CommitWatch RSS
TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

2661 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue1354AI analyses
343commits · 30 days
588commits · 60 days
1363commits · 180 days
2653commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1321Adequate · 60–79
862Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
PrisionMike945982273
Andrew Kozlik712436265
Roman Zeyde572177253171
tychovrahe292104125161
Jakub Janků22917182
Martin Pastyřík23811173
cepetr19682103059
Ioan Bizău23076140059
obrusvit21376107064
M1nd3r20671105071
Lukas Bielesch846771067
Martin Milata1744677063
Analysis record

Published AI watches

Last scanned 16 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ProjectProfile to ProjectConfig

This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…

581b37bcby cepetr+18−182 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce ResolvedBuildArgs

This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…

c24d1be8by cepetr+99−295 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): make build args tristate

This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…

271e249aby cepetr+57−561 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce build options

This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…

75085e2aby cepetr+275−2007 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce build presets

This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…

eefe8f7fby cepetr+397−419 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): upgrade manifest.yaml for tf-tools 0.3.0

This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…

57b28b89by cepetr+86−1351 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add tf-tools 0.3.1+ configuration file

This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…

e554f618by cepetr+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ResolvedBuild to ResolvedBuildFeatures

This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…

aaa2780bby cepetr+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix up clippy warnings in storage.rs

This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…

62354461by cepetr+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): simplify dependencies

This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…

6268349fby cepetr+9−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

docs: add xtask documentation

This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …

4879dababy cepetr+296−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): fix nightly ARM emulator filename

This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…

ab95f08fby Martin Milata+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): avoid micropython submodule noise in git status

This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.

06cab32bby Martin Milata+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatechore(common): add protobuf style checkby M1nd3r · a570b95e · Mar 2, 2026 · 30 filesMessage 80 · StrongInformational 15Details
Commit message · M1nd3r

chore(common): add protobuf style check

- Adjusted `.clang-format` for use with Proto files.
- Added `protostyle` and `protostyle_check` to `Makefile`, included them in `style` and `style_check` respectively.
- Formatted all `.proto` files, adjusted comments.
- Added a few echo statements to `Makefile` rules.

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathboot or update pathauthentication path
AI analysis · Informational 15/100

This commit is purely a code-style cleanup. It adds a protobuf formatter check to the project's build tooling and reformats all .proto definition files. There are no functional changes to the firmware, no protocol changes, and no security fixes or vulnerabilities introduced.

Security candidateci(core): avoid running `core_ui_comment` job for other repositoriesby Roman Zeyde · b7c1c49f · Feb 27, 2026 · 1 fileMessage 89 · StrongInformational 15Details
Commit message · Roman Zeyde

ci(core): avoid running `core_ui_comment` job for other repositories

Otherwise, it fails on `aws-actions/configure-aws-credentials`.

[no changelog]

89/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
credential or privilege statedocumentation-only discount
AI analysis · Informational 15/100

This is a minor GitHub Actions CI workflow tweak. It adds an extra condition so a job that posts UI comparison comments only runs in the official Trezor firmware repository, preventing harmless failures when the workflow runs in forks or other repositories. There is no product security issue.

Security candidatechore: `flow_confirm_output` afueraby Ioan Bizău · 76d7c19c · Feb 26, 2026 · 14 filesMessage 47 · ThinInformational 15Details
Commit message · Ioan Bizău

chore: `flow_confirm_output` afuera

[no changelog]

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit removes an old, duplicated screen called flow_confirm_output and makes the confirm_output function always use the newer confirm_value-based flow. There is no security bug being fixed here; it is a cleanup that unifies how transaction recipient and amount confirmations are shown on newer Trezor device layouts.

Security candidatechore(core): bump version to 2.11.0by Roman Zeyde · 83cae339 · Feb 25, 2026 · 8 filesMessage 72 · AdequateInformational 15Details
Commit message · Roman Zeyde

chore(core): bump version to 2.11.0

Following secmon downgrade protection (e2bfa90870).

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
update trustsigning or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a routine version bump from 2.10.2 to 2.11.0 for the Trezor firmware. It only changes version numbers in a header file and translation metadata, plus updates the signed translation package fingerprint. There are no code behavior changes, bug fixes, or security patches in this diff itself.

