Trezor firmware

This commit adds a build-time warning to the Trezor firmware translation tool. It checks how large each language translation file is compared to the maximum space available on each device model, and logs a yellow warning or red error if the file is getting too close to the limit. There is no change to device runtime code, no user-facing behavior change, and no security fix or vulnerability.

This commit refactors how the Trezor hardware wallet's Rust transport protocol code validates the 'control byte' in incoming USB packets. Previously, the control byte was accepted from raw bytes without checking whether it was a known/valid value, and different parts of the code independently decided what the byte meant. Now, every incoming control byte is centrally validated against a list of allowed packet types before being used. The change also moves responsibility for handling some packet types (channel allocation and legacy codec v1) out of the channel layer into the multiplexer layer. This is a defensive hardening change that reduces the chance that a malformed or unexpected control byte could confuse the device or be misinterpreted as a different packet type.

This commit is a straightforward internal code cleanup in Trezor's Rust transport protocol library. It replaces direct creation of error values with calls to new helper functions (constructors) so developers can set breakpoints to trace where errors originate. It also removes one unused error variant (OutOfBounds) and maps those cases to MalformedData instead. There is no functional security change or bug fix visible in the diff.

This commit fixes a CI build script so that Rust test, style-check, and lint failures are properly reported. It does not change any firmware code or fix a security vulnerability in the product itself.

This commit is a routine code refactor for the Trezor hardware wallet firmware. It adds an optional 'use_std' feature to a Rust library so it can use standard Rust vector-based buffers when running on a full computer (for example, in test/example code), while keeping the no-standard-library mode for the embedded device. There is no indication of a security fix or vulnerability.

This commit refactors how a Trezor hardware wallet's Rust transport layer reports the outcome of receiving a network or USB packet. It replaces a simple success/failure result with a richer set of statuses (accepted, buffer too small, peer error, ignored, failed, route to another channel, etc.) and changes several error-handling paths so that malformed or unexpected packets are now explicitly marked as ignored or failed rather than silently treated as 'nothing happened.' The commit is labeled a refactor with no changelog and no security disclosure. The changes appear to be defensive hardening, but because the patch is partial and the surrounding protocol code is not fully shown, it is not possible to confirm whether it fixes an exploitable vulnerability or merely improves robustness.

This commit is a code refactor in Trezor's experimental THP (Trezor Host Protocol) Rust library. It splits the handling of broadcast-channel messages (channel allocation and ping/pong) into a new 'Mux' component, separate from the main encrypted channel handshake. There is no indication in the commit that this fixes a security bug; it appears to be an internal restructuring with added tests and cleaner state management.

This commit adds the device-side implementation of a new secure communication layer (THP) for Trezor hardware wallets. It introduces code that handles encrypted channels, pairing handshakes, and legacy protocol fallback. The change is a feature addition rather than a documented security fix, and the diff itself does not show an exploitable vulnerability. However, it is a large, security-critical change to firmware that will protect future host-device communication.

This commit only changes automated test code for the Evolu feature. It replaces hard-coded cryptographic proof values with dynamically generated ones so the tests pass on real hardware. There is no change to the actual Trezor firmware or any user-facing security behavior.

This commit is a routine version number bump for an internal production-testing tool (prodtest), changing only the patch version from 0.3.7 to 0.3.8. There is no functional code change and no security relevance visible in the diff or commit message.

This commit is purely a documentation update for the Trezor hardware wallet's production-test firmware. It moves two changelog entries from draft files into the published CHANGELOG.md for version 0.3.7. No code was changed, and there is nothing here that affects device security or user funds.

This commit updates the third-party STMicroelectronics RFAL NFC library inside Trezor firmware from version 3.0.1 to 4.0.2. The vendor's release notes for version 4.0.2 explicitly mention fixing a 'vulnerability during EMD handling on fast systems' that was introduced in version 4.0.0. EMD (Electro-Magnetic Disturbance) handling is part of the NFC radio stack, so the flaw is likely a low-level radio/communication issue rather than something that directly exposes cryptocurrency private keys. Because the commit is a large library drop (almost 8,000 lines changed across 55 files) and the actual code diff is not shown, we cannot independently verify the exact nature or severity of the vulnerability from this commit alone.

