@ who = "Jack Grigg <jack@electriccoin.co>"
 criteria = "safe-to-deploy"
 delta = "1.0.135 -> 1.0.136"

+[[audits.cxxbridge-flags]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.146 -> 1.0.158"
+
 [[audits.cxxbridge-macro]]
 who = "Daira Hopwood <daira@jacaranda.org>"
 criteria = "safe-to-deploy"
@ -1564,6 +1569,12 @@ who = "Daira-Emma Hopwood <daira@jacaranda.org>"
 criteria = "safe-to-deploy"
 delta = "0.4.20 -> 0.4.21"

+[[audits.macro_find_and_replace]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+version = "1.0.0"
+notes = "Fully reviewed. No problems found other than a few typos in documentation (filed https://github.com/lord-ne/rust-macro-find-and-replace/pull/1 )."
+
 [[audits.maybe-rayon]]
 who = "Sean Bowe <ewillbefull@gmail.com>"
 criteria = "safe-to-deploy"
@ -3392,6 +3403,12 @@ user-id = 6289 # Jack Grigg (str4d)
 start = "2023-12-07"
 end = "2025-03-18"

+[[trusted.zcash_transparent]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-12-17"
+end = "2026-05-08"
+
 [[trusted.zip32]]
 criteria = "safe-to-deploy"
 user-id = 6289 # Jack Grigg (str4d)
--- a/qa/supply-chain/config.toml
+++ b/qa/supply-chain/config.toml
@ -63,7 +63,7 @@ version = "0.13.0"
 criteria = "safe-to-deploy"

 [[exemptions.bip0039]]
-version = "0.9.0"
+version = "0.12.0"
 criteria = "safe-to-deploy"

 [[exemptions.bip32]]
@ -107,7 +107,7 @@ version = "0.9.0"
 criteria = "safe-to-deploy"

 [[exemptions.clearscreen]]
-version = "1.0.9"
+version = "4.0.1"
 criteria = "safe-to-deploy"

 [[exemptions.const-oid]]
@ -147,11 +147,11 @@ version = "0.1.0"
 criteria = "safe-to-deploy"

 [[exemptions.cxx]]
-version = "1.0.126"
+version = "1.0.158"
 criteria = "safe-to-deploy"

 [[exemptions.cxxbridge-macro]]
-version = "1.0.126"
+version = "1.0.158"
 criteria = "safe-to-deploy"

 [[exemptions.der]]
@ -162,14 +162,6 @@ criteria = "safe-to-deploy"
 version = "0.9.0"
 criteria = "safe-to-deploy"

-[[exemptions.dirs]]
-version = "2.0.2"
-criteria = "safe-to-deploy"
-
-[[exemptions.dirs-sys]]
-version = "0.3.7"
-criteria = "safe-to-deploy"
-
 [[exemptions.ed25519]]
 version = "2.2.1"
 criteria = "safe-to-deploy"
@ -178,6 +170,10 @@ criteria = "safe-to-deploy"
 version = "3.0.0"
 criteria = "safe-to-deploy"

+[[exemptions.env_home]]
+version = "0.1.0"
+criteria = "safe-to-deploy"
+
 [[exemptions.ff]]
 version = "0.12.0"
 criteria = "safe-to-deploy"
@ -210,6 +206,10 @@ criteria = "safe-to-deploy"
 version = "0.2.6"
 criteria = "safe-to-deploy"

+[[exemptions.getset]]
+version = "0.1.4"
+criteria = "safe-to-deploy"
+
 [[exemptions.group]]
 version = "0.12.0"
 criteria = "safe-to-deploy"
@ -267,19 +267,19 @@ version = "0.9.0"
 criteria = "safe-to-deploy"

 [[exemptions.libc]]
-version = "0.2.159"
+version = "0.2.172"
 criteria = "safe-to-deploy"

 [[exemptions.libm]]
 version = "0.2.2"
 criteria = "safe-to-deploy"

-[[exemptions.libredox]]
-version = "0.0.1"
+[[exemptions.linux-raw-sys]]
+version = "0.4.14"
 criteria = "safe-to-deploy"

 [[exemptions.linux-raw-sys]]
-version = "0.4.14"
+version = "0.9.4"
 criteria = "safe-to-deploy"

 [[exemptions.memchr]]
@ -343,7 +343,7 @@ version = "0.22.0"
 criteria = "safe-to-deploy"

 [[exemptions.password-hash]]
-version = "0.3.2"
+version = "0.5.0"
 criteria = "safe-to-deploy"

 [[exemptions.pasta_curves]]
@ -351,7 +351,7 @@ version = "0.4.0"
 criteria = "safe-to-deploy"

 [[exemptions.pbkdf2]]
-version = "0.9.0"
+version = "0.12.2"
 criteria = "safe-to-deploy"

 [[exemptions.phf]]
@ -390,6 +390,14 @@ criteria = "safe-to-deploy"
 version = "0.12.2"
 criteria = "safe-to-deploy"

+[[exemptions.proc-macro-error-attr2]]
+version = "2.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.proc-macro-error2]]
+version = "2.0.1"
+criteria = "safe-to-deploy"
+
 [[exemptions.proptest]]
 version = "1.6.0"
 criteria = "safe-to-deploy"
@ -414,10 +422,6 @@ criteria = "safe-to-deploy"
 version = "0.3.0"
 criteria = "safe-to-deploy"

-[[exemptions.redox_users]]
-version = "0.4.6"
-criteria = "safe-to-deploy"
-
 [[exemptions.regex]]
 version = "1.10.6"
 criteria = "safe-to-deploy"
@ -446,6 +450,10 @@ criteria = "safe-to-deploy"
 version = "0.38.34"
 criteria = "safe-to-deploy"

+[[exemptions.rustix]]
+version = "1.0.7"
+criteria = "safe-to-deploy"
+
 [[exemptions.rusty-fork]]
 version = "0.3.0"
 criteria = "safe-to-deploy"
@ -482,10 +490,6 @@ criteria = "safe-to-deploy"
 version = "0.7.3"
 criteria = "safe-to-deploy"

-[[exemptions.subtle]]
-version = "2.4.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.syn]]
 version = "1.0.102"
 criteria = "safe-to-deploy"
@ -499,7 +503,15 @@ version = "3.12.0"
 criteria = "safe-to-deploy"

 [[exemptions.terminfo]]
-version = "0.8.0"
+version = "0.9.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.thiserror]]
+version = "2.0.12"
+criteria = "safe-to-deploy"
+
+[[exemptions.thiserror-impl]]
+version = "2.0.12"
 criteria = "safe-to-deploy"

 [[exemptions.time]]
@ -575,7 +587,7 @@ version = "0.3.70"
 criteria = "safe-to-deploy"

 [[exemptions.which]]
-version = "6.0.3"
+version = "7.0.3"
 criteria = "safe-to-deploy"

 [[exemptions.winapi]]
--- a/qa/supply-chain/imports.lock
+++ b/qa/supply-chain/imports.lock
@ -71,15 +71,15 @@ user-login = "nuttycom"
 user-name = "Kris Nuttycombe"

 [[publisher.orchard]]
-version = "0.10.0"
-when = "2024-10-02"
+version = "0.10.2"
+when = "2025-05-08"
 user-id = 169181
 user-login = "nuttycom"
 user-name = "Kris Nuttycombe"

 [[publisher.sapling-crypto]]
-version = "0.3.0"
-when = "2024-10-02"
+version = "0.4.0"
+when = "2024-12-17"
 user-id = 169181
 user-login = "nuttycom"
 user-name = "Kris Nuttycombe"
@ -190,18 +190,18 @@ user-login = "str4d"
 user-name = "Jack Grigg"

 [[publisher.zcash_primitives]]
-version = "0.19.0"
-when = "2024-10-02"
-user-id = 6289
-user-login = "str4d"
-user-name = "Jack Grigg"
+version = "0.21.0"
+when = "2024-12-17"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"

 [[publisher.zcash_proofs]]
-version = "0.19.0"
-when = "2024-10-02"
-user-id = 6289
-user-login = "str4d"
-user-name = "Jack Grigg"
+version = "0.21.0"
+when = "2024-12-17"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"

 [[publisher.zcash_protocol]]
 version = "0.4.3"
@ -217,6 +217,13 @@ user-id = 6289
 user-login = "str4d"
 user-name = "Jack Grigg"

+[[publisher.zcash_transparent]]
+version = "0.1.0"
+when = "2024-12-17"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
 [[publisher.zip32]]
 version = "0.1.3"
 when = "2024-12-13"
@ -335,6 +342,11 @@ criteria = "safe-to-deploy"
 delta = "0.3.0 -> 0.3.1"
 notes = "Just a dependency version bump and a bug fix for redox"

+[[audits.bytecode-alliance.audits.errno]]
+who = "Dan Gohman <dev@sunfishcode.online>"
+criteria = "safe-to-deploy"
+delta = "0.3.9 -> 0.3.10"
+
 [[audits.bytecode-alliance.audits.foldhash]]
 who = "Alex Crichton <alex@alexcrichton.com>"
 criteria = "safe-to-deploy"
@ -721,6 +733,39 @@ delta = "1.0.131 -> 1.0.135"
 notes = "No code changes in the delta"
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

