Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…
This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…
Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…
This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…
Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…
This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…
Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
This commit is a large but purely mechanical code cleanup: it replaces the custom STATIC macro with the standard C keyword static across many MicroPython module files. There is no change to program logic, security boundaries, or behavior. …
This commit is a routine code cleanup that updates Trezor firmware to match a newer MicroPython version where built-in module names dropped the 'u' prefix (for example, 'uos' became 'os' and 'ustruct' became 'struct'). It renames imports, …
This commit only updates the firmware version number from 2.12.4 to 2.12.5 in the source code and translation files. It does not change any security-related logic, fix any bug, or alter any cryptographic behavior. It is a routine release b…
This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There…
This commit is a large but straightforward internal refactoring: the cryptographic code is moved from one Rust crate (`rtl`) into a new dedicated crate (`crypto`), and all project dependencies are updated to point to the new crate. The act…
No security-relevant code changes detectedRefactoring only: moving existing crypto wrappers and build logic into a new crateFeature flags and C source lists preserved from the original `rtl` crate
This commit is a code cleanup that moves how Trezor firmware handles fatal errors and shutdowns between its internal software layers. It does not add new user-facing features or change security protections. The main risk is that reorganizi…
Refactor of fatal-error and shutdown code pathsNew noreturn annotations on systask_exit, systask_exit_error, systask_exit_fatal, systask_killRemoval of duplicated test-only system_exit_error/system_exit_fatal implementations
This commit changes a single on-screen label in the Trezor bootloader from lowercase 'Change fw vendor' to uppercase 'Change FW vendor'. It is purely a cosmetic wording fix with no security relevance.
This commit adds support in Trezor's Ethereum clear-signing feature for transactions that contain multiple embedded subcalls (like a multicall). Previously, only a single embedded call could be clearly displayed. The change lets the device…
New input validation added: callee array length must match subcall array lengthType validation enforced: each subcall blob must be bytes, each callee must be a 20-byte addressGraceful degradation preserved: unparseable subcalls fall back to raw hex display rather than failing the whole transaction
This commit only adds new automated tests for Trezor's Ethereum 'clear signing' feature. It includes a test case for an Aave multi-call transaction, a matching test data blob, and expected screen snapshots for different device models and l…
This commit fixes a user-interface bug in Trezor's Ethereum 'clear signing' flow where the transaction's native ETH amount could be shown twice on the device screen. The old code tried to avoid duplication by checking whether an 'AmountFor…
No cryptographic, authorization, memory-safety, or input-validation changesChange is limited to on-screen display deduplication logicNo changelog entry requested by the vendor ('[no changelog]')
This commit adds a new display formatter for Ethereum clear signing. It lets a transaction descriptor map numeric enum values (like 1 or 2) to human-readable labels (like 'stable' or 'variable') on the Trezor screen. The change is purely a…
New formatter raises InvalidFormatDefinition on unexpected/missing enum values, causing fallback to blind signing rather than displaying an untrusted labelDuplicate enum keys are rejected at descriptor decode timeNon-integer enum values are rejected at format time
This commit only adds a new automated test case for an existing Ethereum transaction display feature. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. It is purely a test-data add…
This commit adds a new Trezor firmware feature called 'clear signing' for nested Ethereum calls. It lets the device understand when a transaction wraps another contract call (like a router or multicall) and tries to show the user readable …
New nested calldata parsing path with explicit depth cap of 1@.to override to callee to prevent token resolution from pointing at the wrapper contract@.from and @.value rejected in nested parse to avoid displaying confidently wrong sender/value
This commit is a test-only addition for Trezor's Ethereum 'clear signing' feature. It adds new test cases and makes a small production-code tweak so that enum display-formatters can accept byte values (converted to integers). The change is…
Production code change is a type-handling relaxation in display formatting onlyNo changelog entry; commit is explicitly test-focusedNo vendor security disclosure or advisory referenced
feat(core/rust): coerce empty slices to null FatPtrs
to avoid problems with C interop checking pointer validity separately from len
89/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode
Lower-priorityrefactor(core/rust): use FatPtr in rust syslog bindingby matejcik · 178950a9 · Aug 3, 2026 · 1 fileMessage 77 · AdequateTriage 0Details
Commit message · matejcik
refactor(core/rust): use FatPtr in rust syslog binding
taking advantage of the new zero-length-slice feature
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
fix(rust/trezor-thp): channel desync after incorrect ACK
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritytest(rust/trezor-thp): do not retransmit before whole message is sentby Martin Milata · c822c5ac · Jul 31, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Martin Milata
test(rust/trezor-thp): do not retransmit before whole message is sent
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix(rust/trezor-thp): do not retransmit before whole message is sentby Martin Milata · f4962a95 · Jul 31, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata
fix(rust/trezor-thp): do not retransmit before whole message is sent
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix(core): THP write timeout for single packetby Martin Milata · cac8b637 · Jul 31, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Martin Milata
fix(core): THP write timeout for single packet
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100
This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There is no indication in the commit that this fixes a security bug; it appears to be a feature addition enabling BLE functionality on a new device variant.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
Security candidatefeat(core/rust): separate trezor-crypto to its own Rust crateby matejcik · 836142c7 · Jul 31, 2026 · 39 filesMessage 62 · AdequateInformational 15Details
Commit message · matejcik
feat(core/rust): separate trezor-crypto to its own Rust crate
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100
This commit is a large but straightforward internal refactoring: the cryptographic code is moved from one Rust crate (`rtl`) into a new dedicated crate (`crypto`), and all project dependencies are updated to point to the new crate. The actual cryptographic algorithms, build flags, and source files remain the same. There is no indication of a security bug fix or a vulnerability being introduced.
AI review queuedfeat(core/sys): expose syslog as a Rust moduleby matejcik · bddf05ee · Jul 31, 2026 · 11 filesMessage 72 · AdequateTriage 0Details
Commit message · matejcik
feat(core/sys): expose syslog as a Rust module
and rewrite trezor_lib to use it as a dependency
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
in rtl: * provide headers for error_shutdown and __fatal_error (and variants) * implement all except error_shutdown_ex_n and __fatal_error_n * if feature error_shims is activated (dependency of test), also error_shutdown_ex_n and __fatal_error_n are implemented via unix calls
in crypto: * implement tc_fault_handler by delegating to error_shutdown
in sys: * add error_handling.c, which provides global implementations of error_shutdown_ex_n and __fatal_error_n by delegating to system_exit_error/fatal
in conclusion: the error failure functions are forward-declared in rtl, and waiting for _someone_ to provide an implementation at link time
90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 17/100
This commit is a code cleanup that moves how Trezor firmware handles fatal errors and shutdowns between its internal software layers. It does not add new user-facing features or change security protections. The main risk is that reorganizing low-level error paths could accidentally introduce a bug, but the diff itself does not show a vulnerability being fixed or introduced.
Lower-prioritybuild(xbuild): output Rust binding file even if no bindings were specifiedby matejcik · 3675b1da · Jul 31, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · matejcik
build(xbuild): output Rust binding file even if no bindings were specified
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityci!(core): run tests via xtaskby matejcik · e1699fae · Jul 31, 2026 · 2 filesMessage 70 · AdequateTriage 0Details
Commit message · matejcik
ci!(core): run tests via xtask
this disables unit tests for Rust code! will be re-enabled in a followup PR but they don't run until then
70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification