Trezor firmware

This commit refactors how the Trezor firmware selects a backup handler when creating or restoring a wallet backup. Previously the device always used a display-based backup handler. Now it accepts a 'method' parameter from the host and routes to the appropriate handler, with only display-based backup implemented today and a placeholder for a future method. There is no direct security fix here; it is a feature/refactoring commit that adds a TODO for user prompting when no method is specified.

This commit is a straightforward internal code reorganization (refactor) for how the Trezor device displays wallet backup instructions. It introduces a 'BackupHandler' abstraction so that different backup methods can reuse the same display logic. There is no change to security behavior, no bug fix, and no indication of a vulnerability.

This is a small internal cleanup in the Trezor firmware's backup setup screens. It removes an unnecessary 'single_share' flag from a function and instead decides which text to show based on whether a word count is provided. There is no visible security change.

This commit is a straightforward internal code cleanup in the Trezor firmware's recovery flow. It moves display-related logic into a new helper class without changing what the recovery process actually does or how it protects user data. There is no indication this fixes or introduces a security problem.

This commit is a code cleanup (refactor) of the wallet recovery flow in Trezor firmware. It moves the recovery loop into a new helper function and changes how the SLIP-39 recovery state is represented internally. There is no indication in the commit that this fixes a security bug or changes security behavior.

This is a routine automated dependency update by Dependabot. It bumps the Python 'requests' library used in an internal battery-testing tool from version 2.32.4 to 2.33.0. There is no indication in the commit or supplied references that this fixes a security issue, and the affected tool is not part of the Trezor firmware that runs on user devices.

This commit only changes how the Black code formatter is run during style checks. It adds a `--fast` flag to suppress a warning in local developer runs, while keeping the slower, stricter check in CI. There is no change to the actual Trezor firmware, wallet logic, or anything users interact with.

This commit changes only a single word inside a code comment, correcting the name of a function referenced in the comment text. No executable code, logic, or behavior was modified.

This commit is a straightforward internal code cleanup in the Trezor firmware's wallet recovery flow. It moves the responsibility for showing error screens from the layout code into the exception classes themselves, without changing what errors are detected or how the recovery process behaves. There is no indication this fixes a security bug or introduces a vulnerability.

This is a code cleanup (refactor) of the wallet recovery flow in Trezor firmware. It restructures how the device asks users to enter backup/recovery words and removes an unused helper function. There is no indication of a security fix or behavior change that would affect user funds or device security.

This commit is a straightforward code cleanup: it moves a confirmation screen that appears during wallet recovery from one file to another, so the same screen is still shown but in a more appropriate place. There is no security-relevant change.

This is a routine dependency update by an automated bot, bumping the Python 'ecdsa' library from version 0.16.1 to 0.19.2 in Trezor's firmware build tooling. The commit itself only changes version numbers and download hashes; it does not show any actual code fix or vulnerability. Dependency updates can sometimes include security fixes, but this commit does not say that is the reason, and no verified security references were provided.

This is a one-line change to Trezor's GitHub Actions CI workflow. It adjusts how the build system checks whether the Rust dependency lockfile (Cargo.lock) has changed. Previously it compared against the main branch; now it compares against the pull request's base branch (the branch the PR targets). This is a normal CI correctness fix and has no direct security relevance.

This is an automated dependency update by Dependabot that bumps the Python 'cryptography' library from version 46.0.5 to 46.0.6 in the project's lock file. The commit itself only changes package hashes and download URLs; it does not modify Trezor's own code. The 'cryptography' library is widely used for encryption and secure communications, so keeping it up to date is generally good security hygiene. However, the commit message does not say this update fixes any specific security problem, and no verified references were provided. Therefore, while dependency updates can address vulnerabilities, we cannot confirm from this commit alone that a particular security issue is being fixed.

This commit is a pure code-style cleanup in the Ethereum 'clear signing' module. It removes unnecessary extra parentheses around tuple unpacking assignments. There is no functional change, no security fix, and no behavior change to the hardware wallet's transaction handling.

This commit is purely a code-style cleanup triggered by an update to the Python formatter 'black'. It removes unnecessary parentheses around tuple unpacking and adjusts some string-literal formatting. There is no functional change and no security relevance.

This commit is a routine dependency update for a Python code-formatting tool called 'black' used during development. It only changes the project's lock file (uv.lock), which records exact package versions. There is no change to the Trezor firmware code that runs on the device, no mention of a security fix, and no indication this introduces a vulnerability.

This commit corrects a single-word typo in a code comment. The docstring said the function raises KeyError, but the actual code raises NoWireContext. There is no functional code change and no security impact.

This commit only adds a new automated test to the Trezor firmware test suite. The test checks that the host-side software correctly raises an error when it receives a tampered handshake response from a Trezor device during the THP (Trezor Host Protocol) handshake. It does not change any device firmware code, fix a bug, or introduce a security vulnerability.

This commit simply turns off very detailed internal debug logging in the Trezor hardware wallet's core firmware to make automated tests run faster. It does not change any security logic, encryption, or how the device protects secrets. The logging was already only present in debug builds and never exposed sensitive data in production firmware.

This commit updates a Rust helper library called heapless from version 0.8.0 to 0.9.2 inside the Trezor firmware. The change is described as a routine dependency update. The commit message points to the upstream changelog but no specific security issue is mentioned, and no independent security references were provided. The actual code change is just a version bump and a small import-path adjustment in a code-coverage module. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but dependency updates can sometimes include security fixes from upstream.

This is a minor build fix that makes a Bluetooth UI component only import LED-related code when the device actually has an RGB LED feature. It prevents compilation errors on devices without that hardware feature. There is no security issue here.

This commit only adds new user-facing text strings (labels like 'Deposit amount', 'Withdraw', 'Your address') for an upcoming Ethereum ERC-4626 vault feature. It also moves one existing word ('Deposit') from a Cardano-only string to a shared word list. There are no code logic changes, no security fixes, and no behavior changes in how the device handles transactions or private keys.

This commit changes the order in which Trezor's Python library tries different ways to connect to a hardware wallet, and switches from an unordered collection to an ordered list. The practical effect is that if newer direct connection methods (USB, Bluetooth, etc.) are unavailable, the library will fall back to the older 'bridge' method. This is a reliability/usability fix, not a clear security patch. There is no vendor statement that this fixes a security vulnerability.

This is a routine automated update by Dependabot that bumps the Python library cbor2 from version 5.8.0 to 5.9.0 in the project's lock file (uv.lock). Only hashes and download URLs for the package changed. There is no indication in the commit itself that this fixes or introduces a security problem. Without checking the upstream cbor2 release notes, we cannot say whether the new version addresses any vulnerabilities.