+[[audits.google.audits.cxxbridge-flags]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.136 -> 1.0.137"
+notes = "The delta just removes `#![allow(clippy::let_and_return)]` from `lib.rs`."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cxxbridge-flags]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.137 -> 1.0.140"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cxxbridge-flags]]
+who = "Takuto Ikuta <tikuta@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.140 -> 1.0.141"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cxxbridge-flags]]
+who = "Daniel Cheng <dcheng@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.141 -> 1.0.143"
+notes = "Only changes for rustdoc generation."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cxxbridge-flags]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.143 -> 1.0.146"
+notes = "No actual changes in this delta - just a version bump."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
 [[audits.google.audits.fastrand]]
 who = "George Burgess IV <gbiv@google.com>"
 criteria = "safe-to-deploy"
@ -1491,6 +1536,11 @@ who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
 version = "0.10.2"

+[[audits.isrg.audits.subtle]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "2.5.0 -> 2.6.1"
+
 [[audits.isrg.audits.thiserror]]
 who = "Brandon Pitman <bran@bran.land>"
 criteria = "safe-to-deploy"
@ -1605,6 +1655,13 @@ criteria = "safe-to-deploy"
 delta = "1.0.78 -> 1.0.83"
 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"

+[[audits.mozilla.audits.cfg_aliases]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.1 -> 0.2.1"
+notes = "Very minor changes."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.crossbeam-channel]]
 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 criteria = "safe-to-deploy"
@ -1831,6 +1888,12 @@ libc, but the usage looks correct.
 """
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

+[[audits.mozilla.audits.nix]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.28.0 -> 0.29.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.num-integer]]
 who = "Josh Stone <jistone@redhat.com>"
 criteria = "safe-to-deploy"
@ -1915,6 +1978,13 @@ criteria = "safe-to-deploy"
 delta = "0.5.5 -> 0.5.7"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

+[[audits.mozilla.audits.subtle]]
+who = "Simon Friedberger <simon@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "2.5.0"
+notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.time-core]]
 who = "Kershaw Chang <kershaw@mozilla.com>"
 criteria = "safe-to-deploy"
@ -1984,6 +2054,19 @@ criteria = "safe-to-deploy"
 delta = "1.11.0 -> 1.13.0"
 aggregated-from = "https://raw.githubusercontent.com/zcash/librustzcash/main/supply-chain/audits.toml"

+[[audits.zcash.audits.errno]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.10 -> 0.3.11"
+notes = "The `__errno` location for vxworks and cygwin looks correct from a quick search."
+aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml"
+
+[[audits.zcash.audits.getset]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.4 -> 0.1.5"
+aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml"
+
 [[audits.zcash.audits.hashbrown]]
 who = "Daira-Emma Hopwood <daira@jacaranda.org>"
 criteria = "safe-to-deploy"
--- a/qa/zcash/postponed-updates.txt
+++ b/qa/zcash/postponed-updates.txt
@ -48,48 +48,6 @@ native_rust 1.84.1 2025-12-31
 native_rust 1.85.0 2025-12-31
 native_rust 1.85.1 2025-12-31
 native_rust 1.86.0 2025-12-31
-native_cxxbridge 1.0.137 2025-12-31
-native_cxxbridge 1.0.138 2025-12-31
-native_cxxbridge 1.0.139 2025-12-31
-native_cxxbridge 1.0.140 2025-12-31
-native_cxxbridge 1.0.141 2025-12-31
-native_cxxbridge 1.0.142 2025-12-31
-native_cxxbridge 1.0.143 2025-12-31
-native_cxxbridge 1.0.144 2025-12-31
-native_cxxbridge 1.0.145 2025-12-31
-native_cxxbridge 1.0.146 2025-12-31
-native_cxxbridge 1.0.147 2025-12-31
-native_cxxbridge 1.0.148 2025-12-31
-native_cxxbridge 1.0.149 2025-12-31
-native_cxxbridge 1.0.150 2025-12-31
-native_cxxbridge 1.0.151 2025-12-31
-native_cxxbridge 1.0.152 2025-12-31
-native_cxxbridge 1.0.153 2025-12-31
-native_cxxbridge 1.0.154 2025-12-31
-native_cxxbridge 1.0.155 2025-12-31
-native_cxxbridge 1.0.156 2025-12-31
-native_cxxbridge 1.0.157 2025-12-31
-rustcxx 1.0.137 2025-12-31
-rustcxx 1.0.138 2025-12-31
-rustcxx 1.0.139 2025-12-31
-rustcxx 1.0.140 2025-12-31
-rustcxx 1.0.141 2025-12-31
-rustcxx 1.0.142 2025-12-31
-rustcxx 1.0.143 2025-12-31
-rustcxx 1.0.144 2025-12-31
-rustcxx 1.0.145 2025-12-31
-rustcxx 1.0.146 2025-12-31
-rustcxx 1.0.147 2025-12-31
-rustcxx 1.0.148 2025-12-31
-rustcxx 1.0.149 2025-12-31
-rustcxx 1.0.150 2025-12-31
-rustcxx 1.0.151 2025-12-31
-rustcxx 1.0.152 2025-12-31
-rustcxx 1.0.153 2025-12-31
-rustcxx 1.0.154 2025-12-31
-rustcxx 1.0.155 2025-12-31
-rustcxx 1.0.156 2025-12-31
-rustcxx 1.0.157 2025-12-31

