Trezor firmware

This commit tightens which types of signed payment requests a Trezor hardware wallet will accept. Previously, the code accepted any validly-signed payment request; now it rejects requests that are not specifically 'coin swap' requests (which must contain both a coin-purchase memo and a refund memo). It also adds a check that each memo has exactly one memo type. The change appears to be a defensive hardening measure rather than a fix for an active exploit, because the commit message and diff do not describe a specific vulnerability.

This commit simply fills in a previously empty placeholder with the real production public key used to verify signed payment requests. By itself, it is a routine configuration/key-installation change, not an exploitable vulnerability. The only security-relevant observation is that before this commit, payment-request signatures using this key could not have been validated, so the feature would not have worked in production.

This commit removes the 'experimental' label from two Trezor firmware features: PaymentRequest (used in several cryptocurrency transaction flows) and GetNonce (a random-number request). It also updates generated code and tests accordingly. The change itself is a feature graduation, not a fix for a known security bug. There is no direct evidence in the commit that it patches an active vulnerability, but it does widen the audience for these features by removing the experimental opt-in requirement.

This commit is a straightforward internal code cleanup: it splits one Python/C function that handled three different reboot behaviors into three separate, clearly named functions. There is no change to what the device actually does during a reboot or firmware upgrade, and no security bug is introduced or fixed.

This update fixes a bug where rebooting a Trezor device from its on-device menu did not properly restart the Bluetooth chip (nRF). The fix makes sure the Bluetooth chip is turned off and rebooted before the device restarts, so both sides come back up in a clean, synchronized state. Without this, Bluetooth could be left in a confused or half-working state after a reboot.

This commit fixes a battery-drain bug in the Trezor bootloader that occurs when the device is left waiting for the user to confirm unofficial firmware. The old code kept the processor awake in a tight loop polling the touchscreen or buttons. The new code lets the device sleep and only wakes it when the user actually touches the screen or presses buttons, and it hibernates after 40 seconds of inactivity. There is no direct security vulnerability being patched; it is a power-management and usability fix.

This commit is a routine user-interface cleanup. It changes the on-screen 'please wait' message in three Trezor firmware layouts to use a standard text paragraph component instead of a dedicated 'Connect' component. There is no indication this fixes a security bug or changes security behavior.

This commit fixes how the Trezor hardware wallet builds on-screen confirmation flows for the newer 'Delizia' interface. Previously, the code could register a confirmation page under the wrong internal state variant (for example, adding a confirmation screen to a flow that was not supposed to have one, or using the variant meant for flows with a menu when no menu existed). The patch makes the state variant explicit and passes it into the helper functions, ensuring each page is attached to the correct flow type. A mismatch could cause the device to show the wrong screen, ignore a button press, or behave unexpectedly when a user confirms or cancels an action.

This commit is a simple code cleanup: it moves a small helper function called dummy_page() into a shared utility file so two different screens can use the same copy instead of each defining their own. There is no change to what the code does, no bug fix, and no security-relevant behavior change.

This commit only updates expected test result fingerprints (hashes) in a single JSON file used for automated UI testing. No actual product code, cryptography, or user-facing behavior was changed. It is a routine maintenance update to keep automated tests passing after unrelated UI or test changes.

This commit removes an unused 'More info' option from several on-screen confirmation helpers in the Trezor firmware. The change is a UI cleanup: screens that never actually provided extra information no longer offer a 'More info' button. There is no direct evidence in the commit that this fixed an exploitable security vulnerability.

This commit fixes undefined behavior in the Rust-based protobuf codec inside Trezor firmware. The code was reading multi-byte integers from data files that were not guaranteed to be properly aligned in memory, which can cause crashes or unpredictable behavior on some hardware. The patch ensures the data files are loaded with correct memory alignment and removes the use of 'packed' structs that forced unaligned access. It is a defensive hardening fix rather than a confirmed remote exploit.

