Trezor firmware

This commit changes how Trezor T3W1 devices generate their temporary Bluetooth (BLE) name during pairing. Previously the name contained three random characters from a pool of 26 letters plus 10 digits. Now it uses a digit-letter-digit pattern. This reduces the number of possible names from 36×36×36 (about 46,656) to 10×26×10 (2,600), making it easier for a nearby attacker to guess or collide with the advertised name during pairing. The change appears intentional to make the displayed name easier to read or type, but it weakens the randomness that helps distinguish devices.

This commit only updates version numbers and translation metadata across Trezor firmware components. It does not change any executable code, fix any behavior, or alter security logic. There is no indication this is a security patch.

This change only affects what version numbers are shown on the device's 'About' screen during automated user-interface tests. When running in the software emulator, real version numbers are replaced with placeholder '0.0.0.0' values so that test snapshots don't have to be updated every time the firmware version changes. There is no security issue here.

This commit is a simple internal rename of a user-interface text label from 'ble__waiting_for_host' to 'words__waiting_for_host'. It does not change what the device does, what data it handles, or how it protects that data. It only reorganizes where a translation string is stored so it can be reused for a future on-screen message.

This commit is a small cleanup and bug fix for the T3W1 hardware wallet's Bluetooth translation upload. It makes sure the Bluetooth connection switches to a faster mode when uploading language translations, just like it already did when uploading custom homescreens. The change also wraps the speed-up logic in a reusable helper so it is harder to accidentally leave high-speed mode on. There is no direct security vulnerability here; it is a reliability/performance improvement.

This is a minor internal cleanup change in the Trezor hardware wallet firmware. It removes explicit button-request type labels from two warning screens in the Ripple and Stellar cryptocurrency apps, letting them default to a generic 'Warning' category instead of 'ConfirmOutput'. There is no visible security bug or vulnerability being fixed.

This commit adds a user-facing warning in Trezor hardware wallets when signing a Ripple transaction that does not include a destination tag. Destination tags are often required by exchanges to credit the correct account, so missing one can lead to lost funds. The change only shows an extra warning screen; it does not alter how transactions are validated or signed.

This commit only adds new automated tests. It checks that Trezor devices correctly reject payment-request amounts encoded with the wrong number of bytes (for Bitcoin) or values that are too large (for Ethereum). There is no change to the actual firmware or production code, and the commit message explicitly marks itself as a test-only chore with no changelog.

This commit changes how payment-request amounts are encoded in Trezor firmware. Previously amounts were 8-byte numbers; now they can be 8 or 32 bytes, with 32 bytes used for Ethereum/EVM transactions. The change is a feature update to support larger EVM token amounts, not a clearly disclosed security fix. It does add length checks and an overflow guard, which reduces risk, but the change touches the trusted payment-request verification path, so any bug there could affect what amount the user is asked to approve.

This commit only updates the expected visual test snapshots (called 'fixtures') used by Trezor's automated UI tests. It adds new test cases and refreshes image hashes because the underlying tests changed, for example replacing the Ethereum 'Holesky' testnet with the newer 'Hoodi' testnet. No actual device firmware code was changed, so this cannot introduce a security vulnerability on its own.

This commit removes a single incorrect documentation comment ('@next TxRequest') from a protocol buffer definition file. It is a documentation-only cleanup with no change to executable code, message structure, or device behavior. There is no security relevance.

This is a one-line firmware change for the Trezor hardware wallet's power manager on STM32U5 chips. When the device wakes from a low-power suspend state, the code now marks the power-manager state machine as 'not yet stabilized.' This is a defensive fix: without it, the firmware might act on stale or transient power-state readings right after wakeup. The commit itself does not explain any security impact, and no public references were provided.

This commit is a straightforward code cleanup (refactor) in the Trezor firmware's display driver. It changes the data types used for backlight levels from signed integers (int) to unsigned 8-bit values (uint8_t), and changes the display_set_backlight function to return true/false (bool) instead of the brightness level. There is no indication this fixes a security bug or introduces a vulnerability.