 # We follow upstream Bitcoin Core's LevelDB updates
 leveldb 1.23 2025-12-31
--- a/src/rust/include/rust/orchard/wallet.h
+++ b/src/rust/include/rust/orchard/wallet.h
@ -335,6 +335,13 @@ bool orchard_wallet_get_txdata(
        push_output_t push_output_cb
        );

+/**
+ * Returns true if this nullifier belongs to one of the notes in our wallet.
+ */
+bool orchard_wallet_is_nullifier_from_me(
+        const OrchardWalletPtr* wallet,
+        const unsigned char *nullifier);
+
 typedef void (*push_txid_callback_t)(void* resultVector, unsigned char txid[32]);

 /**
--- a/src/rust/src/sapling.rs
+++ b/src/rust/src/sapling.rs
@ -11,6 +11,7 @@ use bls12_381::Bls12;
 use group::GroupEncoding;
 use memuse::DynamicUsage;
 use rand_core::{OsRng, RngCore};
+use sapling::keys::EphemeralSecretKey;
 use sapling::{
    builder::BundleType,
    circuit::{self, OutputParameters, SpendParameters},
@ -344,7 +345,7 @@ impl OutputProver for StaticTxProver {
    type Proof = Proof<Bls12>;

    fn prepare_circuit(
-        esk: jubjub::Fr,
+        esk: &EphemeralSecretKey,
        payment_address: PaymentAddress,
        rcm: jubjub::Fr,
        value: NoteValue,
@ -366,7 +367,7 @@ impl OutputProver for StaticTxProver {

 pub(crate) struct SaplingBuilder {
    builder: sapling::builder::Builder,
-    signing_keys: Vec<SpendAuthorizingKey>,
+    extsks: Vec<ExtendedSpendingKey>,
 }

 pub(crate) fn new_sapling_builder(
@ -390,7 +391,7 @@ pub(crate) fn new_sapling_builder(
            bundle_type,
            anchor,
        ),
-        signing_keys: vec![],
+        extsks: vec![],
    }))
 }

@ -425,9 +426,13 @@ impl SaplingBuilder {
            .map_err(|e| format!("Invalid Sapling Merkle path: {}", e))?;

        self.builder
-            .add_spend(&extsk, note, merkle_path)
+            .add_spend(
+                extsk.to_diversifiable_full_viewing_key().fvk().clone(),
+                note,
+                merkle_path,
+            )
            .map_err(|e| format!("Failed to add Sapling spend: {}", e))?;
-        self.signing_keys.push(extsk.expsk.ask);
+        self.extsks.push(extsk);

        Ok(())
    }
@ -450,19 +455,16 @@ impl SaplingBuilder {
    }

    fn build(self) -> Result<SaplingUnauthorizedBundle, String> {
-        let Self {
-            builder,
-            signing_keys,
-        } = self;
+        let Self { builder, extsks } = self;
        let prover = crate::sapling::StaticTxProver;
        let rng = OsRng;
        let bundle = builder
-            .build::<StaticTxProver, StaticTxProver, _, Amount>(rng)
+            .build::<StaticTxProver, StaticTxProver, _, Amount>(&extsks, rng)
            .map_err(|e| format!("Failed to build Sapling bundle: {}", e))?
            .map(|(bundle, _)| bundle.create_proofs(&prover, &prover, rng, ()));
        Ok(SaplingUnauthorizedBundle {
            bundle,
-            signing_keys,
+            signing_keys: extsks.into_iter().map(|extsk| extsk.expsk.ask).collect(),
        })
    }
 }
--- a/src/rust/src/tests/zip339.rs
+++ b/src/rust/src/tests/zip339.rs
@ -1,21 +1,11 @@
 use libc::c_char;
-use std::{
-    convert::{TryFrom, TryInto},
-    ffi::CStr,
-    ptr,
-};
+use std::{ffi::CStr, ptr};

 use crate::zip339_ffi::{
    zip339_entropy_to_phrase, zip339_free_phrase, zip339_phrase_to_seed, zip339_validate_phrase,
    Language,
 };

-#[test]
-fn test_try_from_language() {
-    assert_eq!(Language(0).try_into(), Ok(bip0039::Language::English));
-    assert!(bip0039::Language::try_from(Language(1234)).is_err());
-}
-
 #[test]
 fn test_free_null_phrase_is_noop() {
    zip339_free_phrase(ptr::null_mut());
--- a/src/rust/src/transaction_ffi.rs
+++ b/src/rust/src/transaction_ffi.rs
@ -1,4 +1,4 @@
-use std::convert::TryInto;
+use std::convert::{TryFrom, TryInto};
 use std::io::Cursor;
 use std::{ptr, slice};

