Trezor firmware

This commit updates the backlight driver for a Trezor hardware wallet display controller. It adds smoother brightness levels by blending between the hardware's 32 brightness steps, and it improves error checking during initialization and shutdown. There is no clear security vulnerability here; it reads as a normal hardware-driver improvement.

This commit is a cleanup and hardening pass on the backlight driver for Trezor hardware wallets. It improves error handling, removes debug code, fixes a buffer-index bug in a DMA safety check, and adds memory-protection reconfiguration around the interrupt handler. The changes are defensive and reduce the chance of driver misbehavior, but they do not appear to fix a known exploitable security vulnerability in user-facing software.

This is a minor code cleanup that changes a single variable type from a signed integer to an unsigned 8-bit integer. It does not fix a security bug and does not introduce any obvious security risk. The change is purely for internal consistency in how backlight brightness levels are represented.

This commit is a routine packaging/documentation update. It renames an optional Python dependency group from 'bleak' to 'ble' and updates the README to document Bluetooth installation for newer Trezor models. There is no security-relevant code change.

This commit simply changes a version number in a Python package configuration file from 0.14.0 to 0.20.0-dev0. It is a routine development version bump with no security relevance.

This commit is purely a documentation update: it gathers individual changelog fragments into the main CHANGELOG.md file for the Python trezorlib package version 0.20.0-dev0. No program code was changed, so it cannot by itself introduce or fix a security vulnerability.

This commit only reorganizes the bootloader's written changelog. It deletes small draft files and copies their text into the main CHANGELOG.md, adding version numbers and pull-request links. No program code was changed, so this cannot introduce or fix a security bug by itself.

This commit only updates the production-test firmware changelog. It deletes individual changelog fragment files and rolls their text into the main CHANGELOG.md file, adding release sections and pull-request links. No program code was changed.

This commit fixes a minor consistency bug in Trezor's storage reset logic. When resetting or recovering a device, the code now preserves a cache of paired Bluetooth Low Energy (BLE) device names alongside the BLE bonding data and Trezor-Host Protocol (THP) credentials. Previously, this name cache could be wiped while the underlying bonds/credentials were kept, which could cause confusion or minor pairing issues but does not appear to be a security vulnerability.

This commit is a simple rename-only code cleanup. It changes internal names like 'paired_cache' to 'paired_names' and updates comments to clarify that the data is stored in flash and survives reboots. No behavior, logic, or security properties change.

This is a one-line bugfix for the T3W1 hardware wallet's screen brightness slider. Previously, increasing brightness at all caused an unnecessary wait for the display to refresh, making the slider feel laggy. The fix narrows that wait so it only happens when turning the backlight on from fully off (e.g., during fade-in/fade-out transitions), not every time the brightness is raised. There is no security issue here.

This commit removes two unused Bluetooth pairing methods (QR code and NFC) from the default list in Trezor's new 'THP' transport layer, leaving only the code-entry method active in normal builds. In debug/test builds, the removed methods are still available so internal tests can keep running. The change is framed as a cleanup of unfinished features, not as a response to a known security bug.

This commit simply doubles the size of a temporary text buffer used for debug-only console messages in the Trezor firmware. There is no security issue here: the code already safely limits how much data is written, and the change only makes longer debug messages fit without being cut off.

This commit fixes a minor USB status display bug in Trezor hardware wallets. The device could briefly show a false 'NO USB CONNECTION' warning on its home screen due to timing glitches when reading the USB connection state. The fix adds proper interrupt protection around shared timing data and refreshes the connection timestamp more frequently. There is no direct evidence this is a security vulnerability.

This is a trivial one-line change that adds a human-readable error message to a compile-time size check. It does not change any logic, behavior, or security boundary. It only suppresses a compiler warning in newer versions of clang.

This commit only adds a new test case and updates expected test screenshots. It does not change the actual Trezor firmware code that users run. The new test verifies that a payment request without a memo or nonce behaves as expected and does not trigger a nonce-reuse error. There is no security fix or vulnerability here.

This commit is a purely cosmetic UI fix. It changes the text and icon color of a warning-style action-bar button from bright orange to a dimmed orange when the button is active/pressed. The large number of changed lines are just updated test screenshot hashes (fixtures) reflecting the new color, not functional code changes. There is no security relevance.

This commit fixes a visual timing issue in the setup tutorial on the Trezor T3W1 hardware wallet. Previously, the on-screen background color and the device's RGB LED could change at slightly different moments because they were driven by separate timers. The patch removes the separate LED timer and ties the LED color change directly to the same progress check used for the on-screen loader/background, so they stay synchronized. There is no indication this was a security vulnerability.

This commit is a purely cosmetic user-interface change for the Trezor hardware wallet's 'Eckhart' layout. It changes the indeterminate loading spinner from a single moving piece to two moving pieces on opposite sides of the screen. The only code change is in the loader drawing logic, and the rest of the diff is just updated test screenshot hashes (fixtures) that reflect the new visual appearance. There is no security-relevant change.

This commit fixes a cosmetic bug where the RGB LED on the Trezor T3W1 would briefly blink or flicker when the device's user-interface event loop restarted (for example, when leaving the homescreen). The fix moves LED color control into the normal screen-drawing pipeline so the LED state is set consistently during rendering rather than being turned off when a screen object is destroyed. There is no indication this is a security vulnerability.

This commit only changes the on-screen text label from "Pair & connect" to "Pair & Connect" (capitalizing the C). It also updates the corresponding test snapshot hashes because the displayed text changed. There is no code behavior change and no security relevance.

This commit adds public verification keys for the nRF wireless/Bluetooth chip to the Trezor library's list of known device model keys. It is a routine data update with no code logic change and no indication of a security vulnerability.

This commit renames a helper function back from `raise_if_cancelled` to `raise_if_not_confirmed` and changes its behavior. Previously, the code only raised an error when the user explicitly cancelled. Now it also raises an error if the UI returns any unexpected result other than a confirmed success. This is a defensive hardening change across many on-device confirmation screens, intended to prevent the device from silently continuing when something other than a clear confirmation happens.

This update fixes a bug in the Trezor hardware wallet where entering a 'wipe code' (a special PIN that securely erases the device) did not remove saved Bluetooth pairings on the T3W1 model. After the fix, the device reboots into a dedicated wipe routine in the bootloader that both erases storage and clears Bluetooth bonding information, preventing a wiped device from remaining paired to a previously trusted phone or computer.

This commit changes how Trezor T3W1 devices generate their temporary Bluetooth (BLE) name during pairing. Previously the name contained three random characters from a pool of 26 letters plus 10 digits. Now it uses a digit-letter-digit pattern. This reduces the number of possible names from 36×36×36 (about 46,656) to 10×26×10 (2,600), making it easier for a nearby attacker to guess or collide with the advertised name during pairing. The change appears intentional to make the displayed name easier to read or type, but it weakens the randomness that helps distinguish devices.