Trezor firmware

This commit tightens when a Trezor device lets the user run a 'backup check' (also called a dry-run recovery). Previously, the device allowed the check as long as it was initialized, even if the seed had never been backed up, was marked as not needing a backup, or the backup was unfinished. The change now blocks the backup-check menu item and the RecoveryDevice dry-run command when no real backup exists. This prevents a user from being misled into thinking an unbacked-up seed is safe, and stops a dry-run from being started in states where it has no meaningful purpose.

This commit adjusts how a Trezor hardware wallet waits for acknowledgements during encrypted USB communication. It now measures how long the host computer recently took to reply and adds that estimate to the retry timer. The change is a reliability/performance fix, not a clear security patch, but it touches a sensitive part of the transport protocol that could affect denial-of-service or timing behavior.

This commit updates the legal/regulatory information screen shown on a Trezor hardware wallet. It adds Taiwan and an extra Japan certification icon, and restructures the code that decides which labels and icons appear. There is no security-relevant change—only on-screen text and images.

This commit updates two pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth development firmware blob) and refreshes the recorded cryptographic hash for the new bootloader version. The change is labeled as a routine development chore with no changelog entry. There is no source-code diff, no description of a security fix, and no independent evidence that this update addresses a vulnerability.

This small change makes a Trezor device always redraw its screen and refresh the idle timer after waking from suspend, regardless of what triggered the wakeup. Previously, the screen was only redrawn when the user pressed a button to wake the device. The fix prevents a stale or blank screen from remaining visible after other wakeup events, which could confuse the user about the device's true state.

This commit is a routine user-interface cleanup for the Trezor hardware wallet. It removes a manual 'marquee' flag and instead makes any long subtext automatically scroll sideways. There is no indication this change fixes or introduces a security problem.

This commit adds a feature that lets the main Trezor MCU tell the Bluetooth chip what radio transmit power to use. It is a normal feature addition and does not, by itself, look like a security vulnerability. The only notable risk is that if an attacker could already send malicious commands to the internal Bluetooth-to-main-MCU channel, they might be able to lower the Bluetooth signal strength, which could make the device harder to detect or more likely to disconnect unexpectedly. There is no evidence in the commit that such command injection is possible, and the commit does not claim to fix a security issue.

This commit fixes a power-management bug in Trezor hardware wallets. Previously, USB HID (button/keyboard-like) and VCP (serial port-like) traffic did not wake the device from suspend/sleep. The patch makes any incoming USB data on these interfaces trigger a wakeup, so the device responds promptly instead of staying asleep.

This commit is a routine user-interface feature update for the Trezor hardware wallet. It changes the device menu so that paired Bluetooth-style devices can display both a host name and an application name, and it adds a scrolling (marquee) text effect for long names. There is no security-relevant change, no vulnerability fix, and no indication of a security issue.

This commit adds a new 'Host info' screen to the device menu on Trezor hardware wallets (Eckhart layout only). It lets users view the name and Bluetooth MAC address of each paired host device. There is no security vulnerability here—this is purely a user-interface feature.

This commit adds USB communication as a new way to wake a sleeping Trezor hardware wallet. Previously, the device could wake from button presses, Bluetooth, power events, NFC, or a real-time clock timer. Now, receiving data over the USB cable (WebUSB) also sets a wakeup flag. The change also restores the screen backlight to normal brightness when the device resumes from suspend. There is no indication in the commit that this fixes a security vulnerability; it appears to be a feature or usability improvement.

This commit fixes a bug in the Trezor hardware wallet's low-power suspend routine for STM32U5 devices. Previously, when the device was placed on a wireless charger and not connected by USB cable, it would not stay suspended with the charging LED effect active; it could drop out of suspend unexpectedly. The fix tracks whether charging is active and keeps the device in the suspend loop while charging, even without a USB connection. There is no indication this is a security vulnerability or exploitable by an attacker.

This commit changes how the Trezor hardware wallet enters and wakes from its low-power suspend state. Previously, the device would fully shut down USB communication before entering suspend, so a connected computer could not wake it by sending a message. The change keeps USB active while the device is merely 'idling' with a cable connected, and only fully suspends USB after the cable is disconnected or a real wake-up event occurs. It also fixes a related LED effect bug so the RGB light is stopped when resuming. The overall intent is a feature improvement (wake on USB message), but it slightly increases the time window during which USB is live while the rest of the device is partially suspended, which could matter if the USB stack has flaws.