Security candidaterefactor(core): split secret, make it optional, add compile flags based on presenceby tychovrahe · 520f9ab7 · Feb 25, 2026 · 39 filesMessage 62 · AdequateLow 34Details
Commit message · tychovrahe

refactor(core): split secret, make it optional, add compile flags based on presence

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Low 34/100

This commit reorganizes how Trezor firmware handles secret keys and the 'secret' subsystem. It splits key-handling code into a new optional component (secret_keys), adds compile-time flags (USE_SECRET and USE_SECRET_KEYS) so different device models can include or exclude these features, and updates the build configuration for every supported model. The change is a structural refactor, not a direct security fix, but it touches sensitive code paths that protect device secrets and storage encryption.

Security candidatebuild(core): exclude src if feature not availableby obrusvit · a701a487 · Feb 24, 2026 · 2 filesMessage 80 · StrongInformational 15Details
Commit message · obrusvit

build(core): exclude src if feature not available

- exclude authenticate_device if Optiga not present (i.e. T2T1)
- exclude set_backlight if backlight feature not available (i.e.
T2B1/T3B1)
- the handlers for these files were already correctly excluded from
`workflow_handlers.py`

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This is a routine build-system cleanup for the Trezor hardware wallet firmware. It makes sure that certain device-specific source files (for example, code that talks to a security chip called Optiga, or code that adjusts screen backlight) are only included in firmware builds for devices that actually have those hardware features. There is no indication this fixes a security vulnerability or changes runtime behavior on supported devices.

Security candidatefeat(tron): Release Tron features to prodby PrisionMike · f831cfb8 · Feb 23, 2026 · 11 filesMessage 57 · ThinInformational 15Details
Commit message · PrisionMike

feat(tron): Release Tron features to prod

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit simply turns on Tron (TRX) support in Trezor firmware for all users. It moves Tron code from debug-only builds into normal production builds, updates support lists, and refreshes test snapshots. There is no bug fix or security patch here—just a feature release.

Security candidatefix(tron,ui): use fee_limit instead of max_fees.by PrisionMike · c59e11a5 · Feb 23, 2026 · 5 filesMessage 80 · StrongInformational 15Details
Commit message · PrisionMike

fix(tron,ui): use fee_limit instead of max_fees.

Tron specific labels.
Fixes: TRON: Use `Maximum Fees` instead of `Fee limit`
Fixes #6320

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only changes the on-screen label shown to Trezor users when confirming TRON transactions. The text 'Maximum Fees' is replaced with 'Fee limit' to match TRON-specific terminology. No transaction logic, fee calculation, or security behavior is changed.

Security candidatefix(tron): Use new button request namesby PrisionMike · 30c4e53f · Feb 23, 2026 · 5 filesMessage 57 · ThinInformational 15Details
Commit message · PrisionMike

fix(tron): Use new button request names

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit simply renames internal labels used for Tron transaction confirmation screens across different Trezor device layouts. The old names like 'confirm_tron_send' are replaced with newer names like 'tron/send'. There is no visible security change—just keeping naming conventions consistent.

Security candidatetest: allow setting `unfinished_backup` flag in storageby Roman Zeyde · 131fde9c · Feb 20, 2026 · 8 filesMessage 72 · AdequateInformational 21Details
Commit message · Roman Zeyde

test: allow setting `unfinished_backup` flag in storage

[no changelog]

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 21/100

This commit adds a new test-only debug option called `unfinished_backup` to the Trezor hardware wallet's device-loading tools. It lets developers set an internal storage flag that marks a backup as incomplete. The change only affects debug/test code paths and does not alter normal user-facing wallet behavior. There is no indication in the commit that this fixes or introduces a security vulnerability.

Security candidatefeat(eckhart): external menu on `confirm_action`by Ioan Bizău · 2ecf2d90 · Feb 20, 2026 · 1 fileMessage 57 · ThinInformational 18Details
Commit message · Ioan Bizău

feat(eckhart): external menu on `confirm_action`

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 18/100

This commit updates the user interface code for the Trezor hardware wallet's 'Eckhart' layout. It makes the optional external menu actually appear when requested, by adding a menu icon to the screen header and passing the setting through to the screen component. There is no direct evidence this fixes a security vulnerability; it appears to be a normal UI feature implementation.