@ -11,7 +11,6 @@ use zcash_primitives::{
    consensus::BranchId,
    legacy::Script,
    transaction::{
-        components::transparent,
        sighash::{SignableInput, TransparentAuthorizingContext},
        sighash_v5::v5_signature_hash,
        txid::TxIdDigester,
@ -62,10 +61,10 @@ pub extern "C" fn zcash_transaction_digests(

 #[derive(Clone, Debug)]
 pub(crate) struct TransparentAuth {
-    all_prev_outputs: Vec<transparent::TxOut>,
+    all_prev_outputs: Vec<transparent::bundle::TxOut>,
 }

-impl transparent::Authorization for TransparentAuth {
+impl transparent::bundle::Authorization for TransparentAuth {
    type ScriptSig = Script;
 }

@ -92,7 +91,7 @@ pub(crate) struct MapTransparent {
 impl MapTransparent {
    pub(crate) fn parse(all_prev_outputs: &[u8], tx: &Transaction) -> Result<Self, String> {
        let mut cursor = Cursor::new(all_prev_outputs);
-        match Vector::read(&mut cursor, transparent::TxOut::read) {
+        match Vector::read(&mut cursor, transparent::bundle::TxOut::read) {
            Err(e) => Err(format!("Invalid all_prev_outputs field: {}", e)),
            Ok(_) if (cursor.position() as usize) != all_prev_outputs.len() => {
                Err("all_prev_outputs had trailing data".into())
@ -131,15 +130,17 @@ impl MapTransparent {
    }
 }

-impl transparent::MapAuth<transparent::Authorized, TransparentAuth> for MapTransparent {
+impl transparent::bundle::MapAuth<transparent::bundle::Authorized, TransparentAuth>
+    for MapTransparent
+{
    fn map_script_sig(
        &self,
-        s: <transparent::Authorized as transparent::Authorization>::ScriptSig,
-    ) -> <TransparentAuth as transparent::Authorization>::ScriptSig {
+        s: <transparent::bundle::Authorized as transparent::bundle::Authorization>::ScriptSig,
+    ) -> <TransparentAuth as transparent::bundle::Authorization>::ScriptSig {
        s
    }

-    fn map_authorization(&self, _: transparent::Authorized) -> TransparentAuth {
+    fn map_authorization(&self, _: transparent::bundle::Authorized) -> TransparentAuth {
        // TODO: This map should consume self, so we can move self.auth
        self.auth.clone()
    }
@ -261,6 +262,21 @@ pub extern "C" fn zcash_transaction_zip244_signature_digest(
    let signable_input = if index == NOT_AN_INPUT {
        SignableInput::Shielded
    } else {
+        // This conversion to `u8` is always fine:
+        // - We only call this FFI method once we already know we are using ZIP 244.
+        // - Even if we weren't, `hash_type` is one byte tacked onto the end of a
+        //   signature, so it always fits into a `u8` (and TBH I don't know why we
+        //   ever set it to `u32`).
+        let hash_type = u8::try_from(hash_type).unwrap();
+
+        let hash_type = match transparent::sighash::SighashType::parse(hash_type) {
+            Some(hash_type) => hash_type,
+            None => {
+                error!("hash_type violates the ZIP 244 rules");
+                return false;
+            }
+        };
+
        let prevout = match precomputed_tx.tx.transparent_bundle() {
            Some(bundle) => match bundle.authorization.all_prev_outputs.get(index) {
                Some(prevout) => prevout,
@ -275,22 +291,17 @@ pub extern "C" fn zcash_transaction_zip244_signature_digest(
            }
        };

-        SignableInput::Transparent {
-            // This conversion to `u8` is always fine:
-            // - We only call this FFI method once we already know we are using ZIP 244.
-            // - Even if we weren't, `hash_type` is one byte tacked onto the end of a
-            //   signature, so it always fits into a `u8` (and TBH I don't know why we
-            //   ever set it to `u32`).
-            hash_type: hash_type.try_into().unwrap(),
+        SignableInput::Transparent(transparent::sighash::SignableInput::from_parts(
+            hash_type,
            index,
            // `script_code` is unused by `v5_signature_hash`, so instead of passing the
            // real `script_code` across the FFI (and paying the serialization and parsing
            // cost for no benefit), we set it to the prevout's `script_pubkey`. This
            // happens to be correct anyway for every output script kind except P2SH.
-            script_code: &prevout.script_pubkey,
-            script_pubkey: &prevout.script_pubkey,
-            value: prevout.value,
-        }
+            &prevout.script_pubkey,
+            &prevout.script_pubkey,
+            prevout.value,
+        ))
    };

    let sighash = v5_signature_hash(
--- a/src/rust/src/wallet.rs
+++ b/src/rust/src/wallet.rs
@ -1183,6 +1183,18 @@ pub extern "C" fn orchard_wallet_get_txdata(
    }
 }

