Trezor firmware

This commit is a documentation-only update that moves a changelog entry into the public release notes for Trezor legacy firmware version 1.14.1. The entry says the firmware now 'Enforce advanced recovery for mnemonics shorter than 24 words.' That wording suggests a prior security weakness: shorter seed phrases may have been recoverable using a simpler, possibly less secure method. However, the actual code change is not present in this commit, so we can only see the vendor's description of a fix, not the fix itself or how it could be attacked.

This commit only updates the written changelog for Trezor legacy firmware version 1.14.1. It deletes three small draft changelog entries and adds their text to the published CHANGELOG.md file. No program code, firmware logic, or security behavior is changed. The security note about warning on long Ethereum data is a documentation of a prior change, not a new fix in this commit.

This update changes how older Trezor devices (the 'legacy' models) restore a wallet from a recovery phrase. Previously, users could type in each word directly in order ('ScrambledWords'). Now, for phrases shorter than 24 words, the device requires the more secure 'matrix' method unless the user has deliberately lowered safety checks. The change is meant to reduce the risk that malware on a computer can spy on or manipulate the recovery words during wallet restore.

This commit only adds new message definitions for a debug-only feature called N4W1 emulator. It does not change any firmware logic, cryptographic code, or user-facing behavior. The messages are marked as DebugLink traffic, which is intended for testing and emulator use, not for production devices. There is no direct security vulnerability visible in this change, but adding debug interfaces always slightly increases the attack surface if those interfaces are accidentally reachable in production.

This commit adds a developer-only mock/emulator for a new hardware component called N4W1. It is gated behind debug builds (PYOPT='0') and only for the T3W1 device model. It does not change normal user-facing wallet behavior; it only provides a way for engineers to simulate the N4W1 chip during testing.

This commit is a user-experience polish change for the Trezor hardware wallet's touchscreen interface. It changes when the device vibrates (haptic feedback) in scrollable menus so that the vibration happens when the user lifts their finger and confirms a tap, rather than when they first touch the screen. This prevents confusing vibrations while the user is merely scrolling through a long menu. There is no security-relevant change here.

This is a routine code cleanup commit that removes or conditionally compiles unused Rust imports in two user-interface files. It does not change program behavior, fix a bug, or alter any security-relevant logic.

This commit only adds two new user-facing text strings ('Confirm contract' and 'Intent') to the Trezor firmware's translation system. It does not change any code logic, security checks, or transaction handling. There is no indication this is a security fix or introduces a vulnerability.

This commit adds support for a new TRON blockchain operation called VoteWitnessContract to Trezor hardware wallets. It lets users vote for up to 9 TRON network validators (called Super Representatives) directly from the device, with on-screen confirmation before signing. There is no indication this fixes a security bug; it is a feature addition.

This commit simply downgrades two GitHub Actions helper tools used in automated hardware testing workflows. The change is described as fixing test failures caused by incompatible runners. There is no indication this affects the Trezor firmware itself, user funds, or device security.

This commit simply removes two unused header file includes from source files in the secure AES module. It is a routine cleanup with no functional code changes and no security relevance.

This is a minor build-script cleanup. It removes a check that would stop the build if the microcontroller (MCU) type was not one of two explicitly known families. Now any other recognized MCU falls through to a default binary-generation path. There is no security-relevant change in behavior for supported devices, and no bug or vulnerability is introduced by the diff itself.

This commit is a hardening change, not a vulnerability fix. It pins all GitHub Actions used by Trezor's firmware build and test pipelines to specific commit hashes instead of version tags, and updates those actions to their latest released versions. Pinning prevents a compromised action publisher from silently replacing a trusted tag with malicious code. There is no evidence of an actual supply-chain attack or any bug being fixed beyond this preventive measure.

This commit only changes the test code for the Trezor firmware. It fixes how debug logging is suppressed during unit tests by moving the suppression logic into the shared test runner, instead of having each test file call a helper function. There is no change to the actual wallet firmware that users rely on, and no security vulnerability is being fixed.

