Trezor firmware

This commit adds emulator-only support for a new Trezor device (T3W1) to wake from a simulated low-power sleep state when the user taps the emulated touchscreen. It only affects the software emulator build, not real hardware, and does not change how secrets or user data are handled. There is no indication this is a security fix.

This commit corrects the wrong GPIO pin assignment for the interrupt line of the Tropic01 secure chip on Trezor T3W1 hardware revisions A, B, and C. Previously the interrupt pin was set to the same pin as the power-control line, which does not match the hardware schematic. The commit message says this interrupt pin has not been used so far, so the practical security impact appears low.

This commit only changes release dates in seven changelog files, moving the stated release date from 21 May 2026 to 14 May 2026. No executable code, configuration, or security-related content is modified.

This commit simply changes release dates in seven changelog files from 14 May 2026 back to 21 May 2026. It is a reversion of an earlier date-change commit. There is no code change and no security relevance.

This commit replaces the signed bootloader binary for the Trezor T3W1 hardware wallet model and updates the matching cryptographic hash list. The change is a routine version bump from bootloader version 2.1.16.0 to 2.1.17.0. The commit message and diff provide no information about why the bootloader was rebuilt or whether any security issue was fixed. Because the actual bootloader binary is a compiled blob, its contents cannot be reviewed from this diff alone.

This commit updates a QA/testing bootloader binary and its recorded cryptographic hash for the T3W1 hardware model. It is a routine development chore with no visible security fix or vulnerability.

This commit is a documentation-only changelog update for the Trezor firmware releases core 2.11.2 and bootloader 2.1.17. It does not change any code. The changelog lists several previously fixed security issues, including bugs in Solana account handling, EIP-712 domain caching, and an out-of-memory fix. Because the actual code changes happened in earlier commits, this single commit cannot introduce or directly fix a vulnerability, but it confirms the vendor considers multiple items security-relevant for the release.

This commit updates the on-screen confirmation prompts shown when signing Stellar transactions on Trezor hardware wallets. It does not change how transactions are validated or signed, but it reorganizes and improves the clarity of what the user sees before approving. The changes are purely user-interface related, with updated test snapshots reflecting the new screen layouts.

This commit is a user-interface improvement for Tron (TRX) transfers on Trezor hardware wallets. It changes the on-device confirmation screens to show the sending account name, derivation path, recipient address, and amount in a clearer layout. There is no indication it fixes a security vulnerability; it is a usability and consistency refactor.

This commit is a routine housekeeping change that only updates version numbers in several files. It does not change any program logic, fix any bug, or alter any security behavior. There is nothing here that could be exploited or that affects user security.

This commit adds a user-facing 'Tap to Wake' on/off toggle to the device menu on the Trezor T3W1 hardware wallet. It stores the preference in device storage and applies it at startup and when settings are reloaded after unlocking. There is no security issue visible in the change.

This commit is a straightforward build-system wiring change for the Trezor T3W1 hardware wallet. It enables a feature called USE_TOUCH_WAKEUP, which lets the device wake from a low-power suspend state when the touch screen is touched. The change only affects how firmware is compiled for specific T3W1 revisions and does not alter security-critical code, cryptographic operations, or user data handling. There is no indication this is a security fix or vulnerability patch.

This commit updates Czech translation strings and refreshes the digital signatures that authenticate those translations, plus updates expected test screenshots. There is no code change that affects security behavior, cryptography, or how the device protects secrets. It is a routine localization maintenance patch.

This commit is a hardening change to Trezor's build tooling. It tells the Python package manager 'uv' not to use any package uploaded to PyPI in the last 30 days, which reduces the risk of accidentally pulling in a freshly compromised dependency. It also downgrades the 'Mako' template library from 1.3.12 to 1.3.10 and switches the build system from 'hatchling' to 'flit' in several sub-projects. The commit message explicitly says the goal is to limit supply-chain compromise exposure.

This commit adds support in Trezor's Ethereum 'clear signing' feature for two new data shapes: nested arrays (arrays inside arrays) and fixed 32-byte values (bytes32). It also renames an internal helper function from `_request_definitions` to `request_definitions`. The changes are framed as a normal feature addition with no changelog entry. There is no direct evidence in the commit that this fixes a security vulnerability, but any change to transaction parsing logic can affect how the device interprets maliciously crafted data.

This commit is a code cleanup, not a security fix. It creates a new, more specific error type called AuthenticationError and changes AES-GCM and ChaCha20-Poly1305 decryption to throw that error instead of a generic RuntimeError when authentication fails. It also updates the Python code that catches those errors to catch the new type. The cryptographic behavior itself is unchanged.

This commit adds a new utility function called `consteq` that compares two chunks of memory in a way that takes the same amount of time regardless of how similar the chunks are. It is intended to help prevent timing-based attacks in the future, but the commit itself only extracts and compiles the helper; it does not change any existing security-sensitive comparison or fix a known vulnerability.

This commit hardens how Trezor devices verify AES-GCM authentication tags during decryption. Previously, callers computed the tag and then compared it separately using a constant-time helper. Now the comparison is performed inside the cryptographic finish routine itself, using a constant-time equality check. This reduces the risk that a future caller forgets to verify the tag or uses a non-constant-time comparison, which could allow an attacker to tamper with encrypted messages or recover secrets through timing analysis.

This commit only changes Python unit tests for the AES-GCM cryptography code in the Trezor firmware. It updates existing tests to pass an expected authentication tag to the finish() method and adds new tests that check the code correctly rejects missing, wrong-length, or invalid tags. There is no change to the actual cryptographic implementation or firmware behavior, so this commit does not introduce or fix a live security vulnerability by itself.

This commit only changes Python unit tests for the ChaCha20-Poly1305 encryption code in the Trezor firmware test suite. It does not modify the actual cryptographic implementation, device firmware, or any production code. The changes add test cases to verify that decryption correctly requires and validates the authentication tag (MAC). There is no security vulnerability in this commit itself.

This commit hardens how a Trezor hardware wallet checks the authentication tag when decrypting data protected by the ChaCha20-Poly1305 cipher. Previously, the Python caller compared the expected tag with the computed tag using a helper called utils.consteq. Now the comparison is done inside the low-level C module using a constant-time equality function, and decryption callers must pass the expected tag directly to finish(). This reduces the risk of a developer forgetting to verify the tag or using a non-constant-time comparison, which could let an attacker tamper with encrypted secrets.

This commit is a routine code cleanup (chore) that splits one combined ChaCha20-Poly1305 encryption/decryption class into two separate classes: one for encryption and one for decryption. It does not fix a security bug, add a new feature, or change cryptographic behavior. All existing callers are updated to use the appropriate new class. The change is purely structural and makes the API clearer.

This commit is a routine code cleanup that splits one combined AES-GCM encryption/decryption class into two separate classes: one for encryption and one for decryption. It does not fix a security bug or introduce a new vulnerability. The change makes the API clearer and prevents accidental misuse, such as trying to decrypt with an encryption-only object.

This is a tiny user-interface bug fix. It moves a translation lookup so that the 'Enter PIN' message is shown in the correct language on the boot screen instead of always appearing in English. There is no security vulnerability here.

This is a routine code reorganization in the Python trezorlib library. It moves two helper classes into a new module and moves a user-interface file into the command-line interface package. No security-sensitive behavior is changed, no bugs are fixed, and no vulnerabilities are introduced.