TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Repository coverage

2650 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

915security candidates307second-pass queue633AI analyses
338commits · 30 days
577commits · 60 days
1352commits · 180 days
2649commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
470Strong · 80–100
1316Adequate · 60–79
859Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Jakub Janků1999184
Martin Pastyřík2387173
Roman Zeyde566176126071
tychovrahe29210464061
cepetr1968238059
Ioan Bizău2307652059
obrusvit2137633064
M1nd3r2067160071
Lukas Bielesch846741067
PrisionMike945954073
Martin Milata1744639063
Ondřej Vejpustek953429060
Analysis record

Published AI watches

Last scanned 56 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(ethereum): fix incorrect address checksum

This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…

2b1938ccby Tomas Martykan+52−523 files
No security note in commit
Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove scons related files

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…

a4b25c31by cepetr+5−927554 files
No security note in commit
Informational 22 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): assorted micropython-1.28.0 fixes

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…

Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
7ba7879dby Martin Milata+36−4012 files
No security note in commit
Informational 15 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_cstr

This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.

6a889e6aby Martin Milata+3−33 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace hexlify with bytes.hex()

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…

44aa469eby Martin Milata+1334−1383120 files
No security note in commit
Informational 18 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace m_new_obj_with_finaliser

This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…

No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
142794eaby Martin Milata+40−5619 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): bundle the utimeq module

This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…

617bc806by Martin Milata+284−2211 files
No security note in commit
Informational 17 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_vstr

This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…

Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
7ea11191by Martin Milata+72−7433 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): switch to slots-based mp_obj_type_t

This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…

ab51798fby Martin Milata+163−16624 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): bindgen wrapper for calling static micropython functions

This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…

d5121d92by Martin Milata+20−06 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): adjust mpy-cross paths

This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…

2ef70e16by Martin Milata+18−264 files
No security note in commit
Low 30 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): collect micropython GC root pointers

This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…

GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
fc128f3dby Martin Milata+75−107 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityfix(core): return type annotation for maybe_with_colon() [no changelog]by Michal Kazda · 2e072450 · Jul 28, 2026 · 1 fileMessage 77 · AdequateTriage 0Details
Commit message · Michal Kazda

fix(core): return type annotation for maybe_with_colon()
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritychore(core): update common/models.jsonby Martin Milata · 7227d950 · Jul 27, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Martin Milata

chore(core): update common/models.json

source: https://github.com/trezor/trezor-suite/blob/develop/packages/device-utils/src/models.ts

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Security candidatefeat(clear_signing): support sliced paths.by PrisionMike · 017cf136 · Jul 27, 2026 · 6 filesMessage 72 · AdequateLow 31Details
Commit message · PrisionMike

feat(clear_signing): support sliced paths.

- This should enable deleting 1inch builtin addresses. (QA)
[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 31/100

This commit adds a new feature to Trezor's Ethereum 'clear signing' system that lets wallet definitions extract a slice of bytes from a numeric parameter. For example, a 32-byte number that secretly packs an address into its last 20 bytes can now be sliced so the device shows only the real address. The change is described as a feature, not a bug fix, and there is no vendor statement that it fixes a security vulnerability. It does reduce one real risk: users could otherwise be tricked into approving transactions where hidden extra bits in a number change the meaning of what they see on screen.

Security candidatefeat(core): confirm ERC-8213 calldata digest if all data is shownby Roman Zeyde · 10c82edd · Jul 27, 2026 · 22 filesMessage 62 · AdequateLow 35Details
Commit message · Roman Zeyde

feat(core): confirm ERC-8213 calldata digest if all data is shown

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathboot or update path
AI analysis · Low 35/100

This commit adds a new user-facing safety feature for Trezor hardware wallets when signing Ethereum transactions. If the user chooses to view all the raw transaction data (calldata), the device will now also show a final cryptographic hash (digest) of that data, based on a community standard called ERC-8213. This helps users verify that what they saw on screen matches what is actually being signed, reducing the risk of hidden malicious changes in very long data fields. It is a defensive improvement, not a fix for an active bug or vulnerability.

Lower-priorityfeat: build-docker.sh: add translations root to fingerprints when core firmware is builtby Andrew Kozlik · a64fc5e3 · Jul 27, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Andrew Kozlik

feat: build-docker.sh: add translations root to fingerprints when core firmware is built

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatetest(core/ethereum): don't duplicate "skip_models" for EIP-7702 testsby Roman Zeyde · 1f20560e · Jul 27, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Roman Zeyde

test(core/ethereum): don't duplicate "skip_models" for EIP-7702 tests

It will be supported on T2T1.

[no changelog]

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100

This commit only changes a test data file. It removes duplicate 'skip_models' entries from Ethereum EIP-7702 test fixtures so that the T2T1 model is no longer excluded from these tests. There is no change to firmware code, no security fix, and no user-facing behavior change.