This commit only adds a documentation note inside a markdown file. It records that the RFAL NFC middleware was updated from version 3.0.1 to 4.0.2. No code, build scripts, or configuration files were changed.

This commit fixes a spelling mistake in a function name used during wallet recovery on Trezor hardware wallets. The old misspelled name 'show_group_thresholod' is replaced with the correct 'show_group_threshold' across all device layouts. There is no security issue here—just a typo cleanup.

This commit is a straightforward internal code cleanup in the Trezor hardware wallet's backup process. It reorganizes how backup words are displayed and confirmed, without changing what the user sees or the security checks performed. There is no indication this fixes a security bug or introduces a vulnerability.

This commit adds a key-rotation feature for the 'Evolu' / 'Suite Sync' delegated identity key used by Trezor. It introduces a rotation index that is mixed into the key derivation, lets users rotate the key on demand, and stores the current index in device storage. The change is a feature addition rather than a fix for an obvious vulnerability, but it touches sensitive key-derivation code and adds new protocol messages.

This commit adds human-readable labels for certain cryptocurrency swap transactions on Trezor hardware wallets. It does not change how transactions are validated or signed; it only improves what the user sees on the device screen. There is no direct security vulnerability in the change itself, but any mistake in the labels could mislead a user about what a transaction does.

This commit is a code refactor that reorganizes how Trezor handles Ethereum transaction display logic. It splits existing code into new modules for 'clear signing' and staking, and changes how token amounts and addresses are formatted before being shown to the user. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be preparation for supporting a new Ethereum standard (ERC-7730). However, because it touches the code that decides what users see on screen before signing transactions, any bug introduced here could affect how clearly users understand what they are approving.

This commit is a code cleanup that moves the on-screen confirmation flow for Ethereum 'clear signing' into the device's UI layout modules. It also adds a final summary screen showing the maximum transaction fee. There is no direct evidence of a security vulnerability being fixed; it appears to be a user-interface refactor. However, adding the fee summary screen is a security-relevant improvement because it gives users more complete information before they approve a transaction.

This commit changes how Trezor hardware wallets display and confirm Ethereum transactions that use 'clear signing' (human-readable descriptions of smart-contract calls). Previously, clear signing could be attempted for transactions whose data is split across multiple chunks. Now, clear signing is used only when the entire transaction data fits in the first chunk. If the clear-signing parser fails on that first chunk, the device falls back to the standard raw-data confirmation. The change is described as a feature limitation, not a security fix, but it removes a code path where multi-chunk data might be parsed before all chunks are available or confirmed.

This commit changes how the Trezor hardware wallet formats token amounts shown on screen during Ethereum transactions. It adds support for treating certain addresses as the network's native currency (like ETH on Ethereum mainnet) rather than as ERC-20 tokens when displaying amounts. There is no indication in the commit that this fixes a security vulnerability; it appears to be a user-interface correctness feature.

This commit removes built-in 'clear signing' support for the 1inch decentralized exchange from Trezor Ethereum firmware. Clear signing makes complex crypto transactions easier to read and verify on the device screen. Removing it does not create a new security hole, but users interacting with 1inch will now see less human-readable transaction details, which can make it harder to spot malicious or mistaken transactions. It is a feature rollback, not a vulnerability fix.

This commit enables Trezor hardware wallets to use SLIP-24 payment requests when signing ERC-20 token transfers. Previously, payment requests were rejected for any contract interaction, including ERC-20 transfers. The change adds a new code path that verifies the token transfer amount and recipient against a signed payment request before showing the confirmation screen. It is a feature-enablement change rather than a fix for an active vulnerability, but it touches security-critical signing flow code.

This commit only adds new automated tests for Ethereum transaction data parsing. It does not change any production code, so it cannot introduce a security vulnerability by itself. The tests verify that the device correctly rejects malformed Ethereum addresses and oversized numeric values.

This commit changes how Trezor firmware handles Ethereum transaction data (calldata). Previously, the code only tried to 'clear sign' transactions where the entire calldata fit in the first chunk. Now it stores and processes up to 4 KB of calldata across multiple chunks, and gives up gracefully if the data is too large. The change appears to be a hardening/capacity improvement rather than a fix for an active exploit, but it removes a risky assumption that all data is present in the initial chunk.