Trezor firmware

This is a small, safe code cleanup in Trezor's Python debug tooling. It splits an existing lookup function into two so developers can resolve a device's screen layout type from just its internal model name, without needing a full model object. There is no security issue visible in the change.

This commit is a test-only refactoring change. It reorganizes how Trezor firmware upgrade tests select emulator models and handle a new hardware model (T3W1) that uses a 'tropic' chip. There is no change to the actual device firmware, wallet logic, or cryptography that end users rely on, so it does not create a security vulnerability.

This commit only changes internal CI (continuous integration) workflow files for running firmware upgrade tests. It adds a new hardware model (T3W1) to the test matrix, adjusts environment setup for that model, and renames an environment variable value from 'core'/'legacy' to specific model codes like 'T2T1', 'T3W1', 'T1B1'. There is no change to the actual Trezor firmware code, device behavior, or anything users interact with.

This commit only updates a documentation file explaining how to run internal upgrade tests. It adds instructions for using nix-shell, building the emulator, and selecting which device models to test. There is no code change and no security relevance.

This commit only adds tooling: it introduces cargo-audit (a Rust dependency vulnerability scanner) into the project's build environment and Makefile targets. It does not change any firmware code, fix any vulnerability, or alter how the device behaves. It is a development/CI hygiene improvement, not a security patch.

This commit only adds a new automated security-check step to the project's continuous integration (CI) workflow. It tells GitHub Actions to run `cargo-audit`, a tool that scans Rust dependencies for known security vulnerabilities. There is no change to the actual Trezor firmware code, no bug fix, and no vulnerability being patched.

This commit updates a CI Docker build script used to create container images for Trezor's automated build/test pipeline. It replaces an 'apk update' command with explicit package installation flags and adds 'coreutils' to the installed packages. There is no indication this change fixes or introduces a security vulnerability in the Trezor firmware itself; it is a build-infrastructure maintenance tweak.

This is a one-line change to a test helper that checks on-screen text during automated Ethereum transaction signing tests. It switches from checking the full screen content to checking only the visible text content when looking for a 'view all data' instruction. This makes the test work correctly when the device interface language is not English. It does not change any firmware behavior or fix any security issue.

This is a routine build-system cleanup. It lets the firmware compile without the optional telemetry feature by replacing a hardcoded feature name with a variable. There is no security bug being fixed here.

This is a clean-up change in the build system for the Trezor hardware wallet firmware. It introduces a dedicated feature flag called 'n4w1' so the code no longer decides behavior based on the hard-coded device model 'T3W1'. There is no user-facing behavior change and no security fix or vulnerability introduced.

This is a routine dependency update by an automated bot, bumping the Python testing library pytest from version 8.4.1 to 9.0.3. It only changes version numbers and download hashes in project configuration files. There is no indication of a security fix or vulnerability in the commit itself.

This commit updates the Pillow image-processing library used by Trezor's firmware build tools from version 12.1.1 to 12.2.0. The change is a routine dependency patch intended to fix a security alert flagged by GitHub Dependabot. It only touches the lock file that records which exact package version is downloaded, so it is a defensive fix rather than a change to Trezor's own security code. The actual risk depends on what vulnerability Dependabot reported, which is not described in the commit itself.

This is a minor change to a test helper file that improves how a test checks whether a screen is the 'intro' layout for Ethereum transaction data. It does not change the actual device firmware or any user-facing behavior; it only makes the test assertion more precise. There is no indication this fixes a security issue.

This commit is a routine cosmetic update for the Trezor hardware-wallet emulator. It adds a new foreground PNG image so the emulator window shows the correct physical shape of the TS7/T3W1 device, adjusts the mock LED position, and tweaks the window size and touch offsets. There is no indication this changes any real-device firmware, cryptographic code, or security behavior.

This is a tiny test-only change that fixes an assertion in an automated UI test for Ethereum transaction signing. It makes the test check the screen title more consistently across different Trezor device models. There is no change to the actual firmware code that runs on the device, so it cannot affect real users or their crypto assets.

This commit restores an initial on-screen summary step when confirming large Ethereum transaction data on newer Trezor device layouts (Delizia and Eckhart). It is a user-experience fix, not a security patch, and does not change how transaction data is validated or signed.

This is a routine dependency update by Dependabot that upgrades the Python imaging library Pillow from version 12.1.1 to 12.2.0 inside an internal battery-testing tool. The change is a single line in a requirements file. There is no indication in the commit that this fixes a known security issue, and the tool is not part of the Trezor firmware that runs on user devices.

This commit updates the Nix package manager version used in Trezor's build containers from 2.4 to 2.31.4, and removes an unnecessary copy of a `pyright/` directory in the Docker image. These are routine CI/build maintenance changes. There is no direct evidence in the commit that this fixes a security vulnerability, though newer Nix versions may include general hardening and bug fixes.

This commit changes how the Trezor firmware build system handles source-line information in its embedded MicroPython interpreter. Previously, enabling or disabling source-line data required rebuilding the MicroPython cross-compiler. After this change, the same compiler binary can include or omit source lines via a command-line flag. This is a build-system convenience and optimization; it does not fix a vulnerability in user-facing code.

This is a build-system cleanup for Trezor firmware. It removes an unused storage cache module from a specific firmware variant (THP builds) to save about 1 kB of flash space. The code change also makes sure that when the module is excluded, the few functions that relied on it are skipped too. There is no direct security bug here, but any build-system change that alters which code is compiled into a hardware wallet deserves a quick sanity check.

This commit fixes visual alignment of icons and text on the Trezor hardware wallet's homescreen for the Eckhart layout. It adjusts where the connection indicator and device label are drawn so they line up correctly with the battery icon. There is no security relevance in this change.

This commit changes a build script to use a more portable way of writing sed commands. It replaces a non-standard regular-expression feature with one that works on macOS. There is no security relevance: the change only affects how source code is preprocessed during firmware builds and does not alter runtime behavior or introduce any vulnerability.

This commit increases the secure monitor (secmont) stack size from 12 KB to 80 KB on Trezor hardware wallets and shifts memory layout to make room for it. A larger stack reduces the chance that a security-critical component runs out of memory and misbehaves, but the change itself is a routine resource adjustment, not a proven fix for an active attack. The commit does not describe any security bug or credit a researcher.

This commit is a routine localization update. It regenerates translation files so that some on-screen text strings are left blank for certain device models or languages while keeping them present for others. There is no code behavior change, no bug fix, and no security relevance.

This commit simply removes the repository's own SECURITY.md file and updates the README to point users to the organization's default security policy on GitHub instead. It is a documentation-only change with no code modifications and no direct security impact on the firmware or device.