Trezor firmware

This commit only adds and reorganizes automated tests for the device-authentication feature on Trezor hardware wallets. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability or fix one in the shipped product. The changes make the test suite exercise both the Optiga and Tropic authentication flows, test chunking sizes, and verify that invalid requests are rejected with proper error messages.

This commit changes the Trezor hardware wallet so that a large secondary device-attestation proof (the MCU attestation) is only sent when the caller explicitly requests streaming support. The goal is to avoid sending one oversized response. It is a defensive hardening change rather than a fix for an active vulnerability, and the commit message does not claim it resolves a security issue.

This commit re-enables a security feature called 'MCU device attestation' for the T3W1 hardware wallet model. It is not a vulnerability fix; it restores a previously removed capability that lets the device cryptographically prove its microcontroller is genuine using a modern quantum-resistant signature scheme (ML-DSA-44).

This commit only changes the protocol definitions (the 'language' the Trezor device and apps use to talk to each other). It adds a new optional streaming mode for requesting device-authenticity proofs, so large proofs can be sent in smaller chunks instead of one big message. There is no actual device firmware logic shown here—only generated message bindings—so it is not a security fix or vulnerability by itself. It is a feature addition that could, in theory, introduce new attack surface once the corresponding firmware code is implemented, but that code is not present in this commit.

This commit adds a new optional 'streaming' mode for retrieving device authenticity proofs on Trezor hardware wallets. Instead of sending all attestation data (certificates and signatures) in one large message, the device can now send it in smaller chunks. This is intended to improve reliability over lossy transports like Bluetooth Low Energy. The old one-shot mode is kept for backward compatibility. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a reliability/feature improvement.

This is a tiny test-only change that adds a new optional keyword argument named 'wait' to a type definition used in Trezor's debug/testing tooling. It does not change any runtime behavior, device firmware, or security logic. There is no security issue here.

This commit is a pure code cleanup: it rewrites two small internal helper functions from Python generator style (`yield from`) to modern async/await style (`await`). The author verified that the compiled firmware bytecode is identical, meaning the device behaves exactly the same as before. There is no security-relevant change.

This commit is a build-system cleanup: it wraps a Trezor-Host Protocol (THP) credential confirmation screen so it is only compiled into firmware builds that actually have THP enabled. For non-THP builds, only the simpler non-THP confirmation is kept. There is no direct evidence in the commit that this fixes an active security bug; it appears to be a refactor to avoid including unused THP code in builds where the feature is disabled.

This commit simply restores a missing Python test dependency called pytest-retry. It only affects the project's testing environment and does not change any code that runs on the Trezor device or any production software. There is no security issue here.

This change only adjusts a test configuration file to silence a harmless deprecation warning coming from a third-party UI library called dominate. It does not modify any firmware, wallet, or security-related code, and there is no indication it fixes or hides a real security problem.

This commit only changes the wording of a test-result message in the project's internal testing tools. It splits one message into two so that missing expected test snapshots are labeled 'UI_MISSING' rather than 'UI_FAILED'. There is no change to the firmware, wallet behavior, cryptography, or any user-facing security feature.

This is a code cleanup (refactor) of the on-screen button drawing and touch/hold logic for the Trezor hardware wallet's Caesar UI layout. It removes unused style-sheet abstractions, simplifies how buttons are described, and makes the hold-to-confirm component always assume it sits on the right side of the screen. The commit is tagged [no changelog] and contains no explicit security claims. The only behavior-visible change is a small simplification in the page component: when the left button is triggered on the first page, it now always returns a Cancel message instead of first checking whether a cancel button was configured. That change is a simplification based on an existing invariant, not a fix for a known vulnerability.

This commit only changes test files so that ten unit tests are skipped when running against the Bitcoin-only firmware variant. It does not modify the actual Trezor firmware code that users run, so it cannot directly affect device security or user funds.

This commit adds support for a new Ripple transaction type called AccountDelete to Trezor hardware wallets. It is a feature addition, not a security patch. The change lets users sign transactions that delete a Ripple account and send any remaining balance to a chosen destination. The code adds user-facing confirmation screens and enforces that a transaction cannot be both a payment and an account deletion. There is no direct evidence in the commit of a security vulnerability, but any new signing path deserves careful review because bugs could let an attacker trick a user into deleting an account or signing an unintended transaction.

This commit adds emulator-only support for a new Trezor device (T3W1) to wake from a simulated low-power sleep state when the user taps the emulated touchscreen. It only affects the software emulator build, not real hardware, and does not change how secrets or user data are handled. There is no indication this is a security fix.

This commit adds a new device-information field called tap_to_wake to the Trezor's Features message, which is the normal response to GetFeatures. It also adds a matching Capability_TouchWakeup flag. The change only reports whether the device supports and has 'tap to wake' enabled; it does not change how the device wakes, how it authorizes transactions, or how secrets are handled. There is no security fix or vulnerability visible in the diff.

This commit corrects the wrong GPIO pin assignment for the interrupt line of the Tropic01 secure chip on Trezor T3W1 hardware revisions A, B, and C. Previously the interrupt pin was set to the same pin as the power-control line, which does not match the hardware schematic. The commit message says this interrupt pin has not been used so far, so the practical security impact appears low.

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It updates wording, adds missing translations, and removes obsolete translation keys across several language files. There are no code changes that affect security, cryptography, transaction signing, or device behavior.

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. It does not change any firmware, application, or security code. The hashes are used by automated UI tests to verify that screen outputs match expectations after translation-related changes. There is no indication of a security fix or vulnerability being addressed.

This commit removes automatic test retries from the Trezor hardware test suite. It is a cleanup change: the retries were a temporary workaround for flaky USB communication during automated testing, and the underlying flakiness was fixed in a separate pull request. There is no change to the firmware that runs on user devices and no security-relevant behavior is modified.

This commit simply changes release dates in seven changelog files from 14 May 2026 back to 21 May 2026. It is a reversion of an earlier date-change commit. There is no code change and no security relevance.

This commit only edits changelog text files. It rewrites some entries for grammar and consistency, removes a few empty section headers, and changes the labels of some internal releases. No source code, firmware logic, or security behavior is modified.

This commit simply adds firmware version 2.11.2 to a list of released versions in a JSON file. It is a routine metadata update with no code changes and no apparent security relevance.

This commit only changes release dates in seven changelog files, moving the stated release date from 21 May 2026 to 14 May 2026. No executable code, configuration, or security-related content is modified.

This commit replaces a binary file called secmon.bin for the T3W1 hardware model with a newly built version. The change is described as a routine update ('chore') and there is no description of any security fix or vulnerability. Because the file is a compiled binary, the actual code changes cannot be seen in the diff, so no security issue can be identified from the commit alone.