Security candidatefeat(eckhart): disable cancel on `confirm_action`by Ioan Bizău · 773b1cb6 · Feb 20, 2026 · 8 filesMessage 57 · ThinInformational 21Details
Commit message · Ioan Bizău

feat(eckhart): disable cancel on `confirm_action`

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 21/100

This commit adds a new option to Trezor's on-screen confirmation dialogs that lets developers hide the cancel/cross button on the new 'Eckhart' device layout. It does not remove cancel from existing layouts, and the default behavior keeps the cancel button visible. The only place it is currently used is in one voting-related screen, where the user is still shown a 'Continue' button and can navigate back via an external menu. There is no direct evidence this is a security fix or vulnerability patch.

Security candidatechore: drop `ConfirmOutputWithSummary`by Ioan Bizău · 8a6123bb · Feb 20, 2026 · 12 filesMessage 62 · AdequateInformational 15Details
Commit message · Ioan Bizău

chore: drop `ConfirmOutputWithSummary`

At this point the whole `ConfirmOutputWithSummary` sub-flow is unused,
so we can just drop it.

[no changelog]

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit removes an unused user-interface flow called ConfirmOutputWithSummary from the Trezor firmware. It is a code cleanup: no security vulnerability is fixed or introduced, and no behavior that users currently rely on is changed.

Security candidatefeat(eckhart): external menu on `confirm_summary`by Ioan Bizău · e8004a85 · Feb 20, 2026 · 4 filesMessage 57 · ThinInformational 17Details
Commit message · Ioan Bizău

feat(eckhart): external menu on `confirm_summary`

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 17/100

This commit updates the user interface code for the Trezor hardware wallet's newer 'Eckhart' layout. It adds support for an optional 'external menu' on the transaction summary confirmation screen, replacing the older internal menu when requested. The change is a UI refactor and feature flag wiring; it does not appear to fix or introduce a security vulnerability.

Security candidatefix(eckhart): don't show useless headerby Ioan Bizău · 51b2d9ad · Feb 20, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Ioan Bizău

fix(eckhart): don't show useless header

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This is a minor user-interface polish change for the Trezor hardware wallet's Eckhart layout. It hides a redundant header label when the header text is identical to the title text. There is no security relevance in the commit itself or in the supplied references.

Security candidatefeat(core/thp): bump THP version to 2.1by Roman Zeyde · 4c5b6fb6 · Feb 19, 2026 · 2 filesMessage 85 · StrongInformational 15Details
Commit message · Roman Zeyde

feat(core/thp): bump THP version to 2.1

It will be used by the host to detect device ACK piggybacking support.
Done in a subsequent commit, since it affects the pairing code entropy
- resulting in UI fixture diffs.

[no changelog]

85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomness
AI analysis · Informational 15/100

This commit simply changes a reported protocol version number from 2.0 to 2.1 in Trezor's THP (Trezor Host Protocol) code and updates the corresponding automated test snapshot hashes. There is no security fix or vulnerability present in the change itself. It is a preparatory feature commit to let host software detect an upcoming capability called 'device ACK piggybacking.'

Security candidatefeat(core/thp): support receive-side THP ACK piggybackingby Roman Zeyde · 0d383d03 · Feb 19, 2026 · 5 filesMessage 100 · StrongInformational 20Details
Commit message · Roman Zeyde

feat(core/thp): support receive-side THP ACK piggybacking

The host will detect device support via the bumped minor version
(from `2.0` to `2.1`) - will be done in a subsequent commit, since
it affects the pairing code entropy - resulting in UI fixture diffs.

The device will detect host support via the
ACK bit of `HANDSHAKE_INIT_REQ` message (previously set to 0).

Due to event loop restarts, the last message sent to the host should
be ACKed using a non-piggybacked THP ACK message.
Otherwise, the piggybacking message will be dropped and the host will
need to re-transmit it.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomnessparser or protocol path
AI analysis · Informational 20/100

This commit adds a new optional efficiency feature to Trezor's THP (Trezor Host Protocol) that lets acknowledgements (ACKs) be attached to normal messages instead of sent separately. It is a feature implementation, not a fix for a known vulnerability. The change includes a compatibility handshake so older hosts fall back to non-piggybacked ACKs. There is no direct evidence in the commit that this introduces a security bug, but any protocol change carries some risk of subtle state-machine issues.

