Trezor firmware

This commit changes a production-test configuration for the Tropic secure chip so that 'maintenance mode' is disabled before the chip leaves the factory. Maintenance mode is typically a special low-level access mode used during manufacturing and testing; leaving it enabled in shipped devices could let someone with physical access or specialized tools perform operations that should not be allowed in the field. The change is a hardening step, not a fix for an actively exploited bug.

This commit replaces a binary firmware component called 'secmon.bin' for the T3W1 hardware model. The change is a pre-built binary blob with no source diff, so from the commit alone we cannot tell what security relevance, if any, the update has.

This commit simply updates a timestamp and a matching minimum-data-version number used for Ethereum token and network definitions. It is a routine metadata refresh with no visible security relevance.

This commit simply adds a new cryptographic signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. There is no code change, no bug fix, and no visible security issue in the diff itself.

This commit is purely a documentation change: it generates the release notes (changelog) for version 0.3.6 of Trezor's internal production-test firmware. No program code was modified, so it cannot by itself introduce or fix a security vulnerability.

This update fixes a bug in how Trezor verifies ownership proofs for Bitcoin multisig wallets. Before the fix, a malicious or malformed proof could reuse the same valid signature twice and trick the device into accepting it as if two different keys had signed. The fix ensures each signature is checked against a distinct public key, so duplicate signatures are correctly rejected. The vendor marks this as a security fix.

This commit only updates the expected visual test snapshots (called UI fixtures) for the Trezor hardware wallet firmware. It changes thousands of hash values in a single test data file, but does not modify any actual firmware code, wallet logic, or user-facing behavior. There is no security-relevant change in this commit itself.

This commit is a documentation-only changelog update for the Trezor firmware 2.10.1 release. It does not change any source code, but it lists two security fixes included in the release: one for Ethereum transaction hashing and one for multisignature (multisig) verification. Because the actual code changes are not in this commit, we cannot directly assess how severe the bugs are, but the vendor labels them as security issues affecting a hardware wallet that protects cryptocurrency funds.

This commit fixes a memory corruption bug in the code that caches Bitcoin-style key derivation paths inside Trezor's cryptographic library. When a derivation path was too deep to be cached, the code could store the derived key under the wrong path label. Later, a wallet or app asking for a different deep path could receive the wrong private key, which could lead to sending funds to an attacker-controlled address or signing with the wrong key. The fix stops the cache from storing these too-deep paths, and a new test confirms the wrong-key behavior no longer happens.

This commit only updates the written changelog for Trezor legacy firmware version 1.14.1. It deletes three small draft changelog entries and adds their text to the published CHANGELOG.md file. No program code, firmware logic, or security behavior is changed. The security note about warning on long Ethereum data is a documentation of a prior change, not a new fix in this commit.

This commit is a documentation-only update that moves a changelog entry into the public release notes for Trezor legacy firmware version 1.14.1. The entry says the firmware now 'Enforce advanced recovery for mnemonics shorter than 24 words.' That wording suggests a prior security weakness: shorter seed phrases may have been recoverable using a simpler, possibly less secure method. However, the actual code change is not present in this commit, so we can only see the vendor's description of a fix, not the fix itself or how it could be attacked.

This update changes how Trezor hardware wallets confirm Ethereum transaction data. Previously, the device asked the user to approve the entire data payload before it began hashing the transaction. Now, it confirms data piece by piece while the transaction is being hashed, and only shows the final transaction summary right before signing. The change is marked as a security fix in the project's changelog, suggesting the old behavior could let a user approve data that does not match what is actually signed.

This commit refactors how Trezor handles Stellar cryptocurrency transaction confirmations when a 'payment request' is used. Previously, the device might skip confirming individual operations during payment requests. The change ensures that only simple payment operations are allowed in payment requests, rejects invalid operation types, and still requires user confirmation. It also adds a test case for an invalid operation in a payment request. The commit appears to be a defensive hardening change rather than a fix for an active exploit.

This commit replaces pre-built bootloader binary files for several Trezor hardware wallet models and updates their recorded cryptographic hashes. The change is presented as a routine version bump from older bootloader versions to version 2.1.16.0. The actual code inside the new bootloader binaries cannot be inspected from this commit, and there is no statement that the update fixes a security problem. On its own, this is a normal maintenance action rather than evidence of a vulnerability.

This commit updates the embedded QA (quality assurance) bootloader binaries and their recorded cryptographic hashes for five Trezor hardware wallet models. QA bootloaders are internal test artifacts, not the production bootloaders shipped to end users. There is no indication in the commit that this fixes or introduces a security vulnerability.

This commit is purely a documentation update: it generates the official changelog for bootloader version 2.1.16 and moves four pending changelog snippets into the published CHANGELOG.md file. No source code, firmware logic, or security behavior is changed.

This update changes how older Trezor devices (the 'legacy' T1B1 model) display long Ethereum transaction data before signing. Previously, the device only showed one screen of data, which could hide malicious content appended later in the same transaction. Now it shows up to five pages of data, and if there is still more data left, it shows a clear warning telling the user that not all data can be viewed and to proceed with caution. This is a security improvement that reduces the chance of a user approving a transaction whose full contents they have not seen.

This update changes how older Trezor devices (the 'legacy' models) restore a wallet from a recovery phrase. Previously, users could type in each word directly in order ('ScrambledWords'). Now, for phrases shorter than 24 words, the device requires the more secure 'matrix' method unless the user has deliberately lowered safety checks. The change is meant to reduce the risk that malware on a computer can spy on or manipulate the recovery words during wallet restore.

This commit only reorganizes existing text in a changelog file. It moves one security-related bullet point from a standalone 'Security' section into another 'Security' section lower down, with no changes to actual firmware code or behavior. There is no functional change to review from a security perspective.

This commit changes a GitHub Actions CI workflow so that firmware artifact sizes are reported separately for 'normal' and 'debuglink' builds instead of being merged into one list. It is purely a reporting/visibility tweak in the build pipeline and does not touch any firmware code, cryptography, or device behavior.

This commit adds a developer-only mock/emulator for a new hardware component called N4W1. It is gated behind debug builds (PYOPT='0') and only for the T3W1 device model. It does not change normal user-facing wallet behavior; it only provides a way for engineers to simulate the N4W1 chip during testing.

This commit only adds new message definitions for a debug-only feature called N4W1 emulator. It does not change any firmware logic, cryptographic code, or user-facing behavior. The messages are marked as DebugLink traffic, which is intended for testing and emulator use, not for production devices. There is no direct security vulnerability visible in this change, but adding debug interfaces always slightly increases the attack surface if those interfaces are accidentally reachable in production.

This commit is a user-experience polish change for the Trezor hardware wallet's touchscreen interface. It changes when the device vibrates (haptic feedback) in scrollable menus so that the vibration happens when the user lifts their finger and confirms a tap, rather than when they first touch the screen. This prevents confusing vibrations while the user is merely scrolling through a long menu. There is no security-relevant change here.

This is a routine code cleanup commit that removes or conditionally compiles unused Rust imports in two user-interface files. It does not change program behavior, fix a bug, or alter any security-relevant logic.

This commit adds a new automated CI job that reports the sizes of built firmware binary files. It does not change any firmware code, crypto logic, or device behavior. There is no security-relevant change.