TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Repository coverage

2655 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue1115AI analyses
342commits · 30 days
582commits · 60 days
1357commits · 180 days
2654commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1318Adequate · 60–79
859Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Andrew Kozlik702427266
Roman Zeyde571177231171
tychovrahe292104111161
PrisionMike945976173
Jakub Janků19915184
Martin Pastyřík2389173
cepetr1968282059
Ioan Bizău23076131059
obrusvit2137693064
M1nd3r2067181071
Lukas Bielesch846771067
Martin Milata1744647063
Analysis record

Published AI watches

Last scanned 51 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(ethereum): fix incorrect address checksum

This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…

2b1938ccby Tomas Martykan+52−523 files
No security note in commit
Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove scons related files

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…

a4b25c31by cepetr+5−927554 files
No security note in commit
Informational 22 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): assorted micropython-1.28.0 fixes

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…

Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
7ba7879dby Martin Milata+36−4012 files
No security note in commit
Informational 15 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_cstr

This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.

6a889e6aby Martin Milata+3−33 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace hexlify with bytes.hex()

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…

44aa469eby Martin Milata+1334−1383120 files
No security note in commit
Informational 18 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace m_new_obj_with_finaliser

This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…

No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
142794eaby Martin Milata+40−5619 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): bundle the utimeq module

This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…

617bc806by Martin Milata+284−2211 files
No security note in commit
Informational 17 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_vstr

This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…

Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
7ea11191by Martin Milata+72−7433 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): switch to slots-based mp_obj_type_t

This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…

ab51798fby Martin Milata+163−16624 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): bindgen wrapper for calling static micropython functions

This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…

d5121d92by Martin Milata+20−06 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): adjust mpy-cross paths

This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…

2ef70e16by Martin Milata+18−264 files
No security note in commit
Low 30 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): collect micropython GC root pointers

This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…

GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
fc128f3dby Martin Milata+75−107 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedrefactor(core/ethereum): handle staking/yielding in `confirm_tx_data()`by Roman Zeyde · 6c158b50 · Jul 15, 2026 · 4 filesMessage 85 · StrongLow 27Details
Commit message · Roman Zeyde

refactor(core/ethereum): handle staking/yielding in `confirm_tx_data()`

This way, we don't need to call `get_progress_indicator()`,
since all the data has been already loaded and hashed.

[no changelog]

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This is an internal code cleanup in Trezor's Ethereum transaction signing. It changes how staking and yield-farming transactions hand off their user-confirmation step so the confirmation happens inside the same routine instead of being returned as a separate progress indicator. The commit message says the goal is to avoid needing a progress indicator because all transaction data is already loaded and hashed. There is no direct evidence in the commit of a security bug being fixed, but the change touches the code that decides what users see before they approve high-value operations like staking and vault deposits/withdrawals. The large set of updated UI test hashes shows the on-screen flow changed, which is expected for a refactor of this kind.

Lower-priorityrefactor(core): no need to check `LayoutObj.request_complete_repaint` resultby Roman Zeyde · 8a449f05 · Jul 15, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde

refactor(core): no need to check `LayoutObj.request_complete_repaint` result

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefeat(crypto): test AES-GCM, AES-CCM, HMAC and PBKDF2 against wycheproof vectorsby Ondřej Vejpustek · 6bee661b · Jul 15, 2026 · 1 fileMessage 72 · AdequateInformational 12Details
Commit message · Ondřej Vejpustek

feat(crypto): test AES-GCM, AES-CCM, HMAC and PBKDF2 against wycheproof vectors

[no changelog]

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 12/100

This commit only adds and improves test code. It extends an existing test suite to check more cryptographic algorithms (AES-GCM, AES-CCM, HMAC, PBKDF2) using well-known public test vectors from Project Wycheproof. It also fixes a few small helper functions in the test file so they correctly report failures. There is no change to the actual Trezor firmware or its cryptographic library, so this commit does not introduce or fix a security vulnerability in the product itself.

Security candidatechore(crypto): update wycheproof submoduleby Ondřej Vejpustek · a56f7418 · Jul 15, 2026 · 2 filesMessage 57 · ThinInformational 15Details
Commit message · Ondřej Vejpustek

chore(crypto): update wycheproof submodule

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only updates the project's cryptographic test suite to match a newer version of the Wycheproof test-vector submodule. It changes test data file names and field names (for example, 'keyDer' to 'publicKeyDer') and adds a safety check for empty padding data in a test helper. None of these changes affect the actual Trezor firmware code that users rely on for security.

Security candidatefix(crypto): forbid zero-length IV in AES-GCMby Ondřej Vejpustek · e49753d6 · Jul 15, 2026 · 1 fileMessage 57 · ThinLow 44Details
Commit message · Ondřej Vejpustek

fix(crypto): forbid zero-length IV in AES-GCM

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 44/100

This commit tightens validation in the hardware wallet's AES-GCM encryption code by rejecting initialization vectors (IVs) of length zero. Previously, a zero-length IV was silently accepted, which violates the NIST standard and can lead to weak or broken encryption. The change also makes the higher-level encrypt/decrypt functions properly report this error instead of ignoring it.