Security candidatefeat(core/bootloader): show build version numbersby tychovrahe · 817ea6b9 · Feb 19, 2026 · 2 filesMessage 57 · ThinInformational 15Details
Commit message · tychovrahe

feat(core/bootloader): show build version numbers

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
update trustboot or update path
AI analysis · Informational 15/100

This commit is a minor user-interface change in the Trezor bootloader. It simply adds the build version number to the version string shown on screen. There is no security issue here.

Security candidatefix(core/bootloader): fix bootloader warning icon placement on Safe 3by tychovrahe · a6a651e6 · Feb 19, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · tychovrahe

fix(core/bootloader): fix bootloader warning icon placement on Safe 3

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
update trustcryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit fixes a visual layout bug in the Trezor Safe 3 bootloader. A warning icon was being placed at the top-left of the screen instead of the top-right. The change simply moves the icon to the intended corner. There is no security issue here—only a cosmetic correction.

Security candidatefeat(tron): clear sign Approve flowby PrisionMike · 328cd08d · Feb 18, 2026 · 8 filesMessage 57 · ThinLow 27Details
Commit message · PrisionMike

feat(tron): clear sign Approve flow

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 27/100

This commit improves how Trezor devices display Tron token approval transactions on screen. Previously, only simple transfers were shown clearly; now the device also clearly shows when a user is approving someone else to spend their tokens, including unlimited approvals and revocations. This is a security-hardening change that helps users avoid accidentally signing risky approvals.

Security candidatechore(core): support subtitle on Delizia `should_show_more()`by Roman Zeyde · 9922ba0c · Feb 17, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

chore(core): support subtitle on Delizia `should_show_more()`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This is a small user-interface feature patch that adds support for displaying an optional subtitle in a Trezor hardware wallet screen flow. It does not change security logic, cryptography, memory handling, or user confirmation behavior. There is no indication this commit fixes or introduces a security issue.

Security candidatefeat(core): add iterative data confirmation flowsby Roman Zeyde · 3fe21362 · Feb 17, 2026 · 4 filesMessage 57 · ThinInformational 14Details
Commit message · Roman Zeyde

feat(core): add iterative data confirmation flows

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 14/100

This commit adds new UI helper functions across four Trezor device themes to let users confirm long pieces of data (like transaction details or messages) in chunks, showing a prefix of bytes and asking whether to continue or confirm all at once. It is a user-interface feature, not a fix for a known security bug. There is no direct evidence in the commit or supplied references that it addresses a vulnerability.

Security candidatefix(core): use `TEXT_MONO_DATA` for Delizia `confirm_with_info()`by Roman Zeyde · b75eb856 · Feb 17, 2026 · 1 fileMessage 62 · AdequateInformational 18Details
Commit message · Roman Zeyde

fix(core): use `TEXT_MONO_DATA` for Delizia `confirm_with_info()`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 18/100

This is a one-line visual styling fix in the Trezor hardware wallet's user interface. It changes which font style is used when displaying data values in a specific confirmation screen (confirm_with_info) on the Delizia layout. The old style was the general monospace font; the new style is a monospace font variant intended specifically for data. There is no direct evidence this change fixes a security vulnerability, but using the wrong font style could theoretically make important data harder to read or distinguish from labels, slightly weakening the user's ability to verify what they are approving.

Security candidatechore(core): hide empty "info" button on Caesar `confirm_with_info()`by Roman Zeyde · 00b74ad0 · Feb 17, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

chore(core): hide empty "info" button on Caesar `confirm_with_info()`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This is a minor user-interface polish change for the Trezor hardware wallet's 'Caesar' screen layout. It simply hides an empty or placeholder 'info' button so users don't see a blank or confusing button during confirmations. There is no security-relevant behavior change.

Security candidatechore(core): hide empty "info" button on Bolt `confirm_with_info()`by Roman Zeyde · f939782a · Feb 17, 2026 · 7 filesMessage 85 · StrongInformational 19Details
Commit message · Roman Zeyde

chore(core): hide empty "info" button on Bolt `confirm_with_info()`

The return type is changed to `Gc<LayoutObj>`, since the `buttons` object may be `CancelConfirm` or `CancelInfoConfirm`.

[no changelog]

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 19/100

This is a small user-interface cleanup for the Trezor hardware wallet. On one device style (Bolt), it hides an extra 'info' button when there is no label text for it, so users don't see a confusing blank button. The change also adjusts internal Rust return types so the different device layouts can return the same kind of object. There is no direct security fix here.