+#[no_mangle]
+pub extern "C" fn orchard_wallet_is_nullifier_from_me(
+    wallet: *const Wallet,
+    nullifier: *const [c_uchar; 32],
+) -> bool {
+    let wallet = unsafe { wallet.as_ref() }.expect("Wallet pointer may not be null.");
+    let nullifier =
+        Nullifier::from_bytes(unsafe { nullifier.as_ref() }.expect("nullifier may not be null."));
+
+    wallet.nullifiers.contains_key(&nullifier.unwrap())
+}
+
 pub type PushTxId = unsafe extern "C" fn(obj: Option<FFICallbackReceiver>, txid: *const [u8; 32]);

 #[no_mangle]
--- a/src/rust/src/zip339_ffi.rs
+++ b/src/rust/src/zip339_ffi.rs
@ -1,6 +1,7 @@
 use libc::{c_char, size_t};
+use macro_find_and_replace::replace_token_sequence;
 use std::{
-    convert::{TryFrom, TryInto},
+    borrow::Cow,
    ffi::{CStr, CString},
    ptr, slice,
 };
@ -13,27 +14,90 @@ use zeroize::Zeroize;
 #[derive(Copy, Clone)]
 pub struct Language(pub u32);

-impl TryFrom<Language> for bip0039::Language {
-    type Error = ();
-
-    fn try_from(language: Language) -> Result<Self, ()> {
+impl Language {
+    #[allow(clippy::too_many_arguments)]
+    fn handle<Ctx, T>(
+        self,
+        ctx: Ctx,
+        en: impl FnOnce(Ctx) -> Option<T>,
+        zh_cn: impl FnOnce(Ctx) -> Option<T>,
+        zh_tw: impl FnOnce(Ctx) -> Option<T>,
+        cs: impl FnOnce(Ctx) -> Option<T>,
+        fr: impl FnOnce(Ctx) -> Option<T>,
+        it: impl FnOnce(Ctx) -> Option<T>,
+        ja: impl FnOnce(Ctx) -> Option<T>,
+        ko: impl FnOnce(Ctx) -> Option<T>,
+        pt: impl FnOnce(Ctx) -> Option<T>,
+        es: impl FnOnce(Ctx) -> Option<T>,
+    ) -> Option<T> {
        // These must match `src/rust/include/zip339.h`.
-        match language {
-            Language(0) => Ok(bip0039::Language::English),
-            Language(1) => Ok(bip0039::Language::SimplifiedChinese),
-            Language(2) => Ok(bip0039::Language::TraditionalChinese),
-            Language(3) => Ok(bip0039::Language::Czech),
-            Language(4) => Ok(bip0039::Language::French),
-            Language(5) => Ok(bip0039::Language::Italian),
-            Language(6) => Ok(bip0039::Language::Japanese),
-            Language(7) => Ok(bip0039::Language::Korean),
-            Language(8) => Ok(bip0039::Language::Portuguese),
-            Language(9) => Ok(bip0039::Language::Spanish),
-            Language(_) => Err(()),
+        match self {
+            Language(0) => en(ctx),
+            Language(1) => zh_cn(ctx),
+            Language(2) => zh_tw(ctx),
+            Language(3) => cs(ctx),
+            Language(4) => fr(ctx),
+            Language(5) => it(ctx),
+            Language(6) => ja(ctx),
+            Language(7) => ko(ctx),
+            Language(8) => pt(ctx),
+            Language(9) => es(ctx),
+            Language(_) => None,
        }
    }
 }

+macro_rules! all_languages {
+    ($self:expr, $ctx:expr, $e:expr) => {
+        $self.handle(
+            $ctx,
+            replace_token_sequence!{[LANGUAGE], [bip0039::English], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::ChineseSimplified], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::ChineseTraditional], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Czech], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::French], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Italian], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Japanese], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Korean], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Portuguese], $e},
+            replace_token_sequence!{[LANGUAGE], [bip0039::Spanish], $e},
+        )
+    };
+}
+
+impl Language {
+    fn with_mnemonic_phrase_from_entropy<E: Into<Vec<u8>>, T>(
+        self,
+        entropy: E,
+        f: impl FnOnce(&str) -> Option<T>,
+    ) -> Option<T> {
+        all_languages!(self, (entropy, f), |(entropy, f)| {
+            bip0039::Mnemonic::<LANGUAGE>::from_entropy(entropy)
+                .ok()
+                .and_then(|mnemonic| f(mnemonic.phrase()))
+        })
+    }
+
+    fn with_seed_from_mnemonic_phrase<'a, P: Into<Cow<'a, str>>, T>(
+        self,
+        phrase: P,
+        passphrase: &str,
+        f: impl FnOnce([u8; 64]) -> Option<T>,
+    ) -> Option<T> {
+        all_languages!(self, (phrase, passphrase, f), |(phrase, passphrase, f)| {
+            bip0039::Mnemonic::<LANGUAGE>::from_phrase(phrase)
+                .ok()
+                .and_then(|mnemonic| f(mnemonic.to_seed(passphrase)))
+        })
+    }
+
+    fn validate_mnemonic<'a, P: Into<Cow<'a, str>>>(self, phrase: P) -> Option<()> {
+        all_languages!(self, phrase, |phrase| {
+            bip0039::Mnemonic::<LANGUAGE>::validate(phrase).ok()
+        })
+    }
+}
+
 /// Creates a phrase with the given entropy, in the given `Language`. The phrase is represented as
 /// a pointer to a null-terminated C string that must not be written to, and must be freed by
 /// `zip339_free_phrase`.
@ -45,15 +109,14 @@ pub extern "C" fn zip339_entropy_to_phrase(
 ) -> *const c_char {
    assert!(!entropy.is_null());

