Blockstream Jade

This commit is a routine developer tooling cleanup. It removes a separate debug script and instead lets the same launch script start the emulator in debugger mode when a --gdb flag is passed. There is no change to the actual Jade firmware or to how end-user devices behave.

This commit fixes two developer helper scripts used to launch a QEMU emulator for testing. The changes correct a shell scripting mistake (using a pipe to 'true' instead of '|| true') and make the scripts more portable by using '/usr/bin/env bash'. There is no security issue here; it is a routine bugfix for internal development tooling.

This commit changes the project's Docker build environment so that Git inside the container treats a folder shared from the host computer (/host/jade) as a 'safe directory.' This is a convenience change for developers using Docker Compose, not a fix for a product vulnerability. It slightly lowers a Git security guardrail that exists to prevent attacks when a repository is owned by a different user, but only within the isolated development container context.

This commit changes a build helper script so that, if the ESP-IDF development tools are not already active, it automatically loads them from a standard install location (/opt/esp/idf) instead of immediately failing with an error. It is a developer convenience improvement with no apparent security relevance.

This commit simply deletes two unused Docker build files for the command-line tool. It is a routine cleanup change with no security relevance.

This commit only edits the project's CHANGELOG.md file, adding release notes about new features, changes, and fixes. There are no code changes and no security-related content.

This commit only updates the README.md documentation. It rewords build instructions, adds a Docker-based build section, reorganizes the local build environment steps, and updates device target descriptions. No source code, firmware logic, cryptography, or security behavior is changed.

This change only relaxes a test-suite memory-check for one specific hardware board variant (JADE_V2C). It does not alter the actual device firmware, wallet logic, or any code that end users rely on for security. It is a testing/CI adjustment, not a security fix or vulnerability.

This commit updates internal GitLab CI build/flash scripts for the Jade hardware wallet. It changes how firmware is flashed onto test devices during automated testing: switching from running scripts directly on the runner to running them inside a Docker container, adding support for a new Jade v2.0c hardware variant, and skipping unnecessary Git submodules to speed up CI. There is no change to the firmware code that users run, no security fix, and no vulnerability.

This commit only changes which version of a code-formatting tool the project uses. It adds a check that clang-format version 19 is installed before running formatting. There is no security-relevant change to the wallet firmware or its behavior.

This change cleans up temporary '.pin' test files after automated tests finish. It is a minor hygiene improvement in test code, not a fix for an exploitable product vulnerability. There is no indication these leftover files create meaningful security risk in normal use.

This commit adds a new manual CI/CD job that builds and publishes a Docker image for compiling Jade firmware. It is purely a build-pipeline change and does not modify any wallet, firmware, or cryptographic code.

This commit is described as updating a submodule or external dependency called 'pinserver' to the latest master version. No actual code diff was provided, and there are no verified references explaining what changed in the pinserver update. Based only on the supplied materials, we cannot determine whether this update fixes a security issue, adds a feature, or is routine maintenance.

This commit is purely a code reformatting pass using clang-format-19. It adjusts whitespace, pointer-asterisk placement, and braced-initializer indentation across eight source files. There are no functional changes, no bug fixes, and no security-related alterations.

This commit is a routine build-system housekeeping change. It swaps the Docker image used for automated builds from 'verde' to 'jade_builder', updates the ESP-IDF framework version from 5.4.0 to 5.4.3, adjusts paths to the ESP-IDF installation, and refactors several CI helper scripts. There is no change to the wallet firmware code that handles private keys, transactions, or user data, and no security vulnerability is introduced or fixed in the diff itself.

This commit is a routine build-system cleanup. It removes a development-only Dockerfile and switches the docker-compose setup to use a pre-built container image instead of building one locally. There is no indication this change fixes or introduces a security vulnerability.

This commit only changes how the project's firmware is built. It switches the build container from a generic Debian image to an official Espressif image and updates the ESP-IDF (Espressif's development framework) version from 5.4 to 5.4.3. There is no indication in the commit of any security bug, vulnerability fix, or change to the firmware code itself.

This commit only fixes code style issues in Python test and helper scripts. It adds spaces inside f-strings and log messages so that an automated style checker (pycodestyle) passes. None of the changes affect program logic, security checks, or how the device handles sensitive data.

This commit updates several Python library dependencies in Blockstream Jade's requirements file to maintain compatibility with newer Debian and ESP-IDF versions. It also bumps cbor2 from 5.4.6 to 5.7.1 (but not higher due to a known bug) and requests from 2.26.0 to 2.32.5. The newer requests version fixes known security issues in older requests versions, such as unsafe cookie handling and certificate verification problems. There is no direct evidence in the commit of an active exploit or a specific CVE being patched, and the commit message frames the change as compatibility rather than security.

This commit only changes one date in the project's CHANGELOG.md file, moving a release date from 2026-02-09 to 2026-02-18. There is no code change, no security fix, and no functional change of any kind.

This commit only changes a version number string in a Python package metadata file, from 1.0.37 to 1.0.39. There is no code change, no security fix, and no functional behavior change at all.

This commit updates a bundled copy of the libwally-core library to the latest master version. No actual code changes are visible in the supplied diff, only a submodule pointer or directory reference was changed. There is no information about what changed in libwally-core, whether any of those changes are security fixes, or whether this update addresses any vulnerability in Blockstream Jade.

This commit is a routine build-script maintenance change. It updates three release helper scripts so they use different firmware output directory names for two hardware variants (jade2.0 and jade2.0c). There is no user-facing security change, no vulnerability fix, and no change to cryptographic signing logic.

This commit only updates the project's CHANGELOG.md file, adding release notes for version 1.0.39. It does not change any source code, configuration, or executable behavior. The changelog mentions routine items such as faster QR scanning, a library update, and minor fixes, but nothing is disclosed as a security vulnerability, and no code is patched.

This change only adjusts automated test code. It makes the test suite skip very large QR image tests when running on older Jade v1.1 hardware because those tests were timing out over the serial connection. There is no change to the actual Jade firmware, wallet, or cryptography, and no security vulnerability is present in the commit.