From 7693db39cf3055e6965165a1b0ef6548490e55f7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 14:10:39 +0000
Subject: [PATCH] chore(security): rotate TLS certificate pins

Auto-generated by .github/workflows/pin-rotation.yml. Re-fetched the
live chains and refreshed the leaf + intermediate SPKI pins and the
pin-set expiration dates. Review the diff and verify on-device against
a proxy before merging (docs/PIN-ROTATION.md).
---
 .../res/xml/network_security_config.xml          | 16 ++++++++--------
 docs/PIN-ROTATION.md                             | 10 +++++-----
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/app/composeApp/src/androidMain/res/xml/network_security_config.xml b/app/composeApp/src/androidMain/res/xml/network_security_config.xml
index eeacee3..378fe47 100644
--- a/app/composeApp/src/androidMain/res/xml/network_security_config.xml
+++ b/app/composeApp/src/androidMain/res/xml/network_security_config.xml
@@ -25,7 +25,7 @@
   for every host live in the auto-maintained table in docs/PIN-ROTATION.md.
 
   ROTATION PLAYBOOK: docs/PIN-ROTATION.md
-  Pins last fetched: 2026-07-09
+  Pins last fetched: 2026-10-07
 -->
 <network-security-config>
     <base-config cleartextTrafficPermitted="false">
@@ -38,9 +38,9 @@
          Current issuer + leaf notAfter: see docs/PIN-ROTATION.md. -->
     <domain-config>
         <domain includeSubdomains="false">api.coinbase.com</domain>
-        <pin-set expiration="2026-09-29">
+        <pin-set expiration="2026-12-06">
             <!-- leaf SPKI (primary pin) -->
-            <pin digest="SHA-256">KUnddVn4H2YCi5Yy/As5J1wJiczMYpzdJ6ERqY88goM=</pin>
+            <pin digest="SHA-256">xhsVX1uSfNsNRq5pkbjoQBBXcuiePa9JWuuj1ptt2Y8=</pin>
             <!-- issuing-intermediate SPKI (backup pin) -->
             <pin digest="SHA-256">kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=</pin>
         </pin-set>
@@ -50,9 +50,9 @@
          Current issuer + leaf notAfter: see docs/PIN-ROTATION.md. -->
     <domain-config>
         <domain includeSubdomains="false">api.kraken.com</domain>
-        <pin-set expiration="2026-09-23">
+        <pin-set expiration="2026-11-21">
             <!-- leaf SPKI (primary pin) -->
-            <pin digest="SHA-256">bgRJ9aEZeU9T9RdxtiHelTU4RL+r5J6jfFBcETA2a3E=</pin>
+            <pin digest="SHA-256">7wkkVIAoGzKQFxuavjByXXl0Y7/Iel/0WxZFipJRvo0=</pin>
             <!-- issuing-intermediate SPKI (backup pin) -->
             <pin digest="SHA-256">kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=</pin>
         </pin-set>
@@ -74,11 +74,11 @@
          Current issuer + leaf notAfter: see docs/PIN-ROTATION.md. -->
     <domain-config>
         <domain includeSubdomains="false">api.coingecko.com</domain>
-        <pin-set expiration="2026-09-26">
+        <pin-set expiration="2026-12-28">
             <!-- leaf SPKI (primary pin) -->
-            <pin digest="SHA-256">Mt5g5IYSNNUwjs6dOdWULwrc5T9JazZ3oiBArjectPQ=</pin>
+            <pin digest="SHA-256">cmk+A60n1hDjcuGrgXFb7tAoF6ShDivKr97Pf5ao6gg=</pin>
             <!-- issuing-intermediate SPKI (backup pin) -->
-            <pin digest="SHA-256">kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=</pin>
+            <pin digest="SHA-256">s/tdAOmUzd8syaTuqfgGvFcn6DzA5Cmb+Vby1ST+U3Y=</pin>
         </pin-set>
     </domain-config>
 </network-security-config>
diff --git a/docs/PIN-ROTATION.md b/docs/PIN-ROTATION.md
index 06488ab..af064fa 100644
--- a/docs/PIN-ROTATION.md
+++ b/docs/PIN-ROTATION.md
@@ -31,14 +31,14 @@ overwritten on the next rotation.
 <!-- AUTO-PIN-TABLE:START -->
 | Host | Leaf notAfter | `expiration` in XML | Issuer (intermediate) |
 |------|---------------|---------------------|-----------------------|
-| api.kraken.com | 2026-09-28 | **2026-09-23** | Google Trust Services WE1 |
-| api.coingecko.com | 2026-10-01 | 2026-09-26 | Google Trust Services WE1 |
-| api.coinbase.com | 2026-10-04 | 2026-09-29 | Google Trust Services WE1 |
-| www.bitstamp.net | 2026-11-07 | 2026-11-02 | DigiCert EV RSA CA G2 |
+| www.bitstamp.net | 2026-11-07 | **2026-11-02** | DigiCert EV RSA CA G2 |
+| api.kraken.com | 2026-11-26 | 2026-11-21 | Google Trust Services WE1 |
+| api.coinbase.com | 2026-12-11 | 2026-12-06 | Google Trust Services WE1 |
+| api.coingecko.com | 2027-01-02 | 2026-12-28 | Let's Encrypt YE2 |
 <!-- AUTO-PIN-TABLE:END -->
 
 <!-- AUTO-PIN-DEADLINE:START -->
-**The driving deadline is api.kraken.com on 2026-09-23.** A release with refreshed pins MUST be on GitHub Releases (and have had time to propagate to F-Droid + users) before that date, or pinning silently disables for api.kraken.com.
+**The driving deadline is www.bitstamp.net on 2026-11-02.** A release with refreshed pins MUST be on GitHub Releases (and have had time to propagate to F-Droid + users) before that date, or pinning silently disables for www.bitstamp.net.
 <!-- AUTO-PIN-DEADLINE:END -->
 
 ## Automated rotation (preferred)