-    if let Ok(language) = language.try_into() {
    let entropy = unsafe { slice::from_raw_parts(entropy, entropy_len) }.to_vec();
-        if let Ok(mnemonic) = bip0039::Mnemonic::from_entropy_in(language, entropy) {
-            if let Ok(phrase) = CString::new(mnemonic.phrase()) {
-                return phrase.into_raw() as *const c_char;
-            }
-        }
-    }
-    ptr::null()
+    language
+        .with_mnemonic_phrase_from_entropy(entropy, |phrase| {
+            CString::new(phrase)
+                .ok()
+                .map(|phrase| phrase.into_raw() as *const c_char)
+        })
+        .unwrap_or(ptr::null())
 }

 /// Frees a phrase returned by `zip339_entropy_to_phrase`.
@ -74,10 +137,8 @@ pub extern "C" fn zip339_free_phrase(phrase: *const c_char) {
 pub extern "C" fn zip339_validate_phrase(language: Language, phrase: *const c_char) -> bool {
    assert!(!phrase.is_null());

-    if let Ok(language) = language.try_into() {
    if let Ok(phrase) = unsafe { CStr::from_ptr(phrase) }.to_str() {
-            return bip0039::Mnemonic::validate_in(language, phrase).is_ok();
-        }
+        return language.validate_mnemonic(phrase).is_some();
    }
    false
 }
@ -93,20 +154,23 @@ pub extern "C" fn zip339_phrase_to_seed(
    assert!(!phrase.is_null());
    assert!(!buf.is_null());

-    if let Ok(language) = language.try_into() {
-        if let Ok(phrase) = unsafe { CStr::from_ptr(phrase) }.to_str() {
-            if let Ok(mnemonic) = bip0039::Mnemonic::from_phrase_in(language, phrase) {
+    let phrase = unsafe { CStr::from_ptr(phrase) };
+    phrase
+        .to_str()
+        .ok()
+        .and_then(|phrase| {
            // Use the empty passphrase.
-                let seed = mnemonic.to_seed("");
+            language.with_seed_from_mnemonic_phrase(phrase, "", |seed| {
                unsafe {
                    ptr::copy(seed.as_ptr(), buf, 64);
                }
-                return true;
-            }
-        }
-    }
+                Some(true)
+            })
+        })
+        .unwrap_or_else(|| {
            unsafe {
                ptr::write_bytes(buf, 0, 64);
            }
            false
+        })
 }
--- a/src/test/sighash_tests.cpp
+++ b/src/test/sighash_tests.cpp
@ -31,7 +31,7 @@ uint256 static SignatureHashOld(CScript scriptCode, const CTransaction& txTo, un
    static const uint256 one(uint256S("0000000000000000000000000000000000000000000000000000000000000001"));
    if (nIn >= txTo.vin.size())
    {
-        printf("ERROR: SignatureHash(): nIn=%d out of range\n", nIn);
+        printf("ERROR: SignatureHash(): nIn=%u out of range\n", nIn);
        return one;
    }
    CMutableTransaction txTmp(txTo);
@ -58,7 +58,7 @@ uint256 static SignatureHashOld(CScript scriptCode, const CTransaction& txTo, un
        unsigned int nOut = nIn;
        if (nOut >= txTmp.vout.size())
        {
-            printf("ERROR: SignatureHash(): nOut=%d out of range\n", nOut);
+            printf("ERROR: SignatureHash(): nOut=%u out of range\n", nOut);
            return one;
        }
        txTmp.vout.resize(nOut+1);
--- a/src/wallet/orchard.h
+++ b/src/wallet/orchard.h
@ -437,6 +437,10 @@ public:
        reinterpret_cast<std::vector<uint256>*>(txidsRet)->push_back(txid_out);
    }

+    bool IsNullifierFromMe(const std::array<uint8_t, 32>& nullifier) const {
+        return orchard_wallet_is_nullifier_from_me(inner.get(), nullifier.data());
+    }
+
    std::vector<uint256> GetPotentialSpendsFromNullifier(const uint256& nullifier) const {
        std::vector<uint256> result;
        orchard_wallet_get_potential_spends_from_nullifier(
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@ -4082,6 +4082,11 @@ bool CWallet::IsFromMe(const CTransaction& tx) const
            return true;
        }
    }
+    for (const auto& action : tx.GetOrchardBundle().GetDetails()->actions()) {
+        if (orchardWallet.IsNullifierFromMe(action.nullifier())) {
+            return true;
+        }
+    }
    return false;
 }

