Trezor firmware

This commit changes only a single word inside a code comment, correcting the name of a function referenced in the comment text. No executable code, logic, or behavior was modified.

This commit is a straightforward internal code cleanup in the Trezor firmware's wallet recovery flow. It moves the responsibility for showing error screens from the layout code into the exception classes themselves, without changing what errors are detected or how the recovery process behaves. There is no indication this fixes a security bug or introduces a vulnerability.

This is a code cleanup (refactor) of the wallet recovery flow in Trezor firmware. It restructures how the device asks users to enter backup/recovery words and removes an unused helper function. There is no indication of a security fix or behavior change that would affect user funds or device security.

This commit is a straightforward code cleanup: it moves a confirmation screen that appears during wallet recovery from one file to another, so the same screen is still shown but in a more appropriate place. There is no security-relevant change.

This is a routine dependency update by an automated bot, bumping the Python 'ecdsa' library from version 0.16.1 to 0.19.2 in Trezor's firmware build tooling. The commit itself only changes version numbers and download hashes; it does not show any actual code fix or vulnerability. Dependency updates can sometimes include security fixes, but this commit does not say that is the reason, and no verified security references were provided.

This is a one-line change to Trezor's GitHub Actions CI workflow. It adjusts how the build system checks whether the Rust dependency lockfile (Cargo.lock) has changed. Previously it compared against the main branch; now it compares against the pull request's base branch (the branch the PR targets). This is a normal CI correctness fix and has no direct security relevance.

This is an automated dependency update by Dependabot that bumps the Python 'cryptography' library from version 46.0.5 to 46.0.6 in the project's lock file. The commit itself only changes package hashes and download URLs; it does not modify Trezor's own code. The 'cryptography' library is widely used for encryption and secure communications, so keeping it up to date is generally good security hygiene. However, the commit message does not say this update fixes any specific security problem, and no verified references were provided. Therefore, while dependency updates can address vulnerabilities, we cannot confirm from this commit alone that a particular security issue is being fixed.

This commit is a pure code-style cleanup in the Ethereum 'clear signing' module. It removes unnecessary extra parentheses around tuple unpacking assignments. There is no functional change, no security fix, and no behavior change to the hardware wallet's transaction handling.

This commit is purely a code-style cleanup triggered by an update to the Python formatter 'black'. It removes unnecessary parentheses around tuple unpacking and adjusts some string-literal formatting. There is no functional change and no security relevance.

This commit is a routine dependency update for a Python code-formatting tool called 'black' used during development. It only changes the project's lock file (uv.lock), which records exact package versions. There is no change to the Trezor firmware code that runs on the device, no mention of a security fix, and no indication this introduces a vulnerability.

This commit corrects a single-word typo in a code comment. The docstring said the function raises KeyError, but the actual code raises NoWireContext. There is no functional code change and no security impact.

This commit only adds a new automated test to the Trezor firmware test suite. The test checks that the host-side software correctly raises an error when it receives a tampered handshake response from a Trezor device during the THP (Trezor Host Protocol) handshake. It does not change any device firmware code, fix a bug, or introduce a security vulnerability.

This commit simply turns off very detailed internal debug logging in the Trezor hardware wallet's core firmware to make automated tests run faster. It does not change any security logic, encryption, or how the device protects secrets. The logging was already only present in debug builds and never exposed sensitive data in production firmware.

This commit updates a Rust helper library called heapless from version 0.8.0 to 0.9.2 inside the Trezor firmware. The change is described as a routine dependency update. The commit message points to the upstream changelog but no specific security issue is mentioned, and no independent security references were provided. The actual code change is just a version bump and a small import-path adjustment in a code-coverage module. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but dependency updates can sometimes include security fixes from upstream.

This is a minor build fix that makes a Bluetooth UI component only import LED-related code when the device actually has an RGB LED feature. It prevents compilation errors on devices without that hardware feature. There is no security issue here.

This commit only adds new user-facing text strings (labels like 'Deposit amount', 'Withdraw', 'Your address') for an upcoming Ethereum ERC-4626 vault feature. It also moves one existing word ('Deposit') from a Cardano-only string to a shared word list. There are no code logic changes, no security fixes, and no behavior changes in how the device handles transactions or private keys.

This commit changes the order in which Trezor's Python library tries different ways to connect to a hardware wallet, and switches from an unordered collection to an ordered list. The practical effect is that if newer direct connection methods (USB, Bluetooth, etc.) are unavailable, the library will fall back to the older 'bridge' method. This is a reliability/usability fix, not a clear security patch. There is no vendor statement that this fixes a security vulnerability.

This is a routine automated update by Dependabot that bumps the Python library cbor2 from version 5.8.0 to 5.9.0 in the project's lock file (uv.lock). Only hashes and download URLs for the package changed. There is no indication in the commit itself that this fixes or introduces a security problem. Without checking the upstream cbor2 release notes, we cannot say whether the new version addresses any vulnerabilities.

This commit removes a small piece of Rust code that manually marked a font data structure as safe to share between threads. The commit message calls it a cleanup ('chore') and gives no security context. On its own, the change is minor and defensive, but the reason for the original unsafe marker and its removal is not explained in the materials provided.

This is a routine automated dependency update by Dependabot. It changes the pinned version of the Python 'requests' library from 2.32.5 to 2.33.0 in the project's lock file only. There is no indication in the commit that this fixes a security issue, and the change itself is just a version/hash update with no code modifications.

This commit fixes a bug in the Python Trezor client library that could cause it to crash or fail to connect when probing a Trezor device. The problem happened when leftover or unrelated data packets were still sitting in the communication channel. Previously, the library would see an unexpected packet, treat it as a protocol error, and give up. Now it skips those unrelated packets and waits for the real response. This is a reliability and minor security improvement for the host-side software, not the hardware wallet firmware itself.

This commit replaces the standard Python math.log() function with a custom integer-only log2 function inside the Monero bulletproof code on Trezor devices. The change appears to be a cleanup or performance refactor to avoid using floating-point math in cryptographic code. There is no direct evidence in the commit that this fixes an active security vulnerability, but using integer math instead of floating-point approximations in cryptography is generally considered safer and more predictable.

This commit simply turns off two unused MicroPython language features—the math module and complex numbers—to save about 11 kB of flash storage on the Trezor device. There is no indication this fixes a security bug or changes how user funds or secrets are handled.

This commit only adds new on-screen text strings for a future backup feature called N4W1. It does not change any security logic, cryptographic code, or user-accessible behavior. There is no indication of a vulnerability or security fix.

This commit adds a build-time warning to the Trezor firmware translation tool. It checks how large each language translation file is compared to the maximum space available on each device model, and logs a yellow warning or red error if the file is getting too close to the limit. There is no change to device runtime code, no user-facing behavior change, and no security fix or vulnerability.