Krux

This commit is a documentation and screenshot update for a feature called Mnemonic XOR. It rewrites user-facing help pages, adds new images, and updates simulator test scripts so the feature is documented and visually shown. There are no code changes that affect security, and nothing in the commit fixes or introduces a vulnerability.

This commit updates the Pylint static-analysis tool from version 3 to version 4 and makes a small, matching cleanup in the project's internationalization helper script. It does not change any user-facing security behavior, fix a vulnerability, or alter how the application handles secrets, keys, or untrusted data.

This commit is a routine maintenance update for the project's Python linting tool (pylint) and its dependency lock file. It changes configuration settings to match a newer pylint version and records updated package versions. There is no change to the actual application code that users interact with, and nothing in the commit suggests a security fix or vulnerability.

This commit simply bumps the project's beta version number from 25.10.beta0 to 25.10.beta1 in four files. It also removes two harmless code comments about touch settings. There are no functional code changes and no security implications.

This commit adds a new 'Mnemonic XOR' (SeedXOR) feature to Krux, a Bitcoin hardware wallet. It lets users combine two seed phrases using a mathematical XOR operation to create a new seed, or split an existing seed into two parts. The code also refactors existing mnemonic-loading code into a shared base class. There is no indication this is a security fix; it is a new feature implementation.

This commit only adds a new hardware board ('wonder_k') to the project's test suite. It introduces mock definitions, test fixtures, and expected test outputs for the new board. There are no changes to the actual application code that users run, and nothing in the commit fixes or introduces a security vulnerability.

This commit only adds and updates unit tests for encryption code. It does not change any production code that users run. The tests verify that an existing encryption helper (kef) can still create and decode encrypted QR codes in ECB, CBC, CTR, and GCM modes after a previous cleanup removed a wrapper class. There is no security vulnerability here.

This commit updates a submodule called MaixPy with a one-line change described as 'SPIFFS load and save cleanup.' No actual code diff is available, and there are no verified references indicating this fixes or introduces a security problem. Based solely on the provided materials, nothing can be determined about security impact.

This commit adds a development tool called Vulture that finds unused ('dead') code and removes the dead code it detected. It is a routine code-cleanup change, not a security fix or vulnerability patch. There is no indication it introduces a security issue or addresses one.

This commit simply deletes an unused internal helper method called _encrypted_qr_code from the login page code. There is no functional change to the app, no bug fix, and no security-relevant behavior altered. It is routine code cleanup.

This commit improves a file-viewing tool in Krux (a Bitcoin hardware-wallet firmware) so it no longer crashes when opening large files. It adds memory cleanup, caps expensive encoding checks to small samples, and shows a user-friendly error if a format conversion fails. There is no direct evidence this fixes a security vulnerability; it appears to be a robustness and user-experience improvement.

This commit fixes a timing issue in how Krux detects whether the device has a battery. Previously, the battery check ran too early during power manager setup, before the analog-to-digital converter (ADC) had stabilized, which could cause the device to incorrectly decide it had no battery. The fix moves the check later, to the login screen, giving the ADC time to read the battery voltage correctly. The only visible effect is whether a 'Shutdown' menu item appears. There is no direct security vulnerability here; it is a reliability/usability bug fix.

This commit restores the ability to swipe up or down to exit a QR code display screen in the Krux hardware wallet. Previously, those same up/down swipes were being used to cycle through display modes, which accidentally trapped the user on the screen. There is no security issue here; it is a straightforward user-interface bug fix.

This commit is a routine user-interface cleanup. It centralizes how 'fast-forward' and 'fast-backward' button-hold navigation works across keypads, menus, QR transcribe, and seed editors. It also adds swipe gestures in more places and tweaks how the Yahboom device's extra page button behaves. There is no indication it fixes a security vulnerability or introduces a clear one.

This commit is a user-interface polish change for the Krux hardware wallet's 'Datum' tool. It splits a single translated label like 'binary: 123 bytes' into two parts ('binary:' and '123 bytes') so the device can highlight the label prefix differently in an on-screen info box. It also moves a content preview into the same info box. There is no security bug being fixed here.

This commit is a documentation and testing-only change for Krux's encrypted backup format (KEF). It adds unit tests and clarifies in the specification that compression must use a very specific deflate window size (wbits=-10). The change itself does not alter any production encryption or compression code; it only makes the existing requirement stricter to document and proves with tests why that exact setting matters. There is no direct security vulnerability being patched here, but it guards against a future interoperability or data-recovery failure if an implementer used a larger compression window.

This commit is a routine changelog update describing improved SD card support in Krux. The actual code change in the MaixPy submodule is not shown in the supplied diff, so no security issue can be identified from the materials provided.

This commit removes the 'Reboot' button from the device's Login screen on models that have no battery. It also hides the empty status bar on the Login menu when there is no wallet loaded and no battery. The change is a user-interface cleanup, not a fix for an exploitable security flaw. It slightly reduces the chance a user accidentally reboots instead of shutting down on a battery-less device, which could matter for secure erase assumptions on some hardware.

This commit is a code cleanup that centralizes touchscreen checks across the Krux firmware. It replaces scattered checks of `self.ctx.input.touch is not None` with a single flag `kboard.has_touchscreen`, and allows touch settings to remain accessible even when the touch input object is temporarily disabled. There is no direct evidence in the commit of a security vulnerability being fixed, but the change touches input-handling logic and could affect behavior if the flag gets out of sync with the actual touch object state.

This commit simply deletes three unused or deprecated files: a Vagrant virtual-machine configuration, a font-build helper script, and the README section that described the deprecated script. There is no change to the actual Krux firmware, wallet logic, or security-sensitive code, so it does not introduce or fix a security vulnerability.

This commit is a straightforward code cleanup in the password-strength meter. It replaces four separate scans over the password with a single loop and adds an early-exit optimization once all four character categories have been found. The actual strength rules (minimum length of 8 and presence of uppercase, lowercase, digit, and special characters) are unchanged. There is no security bug being fixed here.

This commit only updates the changelog and installation documentation. It does not change any executable code, cryptographic parameters, or security behavior. The changelog mentions a prior deflate decompression window-size change (wbits=10) to match a specification, but the actual code change is not present in this diff. The documentation change simply corrects the example device folder name used with a flashing tool.

This commit changes a single setting (wbits from an unknown value to 10) in the MaixPy firmware's deflateIO decompression code. The wbits parameter controls the size of the compression window. Without seeing the actual diff or any vendor explanation, we cannot tell whether this fixes a security bug, improves compatibility, or is just a tuning change. The change is too small and lacks context to confidently classify as a security fix.

This commit adds a new touchscreen diagnostic tool under Tools > Device Tests and fixes a simulator crash on some computers. It also moves the definition of the PRESSED constant from the input module to a new buttons module across several files. There is no obvious security vulnerability in the changes; it reads mainly as a feature addition and minor code cleanup.

This commit only updates the project's documentation website. It adds a visual play button overlay on YouTube video thumbnails and adds a new 'Chinese' section with two Chinese-language tutorial videos. There is no change to the Krux application, wallet firmware, build system, or any executable code.