@ -4981,6 +4986,11 @@ bool CWalletTx::IsFromMe(const isminefilter& filter) const
            return true;
        }
    }
+    for (const auto& action : GetOrchardBundle().GetDetails()->actions()) {
+        if (pwallet->orchardWallet.IsNullifierFromMe(action.nullifier())) {
+            return true;
+        }
+    }
    return false;
 }
Author	SHA1	Message	Date
Kris Nuttycombe	fe3e645ca9	Merge pull request #7035 from str4d/fix-wtx-is-from-me-orchard wallet: Check spent Orchard notes in `CWallet{Tx}::IsFromMe`	2025-06-13 17:23:30 +01:00
Jack Grigg	74a1a5d729	wallet: Check spent Orchard notes in `CWallet{Tx}::IsFromMe` We missed these methods when integrating Orchard into the wallet. - We didn't notice `CWallet::IsFromMe` because while previous shielded protocols did spend detection in `CWallet::AddToWalletIfInvolvingMe` via that logic, the Orchard logic was implemented in a separate internal Rust wallet with its own detection logic. Technically the change is unnecessary here as `CWallet::AddToWalletIfInvolvingMe` is the only user of this method, but we update it for consistency. - We didn't notice `CWalletTx::IsFromMe` because the only critical place it affects is the `getbalance` RPC (other than that, it is only called from code used to either create purely-transparent transactions, or provide informational output on non-critical RPC methods). We had a similar bug with this method previously where it didn't track shielded at all (zcash/zcash@fd49f78042).	2025-06-13 15:10:45 +01:00
Jack Grigg	8fa26d7305	qa: Add test exposing an Orchard bug in transparent balance RPCs	2025-06-13 15:03:12 +01:00
Jack Grigg	2352fbc1ed	Merge pull request #7030 from daira/nicer-bip0039-language-handling Make the handling of bip0039 languages nicer	2025-05-20 16:31:44 +01:00
Daira-Emma Hopwood	78695a7d63	Make the handling of bip0039 languages nicer. Signed-off-by: Daira-Emma Hopwood <daira@jacaranda.org>	2025-05-20 10:40:28 +01:00
Jack Grigg	4256156874	Merge pull request #7029 from pacu/fix-test-compiler-error Fixes test/sighash_tests.cpp compiler error	2025-05-19 13:21:37 +01:00
Jack Grigg	3b5ecb2b5d	Merge pull request #7027 from str4d/rust-updates-6.3.0 Rust updates for 6.3.0	2025-05-19 13:20:17 +01:00
pacu	9c593754c9	Fixes test/sighash_tests.cpp compiler error closes #7028	2025-05-15 13:51:45 -03:00
Jack Grigg	dfec26eb1d	rust: thiserror 2	2025-05-09 00:27:58 +00:00
Jack Grigg	7cdc7457a4	depends: cxx 1.0.158	2025-05-09 00:21:54 +00:00
Jack Grigg	2403a0aed9	rust: clearscreen 4	2025-05-08 23:39:55 +00:00
Jack Grigg	be5ff646dc	rust: Migrate to `zcash_primitives 0.21`	2025-05-08 23:33:04 +00:00
Jack Grigg	e90508083e	rust: Migrate to `bip0039 0.12`	2025-05-08 23:33:04 +00:00
Kris Nuttycombe	1f1f7a385a	Merge pull request #7018 from zcash/version-6.2.0 Merge 6.2.0 back into the main branch	2025-04-21 12:00:53 -06:00
Kris Nuttycombe	e3119e5b72	ci: Use the `clone_url` field of the `repo` object for `git fetch` to check a PR This also modifies changed file list parsing to avoid the need for a shell variable.	2025-04-17 14:29:32 -06:00
Daira-Emma Hopwood	c2cbbc3ae2	Merge remote-tracking branch 'origin' into version-6.2.0	2025-04-17 13:47:00 +01:00
Kris Nuttycombe	a78675000b	Merge pull request #7021 from zcash/release-v6.2.0 Release v6.2.0	2025-04-17 06:16:07 -06:00
y4ssi	ff279fdb6a	Update ci.yml Remove CI for ubuntu 20.04	2025-04-16 22:22:51 -06:00
Kris Nuttycombe	76db11eba1	Merge pull request #7020 from zcash/remove_ubuntu2004_build Remove CI for ubuntu 20.04	2025-04-16 22:17:51 -06:00
y4ssi	bb59677ec9	Update ci.yml Remove CI for ubuntu 20.04	2025-04-16 21:51:21 -06:00