COLDCARD firmware

This update fixes a bug in the COLDCARD hardware wallet where a malicious or malformed Bitcoin transaction file (PSBT) could trick the device into using the wrong amount of money for a non-SegWit (legacy) input. Specifically, if the file only provided a lightweight 'witness UTXO' for a legacy input, the device would trust that amount. An attacker could lie about the amount, making the transaction look like it had a normal fee when it actually sent much more to the miner or another recipient. The fix rejects such files for legacy inputs, prefers the full previous transaction when both types are present, and suppresses fee calculation when a witness-only UTXO cannot be verified as genuinely SegWit.

This commit tightens input-length checks for commands that COLDCARD receives over its USB interface. Before the change, several commands would accept packets that were too short, too long, or internally inconsistent. That could let a malicious or buggy host computer read beyond intended memory boundaries, pass malformed data deeper into the firmware, or in some cases crash the device. The patch adds explicit length and bounds assertions for many USB commands and adds tests that confirm malformed packets are rejected.

This commit fixes a bug in the COLDCARD hardware wallet firmware that prevented signing of 1-of-1 multisignature transactions. The change also hardens how the wallet detects single-key P2SH-wrapped SegWit inputs so it no longer misclassifies them as multisig when extra unrelated key paths are present. The bug could cause legitimate transactions to fail, but the patch also reduces the chance that a malformed PSBT could trick the device into treating a simple single-key input as a multisig one.

This commit only changes test files in the COLDCARD firmware repository. It adds setup steps (like returning to the home screen before tests), updates menu navigation to match renamed menu items, and makes test assertions more flexible. There are no changes to the actual firmware or wallet code that users rely on, so this cannot directly affect device security.

This commit only touches test helper code in the COLDCARD firmware repository. It fixes small test issues: allowing PSBT parsing from string input, validating a setting name in a hobble-mode test, and correctly setting sequence numbers and fallback locktimes in fake transaction generators used by multisig and general transaction tests. There is no change to the actual firmware or wallet security logic.

This commit only updates the project's automated test harness to work with newer versions of Bitcoin Core (specifically version 30). It changes how tests detect Bitcoin Core's version, handle removed legacy wallet features, and adjust an expected test result about data size limits. There is no change to the COLDCARD firmware itself or to any code that runs on the device, so this has no security relevance for end users.

This commit only adds a thank-you credit to an upcoming release changelog. It does not change any source code, firmware behavior, or fix anything by itself. The actual bugfix it references (ignoring an unexpected 'bkpw' field in backups) was made in some earlier commit not shown here.

This update fixes a security flaw in how the COLDCARD wallet restores its settings from a backup file. Previously, a tampered backup could secretly set the password used for future backups, letting an attacker who later gets physical access predict or control backup encryption. The fix ignores that 'cached backup password' field during restore, so backups cannot smuggle in a chosen password.

This is an automated dependency update by Dependabot that bumps the Python 'requests' library used only in the project's testing environment from version 2.32.4 to 2.33.0. It changes one line in a test requirements file. There is no indication this affects the COLDCARD firmware itself or introduces a security issue.

This update fixes three small but real bugs in the COLDCARD's Notes & Passwords feature. The most important fix corrects a reversed menu setting: the 'Send Password' option was accidentally shown only when USB was disabled, and hidden when USB was enabled. It also prevents the device from storing a blank password as the special value 'None', which could crash the device later when sending a password. Finally, it stops a misleading 'Saving...' message from appearing after a failed import.

This commit only fixes spelling mistakes in comments and user-facing text strings across nine source files. There are no code logic changes, no security fixes, and no functional behavior differences.

This commit only updates the signed release manifest file (signatures.txt). It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware build files, then re-signs the file with a PGP signature. There is no source code change and no security fix or vulnerability present in the diff itself.

This commit only edits a README file in the hardware documentation folder. It reformats a list of spreadsheet filenames and updates a sentence from singular to plural. There are no code changes, no firmware changes, and no security-related content.

This commit simply adds public hardware documentation for the COLDCARD Mk5 (a schematic image and a bill-of-materials spreadsheet) and updates the README to list them. There is no code change, no firmware change, and nothing that alters security behavior.

This commit is a routine documentation and asset update announcing that the COLDCARD Mk5 hardware is now publicly supported. It updates the README to reference Mk5 images and wording, adds a changelog note that firmware 5.5.0 supports both Mk4 and Mk5, and replaces/adds simulator background images for the Mk5. There is no code change and no security-relevant behavior is modified.

This commit only edits release notes and changelogs. It moves completed feature and bugfix descriptions from an unpublished 'Next-ChangeLog' file into the published 'ChangeLog' and historic release notes, and resets the draft file to placeholder 'tbd' entries. No source code, firmware logic, or security behavior is changed.

This commit only updates the release signature file. It adds two new cryptographic hashes for recently built firmware files and refreshes the PGP signature that covers the file. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

This commit only updates the release signature file. It adds cryptographic hashes and a PGP signature for a new COLDCARD firmware release (version 1.4.0Q for the Q1 hardware model) and updates the hash for the Next-ChangeLog.md file. There are no code changes, bug fixes, or security patches in this commit.

This commit only updates placeholder release dates in a changelog file (from '2065-03-xx' to '2065-03-05'). It makes no code changes and has no security relevance.

This commit fixes a bug in the COLDCARD hardware wallet's WIF (Wallet Import Format) key import feature. Previously, if a user tried to import a file containing the same private key twice, the code could incorrectly count it as a duplicate of an already-saved key rather than as a duplicate within the import file itself. This could cause the import to fail with a misleading 'duplicate WIF(s)' error even when no keys were actually saved yet. The fix properly distinguishes between duplicates inside the import file and duplicates of already-stored keys. There is no direct evidence this is a security vulnerability—it's primarily a usability/robustness fix.

This commit adds a build-system step that creates an additional release file for factory programming. It does not change any firmware code, cryptographic checks, or user-facing behavior. There is no indication of a security vulnerability.

This commit makes only cosmetic changes to the COLDCARD firmware: it changes a screen title from 'WIF' to 'WIF Key' and adds a few blank lines for readability. There is no functional code change and no security impact.

This commit simply updates a date-based block-height threshold in the COLDCARD firmware from a November 2025 value to a March 2026 value. It appears to be a routine scheduling change for a feature tied to a specific Bitcoin block height, not a security fix in itself. There is no evidence in the commit of a vulnerability being patched.

This commit is purely a test-code reorganization. It moves existing WIF-store-related test cases from several scattered test files into a single dedicated test file (test_wif.py), updates test runner configuration, and removes duplicate imports. There is no change to the actual firmware or security-sensitive code.

This commit is a routine version and date bump for two auto-generated files. It updates copyright year, build date, firmware version number, and a corresponding timestamp constant used when the device writes files to a microSD card. There is no code logic change and no security relevance visible in the diff.