Security candidatefeat(crypto): test low-order points on curve25519by Ondřej Vejpustek · 1320b2b0 · Jul 15, 2026 · 1 fileMessage 67 · AdequateInformational 12Details
Commit message · Ondřej Vejpustek

feat(crypto): test low-order points on curve25519

[no changelog]

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 12/100

This commit only adds a new test to the Trezor firmware crypto test suite. It checks that multiplying certain special 'low-order' points on the Curve25519 curve by various secret scalars always produces an all-zero result. There is no change to the actual cryptographic code being tested, only a new regression test. By itself, this commit does not fix or introduce a security vulnerability.

Lower-prioritystyle: exclude wycheproof submodule from pystyle checkby Ondřej Vejpustek · df89d627 · Jul 15, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Ondřej Vejpustek

style: exclude wycheproof submodule from pystyle check

[no changelog]

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedfix(stellar): properly bound string lengthby Jakub Janků · 888aa308 · Jul 15, 2026 · 3 filesMessage 88 · StrongModerate 60Details
Commit message · Jakub Janků

fix(stellar): properly bound string length

Currently, the length of all bounded strings is checked using
len(str). This returns the number of Unicode code points. However,
the XDR spec defines string object<m> as a sequence of at most m
bytes, see https://datatracker.ietf.org/doc/html/rfc4506#section-4.11.
A single Unicode code point can consist of multiple bytes.

[no changelog]

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 60/100

This commit fixes a length-check bug in Trezor's Stellar cryptocurrency support. The device was measuring string length in characters (Unicode code points) instead of bytes. Because some characters use multiple bytes, a string could pass the old check yet be too long for the Stellar protocol, potentially causing malformed transaction data or unexpected device behavior when signing.

Lower-priorityfix(core/bolt): do not use untranslated stringsby obrusvit · e6a8533a · Jul 15, 2026 · 2 filesMessage 72 · AdequateTriage 0Details
Commit message · obrusvit

fix(core/bolt): do not use untranslated strings

- use icon buttons of untranslated texts in Bolt set brightness dialog

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidatefeat(common): add EIP-7702 authorization signing protobuf definitionsby Nicolas Bacca · ad31c3aa · Jul 15, 2026 · 10 filesMessage 90 · StrongInformational 15Details
Commit message · Nicolas Bacca

feat(common): add EIP-7702 authorization signing protobuf definitions

Mark them as experimental for now.

[no changelog]

Co-authored-by: PrisionMike <su.sh2396@gmail.com>
Co-authored-by: Roman Zeyde <roman.zeyde@satoshilabs.com>

90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess controlboot or update path
AI analysis · Informational 15/100

This commit only adds new protocol buffer message definitions for an upcoming Ethereum feature (EIP-7702 authorization signing). It does not contain any actual signing logic, device firmware behavior, or user-interface code. It is a schema-only change and therefore does not introduce a security vulnerability by itself.

Lower-prioritychore(core): don't implement `Lerp` & `InvLerp` for 32-bit integersby Roman Zeyde · 163acb28 · Jul 15, 2026 · 1 fileMessage 77 · AdequateTriage 0Details
Commit message · Roman Zeyde

chore(core): don't implement `Lerp` & `InvLerp` for 32-bit integers

Since `f32::from()` doesn't support u32/i32.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritybuild(core): use `#![deny(clippy::cast_lossless)]`by Roman Zeyde · 825bd82e · Jul 15, 2026 · 2 filesMessage 77 · AdequateTriage 0Details
Commit message · Roman Zeyde

build(core): use `#![deny(clippy::cast_lossless)]`

Add an exception for `trezorhal.rs` auto-generated code.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidatestyle(core/rust): fix clippy::cast_lossless where possibleby Martin Milata · ab5c27ea · Jul 15, 2026 · 80 filesMessage 50 · ThinInformational 15Details
Commit message · Martin Milata

style(core/rust): fix clippy::cast_lossless where possible

[no changelog]

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This is a code-style cleanup commit in the Trezor firmware's Rust code. It replaces plain `as` type casts with explicit conversion methods like `u32::from(...)`, `i16::from(...)`, and `f32::from(...)` to satisfy the Rust Clippy lint `cast_lossless`. These changes do not alter program behavior; they only make the code clearer and avoid compiler warnings. There is no security fix or functional change here.

AI review queuedrefactor(core/rust): don't panic if Rust layout is unavailableby Roman Zeyde · 3c4c5ae1 · Jul 15, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · Roman Zeyde

refactor(core/rust): don't panic if Rust layout is unavailable

Following https://github.com/trezor/trezor-firmware/pull/7282,
let's raise `RuntimeError` if the layout has been dropped too early
(instead of panicking).

[no changelog]

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedrefactor(core/ethereum): rename and move keccak-related helper functionsby Roman Zeyde · dc2aadf6 · Jul 15, 2026 · 7 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

refactor(core/ethereum): rename and move keccak-related helper functions

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a clean internal code cleanup in the Ethereum app of the Trezor firmware. It moves the Keccak hashing helper to a shared location and updates callers to use it. There is no user-facing behavior change and no security fix.