This commit fixes how the Trezor Bluetooth Low Energy (BLE) connection updates its speed settings. Previously, changing speed mode while already connected did not actually apply the new connection parameters to the live connection. The change centralizes the update logic and ensures that switching between high and low speed modes immediately requests the new parameters from the connected peer. There is no direct evidence in the commit that this is a security vulnerability, but an incorrect or stale BLE connection interval could affect responsiveness, power usage, or potentially create a small window of unexpected behavior.

This commit adds a new Bluetooth Low Energy (BLE) 'high speed' mode that is temporarily enabled only while uploading a custom homescreen image, then turned off afterward. It is a performance optimization, not a security fix. There is no evidence in the commit of a vulnerability, attack, or security-relevant bug.

This commit simply removes one unused translation string ('ethereum__contract') and its associated references from the Trezor firmware codebase. It is a routine cleanup with no user-facing or security impact.

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in several language files (Czech, German, Spanish, French, Italian, Portuguese) and refreshes the corresponding digital signature and UI test snapshot records. There are no code logic changes, no security fixes, and no changes to how the device protects private keys or signs transactions.

This is a routine code-style and type-annotation cleanup in the Python part of the Trezor firmware repository. It updates type hints to satisfy a newer version of the pyright type checker, replaces some manual success checks with a helper, and makes a few small return-type changes (for example, returning bytes instead of bytearray from some transport reads). There is no indication of a security bug being fixed or introduced.

This is a large code-style and type-annotation cleanup. It replaces concrete type hints like `bytes` with broader aliases such as `AnyBytes`, `AnyBuffer`, and `StrOrBytes`, and fixes a few minor type-checker warnings (for example adding an `assert ... is not None` and wrapping a value with `bytes(...)`). There are no runtime logic changes, no security fixes, and no behavior changes visible in the diff.

This commit is a routine maintenance update that bumps the Pyright static type checker used in Trezor's continuous integration from version 1.1.361 to 1.1.404. It only changes dependency lock files for a development tool and does not alter any firmware, wallet, or cryptographic code. There is no indication this change fixes or introduces a security issue.

This commit fixes a user-interface bug in the Trezor hardware wallet's new 'Eckhart' layout. When confirming a Solana transaction recipient, the screen previously did not show a 'Cancel' button, so the user had no on-screen way to abort the transaction at that step. The fix adds the missing cancel option. It is a usability fix rather than a remote-exploitable security vulnerability.

This commit is a straightforward internal code cleanup for the Trezor hardware wallet's on-device menu system. It renames function parameters, result types, and message identifiers to be clearer and more consistent (for example, 'pin_code' becomes 'pin_enabled' and 'ScreenBrightness' becomes 'SetBrightness'). No security-sensitive behavior appears to change; the same menu options are still presented and handled the same way.

This commit adds a new 'Backup Device' menu item to the Trezor Safe 5 (Eckhart layout) device menu when the device still needs a backup. It is a user-facing feature change, not a security fix or vulnerability. The change wires a new UI button through to the existing backup_device() flow, with no changes to security-critical logic, authentication, or access control.

This commit is a user-interface redesign for the Trezor hardware wallet's 'backup needed' menu on the Eckhart model. It removes the ability to start a backup directly from the device menu and instead shows an informational screen telling the user to open Trezor Suite to create a backup. There is no security vulnerability here; it is a routine product change.

This commit changes how the Trezor hardware wallet handles low-level communication errors in its new THP (Trezor Host Protocol) code. Previously, certain malformed or unexpected low-level packets would cause the device to raise a ThpError, which gets sent back to the host as a Failure message. The patch makes the device silently ignore many of these low-level problems instead—such as unexpected control bytes, wrong sequence bits, bad checksums, invalid broadcast lengths, and reassembly overruns. Some internal argument checks are also converted from raising errors to assert statements, which only run in debug builds and are removed in production firmware. The stated intent is to make the protocol more robust against noisy or malformed traffic, but it also reduces the device's visibility into potential attacks or protocol fuzzing.