Trezor firmware

This commit simply adds one line to the GitHub pull request template, reminding developers to add QA notes if needed. It does not change any firmware code, build scripts, or security-sensitive files.

This commit changes how Trezor stores wallet backup words (mnemonics) for Cardano support. It now keeps an extra binary copy of the mnemonic in device storage, separate from the encrypted text version. The change is described as a feature, not a security fix. It does not appear to introduce an obvious remote exploit, but it does add a new storage location holding sensitive seed material and includes a debug-only option that lets invalid mnemonics be loaded without raising an error.

This commit only updates expected test result hashes (called 'fixtures') in a single JSON file used for automated user-interface testing. There are no changes to the actual Trezor firmware code, so this cannot introduce a security vulnerability or fix one on its own.

This commit only updates Cardano unit tests to convert text seed phrases into binary format before passing them to a cryptographic function. It does not change any production wallet code, user-facing behavior, or security-sensitive logic. There is no indication this fixes or introduces a vulnerability.

This commit only adds a new automated test to the Trezor firmware test suite. It checks that Cardano public keys and addresses stay the same before and after a firmware upgrade that migrates internal app storage from version 2 to the current version. There is no change to the actual firmware code, wallet logic, or security behavior.

This commit simply fills in a previously empty placeholder with the real production public key used to verify signed payment requests. By itself, it is a routine configuration/key-installation change, not an exploitable vulnerability. The only security-relevant observation is that before this commit, payment-request signatures using this key could not have been validated, so the feature would not have worked in production.

This commit tightens which types of signed payment requests a Trezor hardware wallet will accept. Previously, the code accepted any validly-signed payment request; now it rejects requests that are not specifically 'coin swap' requests (which must contain both a coin-purchase memo and a refund memo). It also adds a check that each memo has exactly one memo type. The change appears to be a defensive hardening measure rather than a fix for an active exploit, because the commit message and diff do not describe a specific vulnerability.

This commit removes a safety check that ensured each memo inside a Bitcoin payment request contained exactly one memo type. The change is described by the developer as removing a redundant sanitizer, suggesting the validation is believed to happen elsewhere. Without access to the rest of the codebase or vendor confirmation, it is unclear whether this weakens security or is genuinely redundant.

This commit only adds new automated unit tests for an existing payment-request verification feature in the Trezor firmware. It does not change any production code, fix a bug, or alter device behavior. There is no security vulnerability present in this change.

This commit removes the 'experimental' label from two Trezor firmware features: PaymentRequest (used in several cryptocurrency transaction flows) and GetNonce (a random-number request). It also updates generated code and tests accordingly. The change itself is a feature graduation, not a fix for a known security bug. There is no direct evidence in the commit that it patches an active vulnerability, but it does widen the audience for these features by removing the experimental opt-in requirement.

This commit is a straightforward internal code cleanup: it splits one Python/C function that handled three different reboot behaviors into three separate, clearly named functions. There is no change to what the device actually does during a reboot or firmware upgrade, and no security bug is introduced or fixed.

This update fixes a bug where rebooting a Trezor device from its on-device menu did not properly restart the Bluetooth chip (nRF). The fix makes sure the Bluetooth chip is turned off and rebooted before the device restarts, so both sides come back up in a clean, synchronized state. Without this, Bluetooth could be left in a confused or half-working state after a reboot.

This commit fixes a battery-drain bug in the Trezor bootloader that occurs when the device is left waiting for the user to confirm unofficial firmware. The old code kept the processor awake in a tight loop polling the touchscreen or buttons. The new code lets the device sleep and only wakes it when the user actually touches the screen or presses buttons, and it hibernates after 40 seconds of inactivity. There is no direct security vulnerability being patched; it is a power-management and usability fix.

This commit is a routine user-interface cleanup. It changes the on-screen 'please wait' message in three Trezor firmware layouts to use a standard text paragraph component instead of a dedicated 'Connect' component. There is no indication this fixes a security bug or changes security behavior.

This commit is a simple code cleanup: it moves a small helper function called dummy_page() into a shared utility file so two different screens can use the same copy instead of each defining their own. There is no change to what the code does, no bug fix, and no security-relevant behavior change.

This commit fixes how the Trezor hardware wallet builds on-screen confirmation flows for the newer 'Delizia' interface. Previously, the code could register a confirmation page under the wrong internal state variant (for example, adding a confirmation screen to a flow that was not supposed to have one, or using the variant meant for flows with a menu when no menu existed). The patch makes the state variant explicit and passes it into the helper functions, ensuring each page is attached to the correct flow type. A mismatch could cause the device to show the wrong screen, ignore a button press, or behave unexpectedly when a user confirms or cancels an action.

This commit only updates expected test result fingerprints (hashes) in a single JSON file used for automated UI testing. No actual product code, cryptography, or user-facing behavior was changed. It is a routine maintenance update to keep automated tests passing after unrelated UI or test changes.

This commit removes an unused 'More info' option from several on-screen confirmation helpers in the Trezor firmware. The change is a UI cleanup: screens that never actually provided extra information no longer offer a 'More info' button. There is no direct evidence in the commit that this fixed an exploitable security vulnerability.

This commit fixes undefined behavior in the Rust-based protobuf codec inside Trezor firmware. The code was reading multi-byte integers from data files that were not guaranteed to be properly aligned in memory, which can cause crashes or unpredictable behavior on some hardware. The patch ensures the data files are loaded with correct memory alignment and removes the use of 'packed' structs that forced unaligned access. It is a defensive hardening fix rather than a confirmed remote exploit.

This commit fixes a potential integer underflow bug in the Trezor hardware wallet's user interface code. The bug occurred when calculating the number of separators between menu buttons. If the menu had zero buttons, the code would try to subtract 1 from 0, causing an underflow. The fix restructures the loop so the separator is only considered after the first button, avoiding the subtraction entirely. This is a defensive fix in Rust UI code that likely prevents a crash or undefined behavior during screen layout.

This is a user-interface cleanup change for the Trezor Safe 5 (delizia layout). It removes a special narrow text style that was used only when long addresses needed a scrollbar. Because the new delizia layout no longer uses a scrollbar on these screens, the code now always uses the standard address-chunk style. The only visible effect is slightly different address formatting on some screens, and the corresponding screen-test snapshots were updated. There is no indication this affects security, cryptography, or how transactions are approved.

This is a routine tooling and documentation update. It adjusts the changelog helper script to support a new Trezor hardware model (T3W1) and to trim older changelog entries for that model. There is no change to wallet, cryptographic, or device security code.

This commit only updates firmware release notes and changelog files. It deletes draft changelog fragments and adds their contents to the published CHANGELOG files for versions 2.9.2 and 2.9.3. No source code, logic, or configuration changes are present, so it cannot introduce or fix a security vulnerability by itself.

This commit is a cleanup and hardening pass on the backlight driver for Trezor hardware wallets. It improves error handling, removes debug code, fixes a buffer-index bug in a DMA safety check, and adds memory-protection reconfiguration around the interrupt handler. The changes are defensive and reduce the chance of driver misbehavior, but they do not appear to fix a known exploitable security vulnerability in user-facing software.

This commit updates the backlight driver for a Trezor hardware wallet display controller. It adds smoother brightness levels by blending between the hardware's 32 brightness steps, and it improves error checking during initialization and shutdown. There is no clear security vulnerability here; it reads as a normal hardware-driver improvement.