Trezor firmware

This commit re-enables a security feature called 'MCU device attestation' for the T3W1 hardware wallet model. It is not a vulnerability fix; it restores a previously removed capability that lets the device cryptographically prove its microcontroller is genuine using a modern quantum-resistant signature scheme (ML-DSA-44).

This commit only adds and reorganizes automated tests for the device-authentication feature on Trezor hardware wallets. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability or fix one in the shipped product. The changes make the test suite exercise both the Optiga and Tropic authentication flows, test chunking sizes, and verify that invalid requests are rejected with proper error messages.

This commit only changes the protocol definitions (the 'language' the Trezor device and apps use to talk to each other). It adds a new optional streaming mode for requesting device-authenticity proofs, so large proofs can be sent in smaller chunks instead of one big message. There is no actual device firmware logic shown here—only generated message bindings—so it is not a security fix or vulnerability by itself. It is a feature addition that could, in theory, introduce new attack surface once the corresponding firmware code is implemented, but that code is not present in this commit.

This commit simply restores a missing Python test dependency called pytest-retry. It only affects the project's testing environment and does not change any code that runs on the Trezor device or any production software. There is no security issue here.

This is a code cleanup (refactor) of the on-screen button drawing and touch/hold logic for the Trezor hardware wallet's Caesar UI layout. It removes unused style-sheet abstractions, simplifies how buttons are described, and makes the hold-to-confirm component always assume it sits on the right side of the screen. The commit is tagged [no changelog] and contains no explicit security claims. The only behavior-visible change is a small simplification in the page component: when the left button is triggered on the first page, it now always returns a Cancel message instead of first checking whether a cancel button was configured. That change is a simplification based on an existing invariant, not a fix for a known vulnerability.

This commit only changes test files so that ten unit tests are skipped when running against the Bitcoin-only firmware variant. It does not modify the actual Trezor firmware code that users run, so it cannot directly affect device security or user funds.

This commit adds support for a new Ripple transaction type called AccountDelete to Trezor hardware wallets. It is a feature addition, not a security patch. The change lets users sign transactions that delete a Ripple account and send any remaining balance to a chosen destination. The code adds user-facing confirmation screens and enforces that a transaction cannot be both a payment and an account deletion. There is no direct evidence in the commit of a security vulnerability, but any new signing path deserves careful review because bugs could let an attacker trick a user into deleting an account or signing an unintended transaction.

This commit adds emulator-only support for a new Trezor device (T3W1) to wake from a simulated low-power sleep state when the user taps the emulated touchscreen. It only affects the software emulator build, not real hardware, and does not change how secrets or user data are handled. There is no indication this is a security fix.

This commit corrects the wrong GPIO pin assignment for the interrupt line of the Tropic01 secure chip on Trezor T3W1 hardware revisions A, B, and C. Previously the interrupt pin was set to the same pin as the power-control line, which does not match the hardware schematic. The commit message says this interrupt pin has not been used so far, so the practical security impact appears low.

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It updates wording, adds missing translations, and removes obsolete translation keys across several language files. There are no code changes that affect security, cryptography, transaction signing, or device behavior.

This commit only changes release dates in seven changelog files, moving the stated release date from 21 May 2026 to 14 May 2026. No executable code, configuration, or security-related content is modified.

This commit simply adds a new cryptographic signature entry to a JSON file that records approved translation data for Trezor devices. There is no code change, no bug fix, and no visible security issue. It appears to be routine release housekeeping: signing the translation bundle for firmware version 2.11.2.0.

This update fixes a bug in how Trezor hardware wallets classify accounts inside Solana transactions. The bug could mislabel read-only signer accounts as writable, or writable accounts as read-only. Because Trezor uses these labels to decide what the user must approve on screen, a crafted transaction could trick the wallet into showing a harmless-looking account while actually requiring it to sign or authorizing unexpected changes. The changelog files explicitly mark this as a security fix.

This update fixes how Trezor displays Solana transactions that use Address Lookup Tables (ALTs). Previously, the device could misidentify or fail to show the real recipient when an ALT was involved, which might let an attacker trick a user into approving a transfer to an unexpected address. The patch also blocks ALT references in payment requests and some staking flows where the device cannot safely verify the destination.

This commit simply changes release dates in seven changelog files from 14 May 2026 back to 21 May 2026. It is a reversion of an earlier date-change commit. There is no code change and no security relevance.

This commit replaces the signed bootloader binary for the Trezor T3W1 hardware wallet model and updates the matching cryptographic hash list. The change is a routine version bump from bootloader version 2.1.16.0 to 2.1.17.0. The commit message and diff provide no information about why the bootloader was rebuilt or whether any security issue was fixed. Because the actual bootloader binary is a compiled blob, its contents cannot be reviewed from this diff alone.

This commit updates a QA/testing bootloader binary and its recorded cryptographic hash for the T3W1 hardware model. It is a routine development chore with no visible security fix or vulnerability.

This commit is a documentation-only changelog update for the Trezor firmware releases core 2.11.2 and bootloader 2.1.17. It does not change any code. The changelog lists several previously fixed security issues, including bugs in Solana account handling, EIP-712 domain caching, and an out-of-memory fix. Because the actual code changes happened in earlier commits, this single commit cannot introduce or directly fix a vulnerability, but it confirms the vendor considers multiple items security-relevant for the release.

This patch changes how a Trezor hardware wallet handles EIP-712 typed data signing for Ethereum. It now caches (stores) the values shown to the user for the domain's name and version fields, and reuses those same cached values when later computing the cryptographic hash. The goal is to prevent a malicious computer or app from showing the user one set of values on screen, but then tricking the device into signing a different set of values. The changelog file labels this as a security fix: 'Cache confirmed EIP-712 domain.'

This commit simply adds a new cryptographic signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. There is no code change, no bug fix, and no visible security issue. It appears to be routine release housekeeping.

This commit updates the on-screen confirmation prompts shown when signing Stellar transactions on Trezor hardware wallets. It does not change how transactions are validated or signed, but it reorganizes and improves the clarity of what the user sees before approving. The changes are purely user-interface related, with updated test snapshots reflecting the new screen layouts.

This commit is a user-interface improvement for Tron (TRX) transfers on Trezor hardware wallets. It changes the on-device confirmation screens to show the sending account name, derivation path, recipient address, and amount in a clearer layout. There is no indication it fixes a security vulnerability; it is a usability and consistency refactor.

This commit is a routine housekeeping change that only updates version numbers in several files. It does not change any program logic, fix any bug, or alter any security behavior. There is nothing here that could be exploited or that affects user security.

This commit is a straightforward build-system wiring change for the Trezor T3W1 hardware wallet. It enables a feature called USE_TOUCH_WAKEUP, which lets the device wake from a low-power suspend state when the touch screen is touched. The change only affects how firmware is compiled for specific T3W1 revisions and does not alter security-critical code, cryptographic operations, or user data handling. There is no indication this is a security fix or vulnerability patch.

This commit adds a user-facing 'Tap to Wake' on/off toggle to the device menu on the Trezor T3W1 hardware wallet. It stores the preference in device storage and applies it at startup and when settings are reloaded after unlocking. There is no security issue visible in the change.