This commit fixes a potential integer underflow bug in the Trezor hardware wallet's user interface code. The bug occurred when calculating the number of separators between menu buttons. If the menu had zero buttons, the code would try to subtract 1 from 0, causing an underflow. The fix restructures the loop so the separator is only considered after the first button, avoiding the subtraction entirely. This is a defensive fix in Rust UI code that likely prevents a crash or undefined behavior during screen layout.

This is a user-interface cleanup change for the Trezor Safe 5 (delizia layout). It removes a special narrow text style that was used only when long addresses needed a scrollbar. Because the new delizia layout no longer uses a scrollbar on these screens, the code now always uses the standard address-chunk style. The only visible effect is slightly different address formatting on some screens, and the corresponding screen-test snapshots were updated. There is no indication this affects security, cryptography, or how transactions are approved.

This is a routine tooling and documentation update. It adjusts the changelog helper script to support a new Trezor hardware model (T3W1) and to trim older changelog entries for that model. There is no change to wallet, cryptographic, or device security code.

This commit only updates firmware release notes and changelog files. It deletes draft changelog fragments and adds their contents to the published CHANGELOG files for versions 2.9.2 and 2.9.3. No source code, logic, or configuration changes are present, so it cannot introduce or fix a security vulnerability by itself.

This commit is a cleanup and hardening pass on the backlight driver for Trezor hardware wallets. It improves error handling, removes debug code, fixes a buffer-index bug in a DMA safety check, and adds memory-protection reconfiguration around the interrupt handler. The changes are defensive and reduce the chance of driver misbehavior, but they do not appear to fix a known exploitable security vulnerability in user-facing software.

This commit rewrites the backlight driver for the Trezor Safe hardware wallet's display boost circuit. It changes from 32 coarse brightness steps to 256 smoother steps by using a DMA-linked-list double-buffer to stream PWM pulse widths to the LED driver chip. The change is a feature implementation, not a security fix. There are some code-quality red flags—unused return values, commented-out error handlers, TODOs, and a commented-out infinite loop on a serious error—but nothing in the commit itself demonstrates an exploitable vulnerability.

This commit updates the backlight driver for a Trezor hardware wallet display controller. It adds smoother brightness levels by blending between the hardware's 32 brightness steps, and it improves error checking during initialization and shutdown. There is no clear security vulnerability here; it reads as a normal hardware-driver improvement.

This commit changes the firmware code that controls the screen backlight on Trezor devices using the STM32U5 chip. It adds safety checks inside the interrupt handler that runs when a DMA (direct memory access) transfer completes, so the firmware can recover if interrupts were disabled for too long and the DMA got ahead of the CPU. It also fixes a small off-by-one bug in PWM duty-cycle timing and makes several cleanup changes (comments, debug prints, disabled code formatting). There is no direct evidence in the commit or supplied references that this fixes a security vulnerability; it appears to be a robustness/reliability improvement for backlight hardware control.

This is a minor code cleanup that changes a single variable type from a signed integer to an unsigned 8-bit integer. It does not fix a security bug and does not introduce any obvious security risk. The change is purely for internal consistency in how backlight brightness levels are represented.

This commit is a routine packaging/documentation update. It renames an optional Python dependency group from 'bleak' to 'ble' and updates the README to document Bluetooth installation for newer Trezor models. There is no security-relevant code change.

This commit simply changes a version number in a Python package configuration file from 0.14.0 to 0.20.0-dev0. It is a routine development version bump with no security relevance.

This commit is purely a documentation update: it gathers individual changelog fragments into the main CHANGELOG.md file for the Python trezorlib package version 0.20.0-dev0. No program code was changed, so it cannot by itself introduce or fix a security vulnerability.

This commit only reorganizes the bootloader's written changelog. It deletes small draft files and copies their text into the main CHANGELOG.md, adding version numbers and pull-request links. No program code was changed, so this cannot introduce or fix a security bug by itself.