Security candidatefeat(core): support EIP-7702 authorization/revocationby Roman Zeyde · 0cd72f03 · Jul 27, 2026 · 15 filesMessage 98 · StrongLow 36Details
Commit message · Roman Zeyde

feat(core): support EIP-7702 authorization/revocation

Figma: https://www.figma.com/design/3wF1eh3Ftj0XGX7wFmev8t/EIP-7702?node-id=6358-2421&t=vo7F599zB7Cp9K5D-0

Changelog entry has been updated in a previous commit.

[no changelog]

98/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
access controlcryptography-sensitive pathsigning or wallet pathauthentication path
AI analysis · Low 36/100

This commit adds support for signing Ethereum EIP-7702 authorizations and revocations on Trezor hardware wallets. EIP-7702 lets an Ethereum account temporarily delegate control to a smart contract. The code adds a new signing workflow, user confirmation screens, and command-line support. It is a feature addition, not a fix for a known vulnerability. The main security consideration is that authorizing delegation is a powerful operation, so the code requires users to disable strict safety checks and confirm on the device, while revocation remains allowed under strict checks.

Security candidatedocs(core): update EIP-7702 changelog entryby Roman Zeyde · d12287b5 · Jul 27, 2026 · 2 filesMessage 93 · StrongInformational 15Details
Commit message · Roman Zeyde

docs(core): update EIP-7702 changelog entry

It allows creating an `authorization_list` tuple,
but doesn't include set-code transaction signature:
https://eips.ethereum.org/EIPS/eip-7702#set-code-transaction

93/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess control
AI analysis · Informational 15/100

This commit only edits changelog text. It adds a more precise description of an already-released Ethereum feature (EIP-7702 support) and removes an older, less accurate changelog line. No code, transaction logic, or cryptographic behavior is changed, so there is no security issue in this commit itself.

Lower-priorityfix(tools): bump-version: support X.Y.Z.W, regen error_codes.jsonby Martin Milata · 010a3c41 · Jul 27, 2026 · 1 fileMessage 85 · StrongTriage 0Details
Commit message · Martin Milata

fix(tools): bump-version: support X.Y.Z.W, regen error_codes.json

- add support for VERSION_BUILD/VERSION_TWEAK
- regenerate error_codes.json after bumping prodtest
- fix python path
- cleanup

[no changelog]

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Security candidatefeat(clear_signing): adding some more simple types.by PrisionMike · 1e146d45 · Jul 27, 2026 · 8 filesMessage 62 · AdequateLow 32Details
Commit message · PrisionMike

feat(clear_signing): adding some more simple types.

mostly bytesN type.
[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 32/100

This commit adds support for more Ethereum data types in Trezor's clear signing feature. It introduces parsing for signed 160-bit integers (int160) and fixed-size byte arrays of various lengths (bytes4, bytes8, bytes16, bytes20, bytes32). The code also refactors existing parsers to use shared factory functions. The changes are primarily feature additions with built-in validation checks, and there is no direct evidence in the commit of a security vulnerability or fix.

Lower-prioritychore(core/eckhart): enable `instructions__view_all_data` stringby Roman Zeyde · 3d9e7c42 · Jul 27, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde

chore(core/eckhart): enable `instructions__view_all_data` string

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
translation-only discount
Lower-priorityfix(core/eckhart): viewing all data can be done via menuby Roman Zeyde · 4f57cbc0 · Jul 27, 2026 · 2 filesMessage 77 · AdequateTriage 0Details
Commit message · Roman Zeyde

fix(core/eckhart): viewing all data can be done via menu

Remove extra "view all data" left button from action bar.
Instead, add a hint to use the menu.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritychore(core): update UI fixturesby Roman Zeyde · 577ccce6 · Jul 27, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde

chore(core): update UI fixtures

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefeat(clear_signing): update defs with providersby PrisionMike · 8698d011 · Jul 27, 2026 · 4 filesMessage 57 · ThinInformational 19Details
Commit message · PrisionMike

feat(clear_signing): update defs with providers

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 19/100

This commit updates the Trezor Ethereum 'clear signing' feature so that when a known DeFi contract (like 1inch or Uniswap) is recognized, the device screen shows the provider's human-readable name (e.g., '1inch Aggregation Router V6') instead of just a raw address or a generic vault label. It also updates some URL comments to point to the community ERC-7730 registry rather than Ledger's copy. There is no obvious security vulnerability in the change; it is a user-experience improvement for transaction clarity.

Security candidatefeat(clear_signing): externalise provider namesby PrisionMike · 0a882a4a · Jul 27, 2026 · 6 filesMessage 57 · ThinInformational 17Details
Commit message · PrisionMike

feat(clear_signing): externalise provider names

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 17/100

This commit adds a new optional 'provider_name' field to the data structure used for Ethereum 'clear signing' on Trezor devices. When a provider name is supplied, the device will show that name instead of the usual recipient address lookup during transaction confirmation. The change itself is a feature addition, but it creates a new channel where a connected computer could tell the Trezor screen to display an arbitrary label for the recipient. There is no evidence in the commit that the input is validated, length-limited, or checked against the actual blockchain address, which could allow a malicious or compromised host application to mislabel a transaction recipient.

