Trezor firmware

This commit removes the 'ipc' feature flag from three build scripts by default, and only enables it when external app loading is supported on the T3W1 model. IPC stands for inter-process communication, and these particular system calls were reportedly unused. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a cleanup or hardening change to reduce unused attack surface.

This commit only updates a GitHub Actions CI workflow file. It adds one extra step to initialize a code submodule (QR-Code-generator) before running automated style checks. There is no change to the actual Trezor firmware code, cryptography, or anything users interact with. It is a routine build/maintenance fix with no security relevance.

This commit rearranges how different pieces of the Trezor firmware are placed in the device's flash memory. It moves frozen Python data and the main code sections into one flash region, while moving the bootloader into a separate flash region. The stated purpose is to support linking Rust static libraries (rlib). There is no direct evidence in the commit that this fixes a security vulnerability.

This commit is a pure code reorganization: it moves the STM32-specific bootloader header, bootloader image, and update-control block (UCB) code from a shared directory into a hardware-specific 'stm32' subdirectory, and adds a minimal Unix emulator stub for UCB. The actual logic in the moved files is byte-for-byte identical to the original. No security behavior is changed, no bugs are fixed, and no vulnerabilities are introduced based on the supplied diff.

This commit removes a memory-protection setting that was being compiled into the Trezor's core kernel even though it was not supposed to be used there. The setting controls access to a special flash area called BOOTUCB, which is related to boot configuration. By making sure this MPU mode is only available outside the kernel, the change prevents the kernel from accidentally or maliciously reconfiguring memory protections to expose or alter sensitive boot-configuration storage. The actual risk is limited because the mode was described as unused in the kernel, and the patch is a one-line guard.

This commit simply updates internal file paths in developer and testing scripts so they point to a new build output directory. It does not change any code that runs on the Trezor device or handle user data, secrets, or network traffic. There is no security issue here.

This commit only updates expected test result fingerprints (hashes) in a UI test fixtures file for the T3W1 device model. No actual product code, firmware logic, or user-facing behavior was changed. It is a routine test-maintenance change with no security relevance.

This commit is a build-system refactor: it switches the Trezor Core firmware build from direct scons/Make invocations to a new wrapper tool called xtask. It also renames output directories and artifact filenames. There is no change to the actual firmware code, cryptographic logic, or device behavior, so it does not introduce or fix a security vulnerability on its own.

This commit is a routine cleanup of the GitHub Actions workflow that builds Trezor emulator releases. It removes unused matrix dimensions (like ASan variants), drops environment variables that were no longer needed, changes a default so the bootloader build step is skipped unless explicitly requested, and passes the device model into the build command. There is no change to the firmware code that runs on user devices, no fix for a vulnerability, and no security-relevant behavior change.

This is a massive Trezor firmware commit that replaces the old SCons-based build system with Cargo (Rust's build tool) for compiling the embedded C code. It adds many new Cargo.toml files, build.rs scripts, and a custom xbuild helper crate, but does not change the actual security logic of the wallet. The main risk is that a build-system change of this size could accidentally alter compiler flags, included source files, or linker settings, which might affect the produced binary. There is no direct vulnerability shown in the diff, and the commit message explicitly says it is a feature with no changelog entry.

This commit fixes a missing initialization step in the Trezor hardware wallet emulator (the software version used for testing/development, not the real device). The emulator now initializes the haptic driver when haptic feedback is enabled. This is a straightforward bug fix for a feature that was not being set up correctly in the emulator build. There is no direct security relevance visible in the commit.

This commit only reorders two C keywords in three places, changing 'const static' to 'static const'. This is a coding-style cleanup to silence compiler warnings and has no effect on what the code actually does or on security.

This commit renames a hardware configuration flag from USE_BACKUP_RAM to USE_BACKUP_DOMAIN_RETENTION and enables it for three Trezor T3W1 hardware revisions. It appears to be a code cleanup/refactor to make startup power-retention behavior match the actual hardware capability on these boards. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit updates a build script to look for compiled firmware files in a new directory path (`build-xtask/artifacts/...`) instead of the old path (`build/...`). It is a routine build-system path adjustment with no apparent security relevance.

This commit removes the full build directory path from the firmware binary by switching from __FILE__ to __FILE_NAME__ in two error-handling locations. The change reduces information leakage but does not fix a memory corruption or logic bug. It is a hardening/information-disclosure reduction patch, not a fix for an actively exploitable vulnerability.

This commit only adds comments explaining why the code does not overwrite SD card salt files with random data before deleting them. It changes no behavior, logic, or security controls. The documentation argues that overwriting is unnecessary because the encrypted data key stored inside the device is already wiped when the salt is changed, so an old recovered salt cannot decrypt anything.

This is a routine automated dependency update by Dependabot that bumps the urllib3 library from version 2.6.3 to 2.7.0 inside a small internal testing tool (automatic_battery_tester). The change is a single line in a requirements file. There is no indication in the commit that this fixes a security issue, and the tool is not part of the Trezor firmware that runs on user devices.

This is a routine build-environment cleanup. The developers removed an old copy of Nix packages (oldNixpkgs) used only for older SDL2 graphics libraries, because the project now uses SDL3. They added a compatibility package so old test emulators still work, and updated documentation and a download script to use a fuller Nix shell environment. There is no indication this changes any wallet, firmware, or cryptographic code, and no security relevance is claimed.

This commit only changes a test file so that a Decred signing test is skipped when the firmware is built in Bitcoin-only mode. It does not modify any production firmware code, wallet behavior, or cryptographic logic. There is no security issue here.

This commit only changes how long hexadecimal fingerprints and hashes are displayed to users. It inserts spaces every four characters so the strings are easier to read and compare visually. There is no change to security logic, cryptography, or how firmware is verified.

This commit only adds a new test case for Solana message signing with 64 cosigners and updates the expected screen snapshots used by automated testing. It does not change any firmware code that runs on the Trezor device, so it cannot introduce a security vulnerability or fix one.

This is a minor GitHub workflow change that stops an automatic pull-request assignment job from running when the pull request is opened by a bot account (whose username ends with '[bot]'). It has no security relevance to the Trezor firmware itself or to user funds.

This commit only updates documentation links inside the Trezor firmware repository. It fixes broken links, replaces GitHub URLs with relative links, and removes a symlinked documentation file. There are no code changes and no security impact.

This commit only changes the automated message used when the project pulls translation updates from Crowdin. It adds a '[no changelog]' tag so the translation sync does not appear in release notes. There is no security relevance.

This is a routine GitHub workflow change for managing translation updates. It removes a restriction that previously allowed the workflow to run only from the 'main' branch, and it makes the automatically created pull request a draft instead of a normal one. There is no security relevance in the code change itself.