This commit refactors how the Trezor hardware wallet's screen brightness is controlled from Rust code. The old single 'backlight' function is split into separate 'set_backlight' and 'get_backlight' functions, and the brightness value type is narrowed from a wider signed integer to an unsigned 8-bit value (0-255). The commit message and code comments explicitly flag that some callers still pass a 16-bit value, and the patch adds defensive clamping to 255 in those cases. There is no direct evidence of an exploitable security bug, but the change is clearly defensive hardening against potential type-conversion issues.

This is a code cleanup change in the Trezor hardware wallet's screen-brightness controls. It changes internal number types from 16-bit to 8-bit to match the display driver, and removes temporary workarounds that converted the values. The commit message says the code was reviewed and no safety problems were found. There is no indication this fixes an active security bug; it is a defensive type-safety refactor.

This commit is a routine code cleanup of the screen backlight driver in Trezor hardware wallets. It changes function return types from plain integers to booleans and from signed to unsigned 8-bit values, and removes redundant range checks. There is no indication this fixes a security vulnerability; it appears to be a refactoring for code clarity and type correctness.

This is a small fix in Trezor's internal emulator tooling. It changes where a helper program (the 'Tropic model') writes its output file, so the file goes into a per-profile directory instead of an unspecified default location. The change only affects internal test/development infrastructure and does not appear to fix a vulnerability in the actual Trezor hardware wallet or its firmware.

This commit fixes a bug in the Trezor hardware wallet's Bluetooth code. Previously, entering Bluetooth pairing mode required providing a device advertising name; if no name was supplied, the function immediately failed. The change now allows pairing mode to start without a name, only rejecting names that are too long. The changelog describes this as fixing 'ble-adv-start without args' in the production-test (factory/testing) project. This is a functional bug fix rather than a clear security vulnerability.

This commit fixes an off-by-one error in the STM32U5 flash memory layout definition for Trezor's hardware wallet firmware. The number of sectors covering the kernel/firmware area was calculated as one too few, meaning the last sector was excluded from the area used for firmware hash verification. This could cause the device to compute or verify a firmware hash that does not cover the entire installed firmware image, potentially weakening integrity checks.

This commit is a routine translation and localization update for the Trezor firmware. It updates translated user-facing strings in several languages, fixes a typo ('minumum' to 'minimum'), adjusts some strings to be device-layout-specific, and refreshes the corresponding UI test fixture hashes. There is no code behavior change and no security impact.

This commit replaces the deprecated Ethereum Holesky testnet with the new Hoodi testnet across Trezor firmware. It updates network names, chain IDs, SLIP44 derivation indices, staking contract address labels, and test fixtures. There is no indication of a security vulnerability being fixed; it is a routine network-maintenance change.

This commit changes a Crowdin translation-service configuration file so that when an English source string is updated, existing translations in other languages are kept but marked as needing re-approval. It is a workflow/translation-management fix with no effect on device firmware, cryptography, user funds, or security boundaries.

This commit changes an internal Python helper script used to prepare translation files for the Crowdin localization service. It makes the tool tolerate translation files where some languages or screen layouts do not have every translation key. There is no change to the Trezor firmware that runs on the device, no user-facing behavior change, and no security relevance.

This is a small bug fix in the Trezor command-line tool `trezorctl`. The `get-session` command accidentally connected to the Trezor device twice because it used an existing connection object (`obj`) that already had an open session, then called `get_session()` again. The fix reuses the already-open `client` connection instead. This is a reliability/usability fix, not a security vulnerability. There is no indication it could be exploited to steal funds, keys, or bypass protections.

This is a trivial build-compatibility change. It adds human-readable error messages to two compile-time size checks so that newer versions of the Clang compiler accept the code without warnings. The actual security logic is unchanged.