Security candidatefix(crypto): add missing checks for negative VLA sizeby M1nd3r · 3f193183 · Jul 27, 2026 · 1 fileMessage 82 · StrongModerate 59Details
Commit message · M1nd3r

fix(crypto): add missing checks for negative VLA size

Credit for finding this issue belongs to a security reporter Amr.

[no changelog]

82/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
cryptography-sensitive path
AI analysis · Moderate 59/100

This commit fixes two functions in Trezor's base58 code that build temporary memory buffers using a user-supplied length. Before the fix, a negative length value was not rejected. On systems where negative signed integers are treated as very large unsigned values, that could cause the device to allocate a huge buffer or corrupt memory, potentially crashing the device or enabling further attacks. The fix adds simple checks to reject negative lengths.

Lower-prioritychore(ci): applying zizmor findings to UI flows workflow [no changelog]by Michal Kazda · 2752c296 · Jul 27, 2026 · 2 filesMessage 77 · AdequateTriage 0Details
Commit message · Michal Kazda

chore(ci): applying zizmor findings to UI flows workflow
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-prioritydocs(python): regenerate OPTIONS.rstby M1nd3r · 72e2d061 · Jul 27, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · M1nd3r

docs(python): regenerate OPTIONS.rst

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedrefactor(core): do not preallocate known addressesby obrusvit · 2e67a22f · Jul 27, 2026 · 4 filesMessage 77 · AdequateTriage 12Details
Commit message · obrusvit

refactor(core): do not preallocate known addresses

- use `mako` template to generate sc_constants
- de-duplicate WETH_DEPLOYMENTS

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-priorityfeat(common): add network definition support for `EthereumSignAuth7702`by Roman Zeyde · 32d06df3 · Jul 27, 2026 · 4 filesMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde

feat(common): add network definition support for `EthereumSignAuth7702`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefeat(clear_signing): WETH wrap and depositby obrusvit · fdbfc031 · Jul 26, 2026 · 6 filesMessage 57 · ThinInformational 20Details
Commit message · obrusvit

feat(clear_signing): WETH wrap and deposit

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 20/100

This commit adds user-friendly on-screen labels for wrapping and unwrapping Ether using the popular WETH token contract on several Ethereum-like networks. It does not change transaction security rules; it only makes the device show clearer messages such as 'Wrap ETH to WETH' instead of raw contract data. There is no indication of a vulnerability being fixed.

Lower-prioritytest(python): configure tox not to skip missing interpretersby Martin Milata · 90e07df7 · Jul 24, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Martin Milata

test(python): configure tox not to skip missing interpreters

[no changelog]

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityfix(ci): allow `python_test` to download older python versionsby M1nd3r · 64328647 · Jul 24, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · M1nd3r

fix(ci): allow `python_test` to download older python versions

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefeat(solana): migrate to off-chain message signing v1by Jakub Janků · d289db4b · Jul 24, 2026 · 24 filesMessage 100 · StrongLow 39Details
Commit message · Jakub Janků

feat(solana): migrate to off-chain message signing v1

This commit completely removes support for Solana Off-Chain Message
Signing (OCMS) v0. This change follows the decision by Solana Foundation
(SF) to drop support for v0 and focus on v1 [1]. The motivation was that
v0 is flawed and its adoption is close to zero. However, note that not
all parties followed this decision fully: while Wallet Standard supports
v1 only (see [2]), Anza Docs [0] still list v0 as supported for
backwards compatibility.

Support for OCMS v1 is added instead. The protobuf interface is changed:
instead of accepting a serialized message in OCMS format, the device now
expects a structured protobuf message which it then serializes itself.
This again follows a decision by SF to shift the serialization
responsibility from dApps to wallets, see [1].

Moreover, the CLI is simplified as well. The "raw mode" of solana
sign-message (verify-message) commands which allowed the user to pass
a serialized OCMS message (envelope) is removed. This reflets the
protobuf interface change and makes the commands easier to use.

Fixes: https://github.com/trezor/trezor-firmware/issues/7053

[0] https://docs.anza.xyz/proposals/off-chain-message-signing

[1] https://app.notion.com/p/solanafoundation/OCMS-Meeting-June-3-2026-Notes-374d36dad52d80e3a517e5d2a8b29a2c

[2] https://github.com/anza-xyz/wallet-standard/pull/92

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 39/100

This commit updates Trezor's Solana off-chain message signing feature from an older version (v0) to a newer version (v1). It changes how messages are packaged and sent to the device: instead of the computer app formatting the message and sending raw bytes, the device now receives a structured message and formats it itself. This is a feature migration, not a fix for an active security bug, but it removes support for the older format and changes the command-line interface. The change is described as following Solana Foundation's direction because v0 was considered flawed.

Lower-priorityfix(nordic): update mcuboot - fixes trezor crypto compatibilityby tychovrahe · d6033024 · Jul 24, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · tychovrahe

fix(nordic): update mcuboot - fixes trezor crypto compatibility

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body