Lower-priorityfix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build scriptby M1nd3r · 4e97e159 · Jul 14, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · M1nd3r

fix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build script

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedrefactor(core/ethereum): simplify `confirm_data_and_summary()`by Roman Zeyde · 814203e1 · Jul 14, 2026 · 2 filesMessage 77 · AdequateInformational 15Details
Commit message · Roman Zeyde

refactor(core/ethereum): simplify `confirm_data_and_summary()`

Note that `(confirm_data_chunk is None) == (confirm_summary is None)`.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a small internal code cleanup in Trezor's Ethereum transaction signing. It replaces two separate return values with a single tuple, because they are always either both present or both absent. There is no user-visible behavior change and no indication of a security fix.

Lower-priorityfix(core): Features.language_version_matches true even if build_version differsby Martin Milata · f1f9a372 · Jul 14, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata

fix(core): Features.language_version_matches true even if build_version differs

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefix(core): unify autolock duration formattingby Jakub Janků · 28197f4d · Jul 14, 2026 · 17 filesMessage 95 · StrongInformational 21Details
Commit message · Jakub Janků

fix(core): unify autolock duration formatting

format_duration_ms and format_autolock_duration implemented the same
unit-selection logic but disagreed above 24 hours: the ApplySettings
confirmation dialog formatted a 2-day delay as "48 hours" while the
device menu showed "2 days" for the same setting. The day tier was
added only to the device menu code (a57fc3f8ed) and never made it back
to the older helper.

To reproduce (T3W1): set a day-scale delay from the host, e.g.
`trezorctl set auto-lock-delay 48h` - the confirmation dialog reads
"48 hours" - then check Settings -> Security -> Auto-lock in the
device menu, which reads "2 days" for the same stored value.

Add the day tier to format_duration_ms, move the unit names inside it,
and drop format_autolock_duration entirely, so all call sites share
one implementation. Since the unit-name strings are not specific to
the auto-lock feature, rename plurals__lock_after_x_minutes to just
plurals__minutes etc., keeping their string IDs so existing
translation blobs remain compatible.

Also add the day tier to the click-test oracle in tests/click_tests,
which mirrored the day-less variant and would have mispredicted the
device menu contents for day-scale delays.

[no changelog]

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

95/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
boot or update path
AI analysis · Informational 21/100

This commit fixes a minor user-interface inconsistency in how the Trezor device displays auto-lock delays longer than a day. Previously, the confirmation dialog showed "48 hours" while the settings menu showed "2 days" for the same delay. The fix merges two similar formatting functions into one shared implementation so all screens use the same wording. It is a cosmetic bug fix, not a security vulnerability.

Security candidatetest(clear_signing): add Trezor Test descriptor and clear-signing testsby PrisionMike · dfe90892 · Jul 14, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · PrisionMike

test(clear_signing): add Trezor Test descriptor and clear-signing tests

- Add test descriptors.
- core tests.

[no changelog]

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only adds two new import names (DateFormatter and RawFormatter) to an existing Python file in the Ethereum clear-signing module. It is a test-related change with no functional code modifications, no bug fixes, and no security-sensitive behavior changes.

Security candidatefeat(clear_signing): ERC-7730 constant (const_value) display fieldsby PrisionMike · 9e593447 · Jul 14, 2026 · 7 filesMessage 85 · StrongLow 27Details
Commit message · PrisionMike

feat(clear_signing): ERC-7730 constant (const_value) display fields

- constant path (resolved by offline parser)
- renamed `hint` to `is_mono` in clear signing
[no changelog]

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 27/100

This commit adds a new way for Ethereum transaction definitions to include fixed text labels (called 'constant values') that are shown to the user during signing. It does not change how transaction data is parsed or signed, but it expands what untrusted display-format definitions can put on the device screen. The change is a feature addition, not a fix for a known bug, and there is no vendor statement that it is security-relevant.

Lower-prioritychore(tools): validate date format in changelogsby obrusvit · f48e3ade · Jul 14, 2026 · 1 fileMessage 72 · AdequateTriage 8Details
Commit message · obrusvit

chore(tools): validate date format in changelogs

- also drop empty subsections

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
defensive validation
Lower-prioritychore: unify date format in changelogsby obrusvit · 0705c17c · Jul 14, 2026 · 8 filesMessage 57 · ThinTriage 0Details
Commit message · obrusvit

chore: unify date format in changelogs

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritychore: trim model changelogs to what is relevantby obrusvit · 47251498 · Jul 14, 2026 · 7 filesMessage 57 · ThinTriage 0Details
Commit message · obrusvit

chore: trim model changelogs to what is relevant

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatechore(core): drop unused `trezorui_api.show_wait_text()`by Roman Zeyde · 46761b96 · Jul 14, 2026 · 12 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

chore(core): drop unused `trezorui_api.show_wait_text()`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit simply removes an unused on-screen message function called show_wait_text() from the Trezor firmware. There is no security fix or behavior change; it is a routine code cleanup.