Krux

This commit swaps the project's Python virtual-environment and dependency-lock tooling from Poetry to uv. It deletes the old Poetry lockfile (poetry.lock), updates pyproject.toml to use uv-compatible metadata, and adds a new uv lockfile (uv.lock). There is no change to application source code, runtime behavior, or installed dependencies, and nothing in the commit indicates a security fix or vulnerability.

This commit is a straightforward internal cleanup: it moves a repeated screen-rotation check into a single shared helper and makes that helper use its existing object instead of creating new temporary settings objects. There is no user-facing behavior change and no security relevance.

This is a straightforward internal code cleanup: it reads device settings once and reuses the result instead of reading them multiple times. The commit message and diff show no change in behavior, no bug fix, and no security relevance.

This commit tightens several 'catch-all' error handlers in the Krux firmware so they only catch the specific problems they intend to handle. Previously, these handlers would also swallow serious system-level signals such as KeyboardInterrupt and unexpected programming errors, which could hide bugs or prevent a user from cancelling an operation. The change is defensive hardening rather than a fix for a known active attack, but it removes a class of reliability and safety bugs.

This commit fixes bugs in how Krux reads and writes its saved settings. Previously, simply reading a setting could silently change the stored data, and a corrupted settings file (for example, one where a category was accidentally a word instead of a group) could crash the app or be misinterpreted. The patch makes reads truly read-only, repairs bad structure when writing, and only accepts known storage locations. It is a defensive hardening change rather than a fix for an active attack, but it removes several ways a tampered or damaged settings file could destabilize the device.

This commit simply adds a Spanish-language video tutorial link to the documentation page. It is a non-code change with no security relevance.

This commit is a documentation reorganization. It renames a templates page so it appears at a cleaner web address and updates internal links accordingly. There is no change to the Krux software, device firmware, or any security-sensitive code.

This commit hardens the Krux documentation website by removing all embedded third-party content (YouTube thumbnails, Google Fonts, gitmind.com iframes) and adding a browser-level Content-Security-Policy. The goal is to prevent attackers who compromise a third-party service (like a CDN) from injecting malicious code into visitors' browsers when they read the docs. It is a preventive security improvement, not a fix for an active vulnerability in Krux's hardware wallet firmware itself.

This change removes third-party web scripts (MathJax and require.js loaded from a content delivery network) from the project's documentation and replaces them with self-hosted, pre-rendered math images. That eliminates a supply-chain risk similar to the polyfill.io incident, where a compromised or malicious CDN could inject harmful code into documentation pages viewed by users or developers.

This commit removes a reference to polyfill.io from the project's documentation website configuration. Polyfill.io is a third-party JavaScript service that was used to make documentation pages work in older browsers. It became a security concern in 2024 when the polyfill.io domain was reported to have served malicious code to websites in some cases. Removing it reduces the risk that visitors to the Krux documentation site could be served malicious JavaScript by that external service. The change is defensive and does not by itself prove an attack occurred against Krux users.

This commit removes a reference to polyfill.io from the project's documentation website configuration. Polyfill.io was a widely used service that provides JavaScript code to help older browsers support modern web features. In 2024, the polyfill.io domain was acquired by a new operator and was reported to have served malicious code to some users through a supply-chain attack. Removing it reduces the risk that visitors to the documentation site could load untrusted or malicious JavaScript. However, this change only affects the documentation website, not the Krux device firmware or wallet software itself.

This commit is purely a maintenance change to the project's build and test setup. It expands the officially supported Python versions from only 3.12.3 to a range from 3.11.5 up to (but not including) 3.13, and updates the continuous integration (CI) tests to run against two specific versions: 3.11.5 and 3.12.13. There are no changes to application code, user-facing behavior, or security-sensitive logic.

This commit fixes a display bug in Krux, a Bitcoin hardware wallet tool. When showing QR codes in certain zoomed modes (line/region), a title text could overlap with on-screen index numbers, making the screen confusing. The fix simply hides the title in those modes. There is no direct evidence this is a security vulnerability.

This commit updates two bundled dependencies (Embit and MaixPy) to their latest versions. No source code diff is available, and the commit message describes it as a routine maintenance chore with no security claims.

This commit only adds a SECURITY.md file to the repository. It is a documentation-only change that tells people how to report security bugs. It does not change any code, fix any vulnerability, or introduce any security risk.

This commit is a routine rewrite of the project's CONTRIBUTING.md guide. It shortens instructions for contributors, fixes wording, and updates examples, but does not change any program code, build scripts, tests, or security behavior. There is no security issue here.

This commit only adds a CONTRIBUTING.md file to the repository. It is a documentation-only change that explains how people can contribute to the Krux firmware project. There are no code changes, no bug fixes, and no security-related modifications.

This commit only updates the project's CHANGELOG.md to document two prior dependency changes (an Embit library update and replacing a custom QR-code decoding library with k_quirc). It contains no code changes, no bug fixes, and no security claims.

This commit appears to be a routine maintenance update that bumps the MaixPy firmware submodule to a newer version and updates another component (uUC). The title describes it as a cleanup chore. No actual code changes are visible in the provided diff, and no security-related information is present in the commit message or materials.

This commit updates the build environment for the Krux project. It changes the Docker base image from an older Debian version (Bullseye with GCC 9.5.0) to a newer one (Bookworm with GCC 12) and updates the bundled 'embit' library. The commit message frames this as a routine maintenance chore needed to keep Python versions compatible. There is no indication in the commit itself that this fixes a security vulnerability.

This commit only adds translated text strings for two menu labels, 'Standard' and 'Vertical', used in the stackbit feature. It does not change any program logic, security checks, or data handling. There is no security relevance.

This commit only updates the project's CHANGELOG.md file to document a new vertical layout option for the Stackbit 1248 backup display. It adds three lines of text describing a user-facing feature. There are no code changes, no configuration changes, and no security-relevant modifications.

This commit only adds and updates automated tests for a backup-screen layout feature called Stackbit. It does not change any production code, so it cannot introduce a security vulnerability or fix one.

This commit adds new on-screen backup layout options for a Bitcoin hardware wallet feature called Stackbit 1248. It only changes how the wallet's seed phrase is drawn on the device display so users can physically punch it into a metal backup card. There is no security vulnerability visible in the change.

This commit only adds documentation screenshots and text describing a vertical layout for the Stackbit 1248 metal backup format. It also updates a simulator script used to capture those screenshots. There is no code change that affects security.