We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit only updates a signed release manifest file (signatures.txt). It refreshes cryptographic hashes for release notes and adds a new firmware file entry, then re-signs the file with PGP. There is no code change and no security vuln…
f32e0579by Peter D. Gray+11−101 fileThis commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There…
d8b4daa6by tychovrahe+526−922 filesThis commit fixes the firmware build scripts for Trezor's Nordic Bluetooth chip variant so the correct cryptographic hash algorithm (SHA-256) is used when validating firmware images. Previously, the nRF54L-based boards could end up using S…
66205f1bby tychovrahe+36−34 filesThis commit updates Coldcard's release notes to announce that a previously disclosed limited-entropy bug in seed generation now also affects Mk3 hardware, and that a new Mk3 firmware version 4.2.0 has been released as a hotfix. The earlier…
50fceee9by Peter D. Gray+10−82 filesThis commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-igno…
1af86279by Salvatore Ingala+66−173 filesThis commit simply updates a hardcoded Bitcoin blockchain height number in a file that is automatically generated. There is no security issue here.
1f03a52fby Peter D. Gray+2−21 fileThis commit is a housekeeping change that reorganizes the feature sections inside 14 Cargo.toml build configuration files. It reorders, renames, and groups feature flags (such as MCU selection, privilege mode, build options, and selectable…
40ce9494by cepetr+428−33614 filesThis commit tightens how the Ledger Bitcoin app parses previous transaction data when signing Bitcoin transactions. It adds size limits and completion checks that prevent malformed or oversized previous transaction outputs from being proce…
0df0add4by Salvatore Ingala+44−64 filesThis commit only changes the declared type of three array-length constants from signed int to unsigned size_t, and removes two stale comments about a 10,000-byte limit. There is no change to program logic, memory allocation, bounds checkin…
373f4a56by Salvatore Ingala+7−72 filesThis commit is a large but straightforward internal refactoring: the cryptographic code is moved from one Rust crate (`rtl`) into a new dedicated crate (`crypto`), and all project dependencies are updated to point to the new crate. The act…
836142c7by matejcik+2213−195139 filesThis commit is a routine internal code reorganization. It moves the syslog (system logging) functionality from one Rust module into a new shared 'sys' crate and updates the callers to use the new location. There is no user-facing change, n…
bddf05eeby matejcik+152−7111 filesThis commit removes internal debug-only printing helpers from the Trezor firmware's Rust code. It is a cleanup change with no security relevance: the removed macros were only active when a special 'debug' build feature was enabled, and the…
b0d40104by matejcik+0−483 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.