This commit fixes a cleanup issue in the code that creates cryptocurrency signatures on Trezor hardware wallets. In several error paths, secret intermediate numbers (including a copy of the private key and random nonce values) were left in memory instead of being securely erased. The patch makes sure those values are wiped even when the function exits early due to an invalid key or other failure. This reduces the risk that sensitive signing material could leak if memory is later read by another process or attacker.

This commit fixes a cleanup oversight in the Trezor firmware's code that handles NEM cryptocurrency encryption and decryption. Previously, if an encryption or decryption operation failed partway through, the temporary AES key context (a small chunk of memory holding sensitive key material) was not securely wiped before the function returned. The patch ensures this memory is always zeroed out, even on error paths, reducing the risk that leftover cryptographic key bits could leak to other code or be recovered later. It is a defensive hardening fix rather than a demonstrated exploitable bug.

This commit fixes a small cleanup bug in the code that creates Ed25519 digital signatures in Trezor hardware wallets. When a certain rare mathematical check fails, the function now securely wipes two temporary secret values from memory before returning an error. Without the fix, those temporary secrets could remain in memory longer than intended. This is a defense-in-depth improvement rather than a confirmed exploitable vulnerability.

This commit fixes a bug in the Cardano cryptocurrency key derivation code for Trezor hardware wallets. Previously, if a certain error path was hit during key derivation, the function would return early without wiping sensitive intermediate values from memory. The fix ensures those temporary secrets are always cleared, even when the function fails partway through. It also adds cleanup for a couple of additional temporary buffers that were not being wiped before.

This commit is a routine version number update. It changes patch version numbers from 2.11.0 to 2.11.1 for the modern Trezor firmware and from 1.14.1 to 1.14.2 for the legacy firmware, updates matching translation file headers, and refreshes a translation signature file. There are no code logic changes, no bug fixes, and no security-related modifications visible in the diff.

This commit is a routine user-interface fix for the Trezor hardware wallet's 'Caesar' layout. It swaps a hard-coded English string ('Locking the device...') for a localizable translation key and slightly increases the on-screen margin so longer translated text fits. The remaining changes are only updated test screenshot fingerprints, which is expected when any visible text changes. There is no security issue here.

This commit introduces a new build flag called DEBUGLINK that controls whether Trezor firmware is compiled with debug/test-only USB and screen-recording features enabled. It does not add new runtime behavior; it mostly reorganizes when these debug features are included. The change makes debug builds more explicit, but it also means enabling DEBUGLINK (or disabling optimizations via PYOPT=0) automatically turns on the debug USB interface and screen recording. In a production device this could be risky, but the commit itself is a build-system refactor and the features remain off by default for production builds.

This commit adds a debug-only feature to the Trezor bootloader that lets automated testing tools talk to the bootloader over a special USB debug channel. It is controlled by a build-time flag (DEBUGLINK=1) and is not enabled in normal production firmware. The feature can read screen contents, simulate button presses and touch events, and record the screen. It does not appear to be a vulnerability by itself, but it is a powerful debugging interface that must remain disabled in production devices.

This commit adds a way to turn off progress animations in the Trezor bootloader. When animations are disabled, the progress value is forced to 0 so the screen does not show a moving progress bar. There is no direct security fix here; it is a user-experience or accessibility change, likely to support a setting that disables animations.

This commit updates the Python image-processing library Pillow from a vulnerable version to a fixed one, but only for users running Python 3.10 or newer. The commit message explicitly says it fixes an out-of-bounds write vulnerability in Pillow, and that the vulnerable library is only used by a command-line helper tool called toiftool, not by the Trezor firmware that runs on the hardware wallet itself. So the security risk is limited to developers or build machines that use that helper tool with Python 3.10+.

This is a small GitHub Actions CI workflow change. It tells the workflow to upload build artifacts even when a previous build step fails. This is a normal reliability/debugging improvement and does not change any firmware code, cryptography, or device behavior. There is no security issue visible in this commit.