COLDCARD firmware

This commit simply increments an automatically-generated Bitcoin block height constant by one. It is a routine data update with no code changes and no security implications.

This commit simply updates a stored Bitcoin blockchain height number from 963,074 to 963,190, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

This commit only updates a linked external code submodule (ckcc-protocol) to a newer version. The actual code changes are not shown in this diff, only the submodule pointer was moved. There is no information in the commit itself about what changed in the submodule or whether it has any security relevance.

This commit changes how COLDCARD handles multisig wallet names. Previously, re-importing a wallet file or descriptor with a different name would silently rename the existing wallet. Now, renaming must be done through an explicit 'Rename' menu action, and re-importing a duplicate with a different name is rejected. This is a security-hardening UX change that prevents accidental or malicious wallet renaming during import, which could confuse users about which wallet they are signing for.

This commit only edits the project's 'Next-ChangeLog.md' file. It rewrites upcoming release notes, adds details, fixes wording, and updates release dates. No actual firmware code, build scripts, or security behavior changed in this commit. The changelog text does describe many security fixes, but those fixes are already present in other commits; this commit merely documents them.

This commit simply updates a stored Bitcoin blockchain height number from 960,398 to 963,074, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

This commit only changes test code for the COLDCARD firmware. It makes the test suite more stable by letting developers specify a custom Bitcoin daemon path, adding a PSBT2 test flag, fixing a test that checks upload-during-approval behavior, and importing an extra constant for user-interface tests. None of these changes affect the actual firmware that runs on the device, so there is no security risk to users.

This commit only edits the wording of an upcoming release changelog. It does not change any firmware code, cryptographic algorithms, or security behavior. The edits clarify and reorganize descriptions of previously planned entropy-generation improvements, but they do not themselves introduce or fix any vulnerability.

This commit fixes a bug in the COLDCARD firmware signing tools and headers. Previously, the maximum allowed firmware size for Mk4/Q1 devices was set too large: it did not account for a 512 KB filesystem region and a small DFU wrapper block at the end of flash. As a result, a firmware image could be signed and accepted even though part of it would extend beyond the region protected by the device's 'world checksum' integrity check. The patch shrinks the official maximum firmware length so that the entire image stays within the integrity-checked region. The changelog explicitly calls this a bugfix that 'reject[s] firmware images that extend past the world-checksum-covered flash region.'

This update changes the Coldcard wallet cloning process so that the receiving device now displays the restored seed's master fingerprint and asks the user to confirm it before installing. Previously, the clone process skipped this confirmation step. The change helps prevent a user from accidentally accepting a different seed than intended during a clone, which could lead to backing up or using the wrong wallet.

This commit only changes automated test files for the COLDCARD hardware wallet firmware. It adds small delays, extra button presses, and adjusts test parameters to make the test suite run more reliably. There are no changes to the actual firmware code that runs on the device, so this cannot affect real users or introduce security vulnerabilities.

This commit fixes a bug in the COLDCARD password-notes feature. Previously, the 'Send Password' menu option was accidentally hidden when USB was disabled, because the code reused a setting meant for something else. The fix removes that wrong condition so the option always appears. This is a usability bugfix, not a security vulnerability: it restores intended access rather than opening an unintended one.

This commit fixes a simulator-only bug in the COLDCARD firmware's development/test tooling. A special code path that simulates the secure element's 'greenlight' LED signal was writing one byte to an internal pipe instead of the expected two bytes. That single-byte write shifted all later messages out of alignment, eventually causing the simulator to crash with a Python unpacking error. The fix changes that one write to two bytes and adds a regression test to catch similar mistakes. It does not affect real COLDCARD hardware or user funds.

This commit only updates documentation. It clarifies that a BIP39 passphrase wallet backup stores an extended private key (XPRV) rather than the seed words or passphrase, and adds version numbers for older firmware behavior. There is no code change and no security fix or vulnerability introduced.

This commit is a minor formatting edit to the README.md file. It changes a 'Security Advisory' heading from being displayed as a code block (with diff-style coloring) to a normal Markdown heading, and adds a horizontal rule. There are no code changes, no new security claims beyond what was already present, and no functional impact on the COLDCARD firmware.

This commit adds a security advisory to the COLDCARD firmware README. Coinkite states that firmware releases from 2021 through July 2026 contained a bug that produced weak randomness (poor entropy) when generating secrets such as wallet seed phrases. Because weak randomness can make private keys guessable by attackers, any Bitcoin or other cryptocurrency funds protected by seeds created on affected COLDCARD devices during that period may be at risk of theft. The advisory recommends regenerating seeds and moving funds immediately, and lists specific firmware versions where the issue is fixed. The commit itself only changes documentation; it does not contain the actual code fix.

This update changes the COLDCARD hardware wallet so that it refuses to sign Bitcoin transactions using the SIGHASH_SINGLE signature mode unless the user has explicitly enabled a 'Warn' setting. SIGHASH_SINGLE lets a signer lock in only one output while leaving other outputs changeable later. That could allow someone to alter where remaining funds go after the COLDCARD has already signed. The change adds SIGHASH_SINGLE to the existing safety check that already blocked SIGHASH_NONE, and it includes a test to confirm the block works.

This commit only updates the release signature file. It adds two new firmware file hashes for recently built releases and refreshes the PGP signature that covers the file. There is no code change and no indication of a security fix or vulnerability.

This commit only updates a signed release manifest file (signatures.txt). It refreshes cryptographic hashes for release notes and adds a new firmware file entry, then re-signs the file with PGP. There is no code change and no security vulnerability is present in the diff.

This commit updates Coldcard's release notes to announce that a previously disclosed limited-entropy bug in seed generation now also affects Mk3 hardware, and that a new Mk3 firmware version 4.2.0 has been released as a hotfix. The earlier notes told Mk3 users to stop generating seeds and move funds; the revised notes say Mk3 users can safely generate seeds again after installing 4.2.0. Seeds created before this fix may have only about 40 bits of randomness, making them far weaker than intended and potentially guessable by attackers.

This commit simply updates a hardcoded Bitcoin blockchain height number in a file that is automatically generated. There is no security issue here.

This commit only updates the release signature file. It adds two new file hashes for a COLDCARD Mk firmware release and refreshes the PGP signature that covers the file. There is no code change, no bug fix, and no security patch in the diff itself.

This commit simply updates a hardcoded Bitcoin block height number in a single file by one block, along with its timestamp. There is no code logic change and no apparent security relevance.

This commit only updates a signed release manifest file (signatures.txt). It records new cryptographic hashes for firmware release files and their PGP signature. There is no code change, no bug fix, and no security patch in the commit itself.

This commit simply updates a recorded Bitcoin block height number in a generated file, moving it from block 960,344 to 960,347. There is no code logic change, no user-facing behavior change, and no security relevance.