Trezor firmware

This is a small internal code cleanup in Trezor firmware's message handling loop. It removes an optional 'no message' path and restructures exception handling so the loop continues cleanly after unexpected messages. There is no indication this fixes or introduces a security vulnerability.

This commit changes how the Trezor device handles multiple encrypted USB-like communication channels. It lets a new channel on the same connection take over if an existing channel appears stuck for more than one second. The change is described as a feature, not a security fix, and there is no disclosed vulnerability or incident tied to it.

This commit simply adds a new firmware version number (2.9.1) to a list of released versions for several Trezor hardware wallet models. It is a routine metadata update with no code changes and no security relevance visible in the diff.

This commit simply updates a timestamp that tells the Trezor device how new its built-in Ethereum network/token list must be. It is a routine data-version bump with no code logic changes and no security relevance visible in the commit.

This commit is purely a documentation update: it compiles the changelog for Trezor firmware version 2.9.1 by deleting individual changelog fragments and adding the final release notes to several CHANGELOG files. No source code, firmware logic, or security behavior is changed.

This commit removes a 'Skip backup' menu option that had accidentally been left on a screen shown during the wallet backup process on the Trezor Safe 5 (Eckhart layout). The change prevents a user from bypassing the backup verification quiz, but it is a UI-only fix and does not by itself create or fix a security vulnerability in the cryptographic backup process.

This commit fixes a bootloader wireless setup workflow so it checks whether Bluetooth pairing actually started before continuing. Previously, the code ignored the return value of the pairing-start function, so if pairing failed to initiate, the setup would proceed anyway. The fix makes the workflow return a pairing-failed status instead. This is a defensive hardening change in the bootloader's BLE pairing path.

This is a straightforward internal code cleanup in Trezor's Python library. It replaces two separate flags that tracked whether a device was paired with a single simpler flag, and adds extra debug logging. There is no indication this fixes or introduces a security vulnerability.

This commit removes leftover debug print statements from a Trezor hardware wallet pairing function. The prints could have exposed sensitive cryptographic material (a shared secret and authentication tag) during development or testing, but they were clearly marked as temporary test code and are now removed. There is no evidence this code ever shipped to production firmware.

This commit refactors error handling in the Trezor Python client library and command-line tool. It removes some custom exception types and moves error printing into a shared helper. The changes appear to be a cleanup following an earlier pull request, not a fix for an active security vulnerability. There is no indication in the commit that this addresses a security issue.

This change fixes a bug in the Trezor hardware wallet's THP (Trezor Host Protocol) communication layer. Previously, if the device was trying to resend a message but the USB host stopped accepting data (for example due to USB flow control), the retransmission loop could get stuck forever, blocking other THP channels. The patch adds a 5-second timeout so the loop can break out and let other communication channels proceed. It is a reliability/availability fix rather than a clear-cut vulnerability patch, though the stuck-loop condition could be abused to deny service to other channels.

This commit adds the public key to the Cardano message-signing response. It is a feature enhancement for software wallets, not a fix for a vulnerability. There is no security defect in the change itself.

This commit only adds a missing period to two changelog entries describing a new Cardano feature. There are no code changes and no security relevance.

This commit only updates the expected test result hashes (called 'fixtures') for the user-interface test suite. It does not change any firmware, application, or cryptographic code. The changes are test-only data, so they do not create or fix any security vulnerability on their own.

This commit only adds or updates translated text strings for the Cardano cryptocurrency feature. It replaces hard-coded English labels like 'Confirm message' and 'Message text' with references to the device's translation system, and updates the translation files, generated code, and a test marker. There is no change to security logic, cryptography, or how user approvals work.

This commit is a routine cleanup after merging (rebasing) other Cardano code changes. It updates the Cardano message-signing flow to use newer internal APIs (sessions instead of raw clients, and a separate SLIP-21 keychain argument) and refreshes automated test snapshots. There is no indication it fixes or introduces a security vulnerability.

This commit is a simple internal code cleanup in the Cardano app of Trezor firmware. It renames a function parameter from 'payload_first_chunk' to 'payload' and switches from keyword arguments to positional arguments in one call. There is no change to user-visible behavior, security logic, or data handling.

This commit fixes a display issue in Trezor's Cardano message signing feature. Previously, very long messages were visually trimmed on the device screen, so the user could not see the full content before approving a signature. The patch removes the trimming limit and adds a test case for a long payload. The risk is that a user might unknowingly sign a message whose full content they did not review, but the signature itself is still produced over the complete message (not a truncated one).

This commit changes a single test marker so that a Cardano message-signing test runs on Trezor Model T/Core devices instead of being skipped on the older T1B1 model. It is a test-suite maintenance change with no effect on the actual firmware code that users rely on.

This update makes Trezor's Cardano message-signing feature refuse to sign 28-byte payloads that look like cryptographic hashes. The goal is to prevent users from accidentally signing a hash of an unknown message, which could let an attacker trick them into authorizing something they did not read. The change is a simple heuristic: if the payload is exactly 28 bytes and is not made of ordinary printable text, the device now rejects it with an error.

This commit rewrites how the Trezor device fetches the message payload during Cardano message signing. Instead of the host pushing fixed-size chunks to the device, the device now asks for a specific slice of data by sending a length and offset, and the host replies with exactly that slice. The change also removes the previous 1024-byte maximum payload size limit, so larger messages can now be signed. The code adds bounds checks on both sides, but because the device now requests the entire payload in one go, this could stress limited device RAM. There is no direct evidence in the commit that this fixes a reported security bug; it reads as a feature/refactoring change.

This commit removes the option to sign a hash of a Cardano message instead of the message itself. The device now always signs the actual message payload directly, up to a size limit. This is a feature/API change rather than a fix for an active security flaw, but it does eliminate a mode where users might have signed data they could not fully inspect.

This commit improves the Cardano message-signing feature on Trezor hardware wallets by showing users more details on the device screen before signing. It displays the signing path, the address parameters (if provided), and a larger chunk of the message payload when appropriate. It also tightens path validation by checking the path against the keychain and allowing minting paths in addition to public-key paths. These are defensive UI and validation hardening changes rather than fixes for an active vulnerability.

This commit adds a new feature to Trezor hardware wallets: the ability to sign arbitrary Cardano messages. It introduces new protocol messages, device firmware code to handle signing, and client libraries to use the feature. The signing process requires user confirmation on the device screen and includes safety checks, such as limiting unhashed payload length and validating ASCII display options. There is no direct evidence in the commit of a security vulnerability, but any new signing feature carries inherent risks if not fully reviewed.

This commit renames and slightly changes a Cardano message-signing display option. Previously, the host had to explicitly request ASCII display, and the device would reject payloads that were not clean, readable ASCII. Now the host can ask the device to prefer hex display, and if ASCII display is preferred but the payload is not clean ASCII, the device falls back to showing hex instead of rejecting the request. This is a user-experience and consistency change, not a fix for a clear security vulnerability.