Trezor firmware

This commit adds a new on-screen prompt that asks users to confirm they really want to cancel a transaction-signing flow. It is a user-experience and safety feature, not a security fix. There is no evidence of a vulnerability being patched.

This commit is a straightforward code cleanup: it bundles several settings for confirmation screens into a single ConfirmActionOptions struct instead of passing them as separate function arguments. There is no change to user-facing behavior, no bug fix, and no security-related change.

This commit is a straightforward internal code cleanup in the Trezor firmware's user-interface layer. It replaces several individual settings inside a 'ConfirmValue' screen builder with a shared 'ConfirmActionOptions' object. There is no change to user-visible behavior or to security logic; it is purely a refactor to reduce duplicated code.

This commit adds a 'swipe down to go back' feature to the Delizia user interface on Trezor hardware wallets. When reviewing a cryptocurrency transaction, a user can now swipe down on the amount screen to return to the address screen and double-check it. It is a usability improvement, not a fix for a vulnerability.

This commit is a straightforward internal code cleanup. It introduces a new type alias called StrPropertyType for UI properties that are always text strings (never raw bytes), and replaces some str(x) conversions with x or "" to handle possible None values more cleanly. There is no indication this fixes a security bug or changes user-visible behavior.

This commit changes how the Trezor firmware's vibration motor (haptic) driver reports and handles errors. Previously, some haptic functions returned simple true/false success values, and some callers ignored the result of initialization. Now those functions return a structured status code, callers capture the status (though mostly still ignore it), and one resume path actually halts on failure. A test-only haptic syscall was removed. The changes are defensive cleanups rather than a fix for a known exploitable bug, but they reduce the chance that a failing haptic device could leave the system in an inconsistent state.

This commit is a large internal refactor of the Trezor bootloader's event loop, moving it from C into Rust and changing how screens handle USB/Bluetooth communication. The title and message explicitly call it a refactor with '[no changelog]', and there is no vendor statement that this fixes a security bug. The diff shows substantial code movement but no obvious new vulnerability. Because it is a wide-reaching rewrite of security-critical boot-time code, it carries ordinary implementation risk, but the available materials do not demonstrate a concrete security issue.

This commit adjusts how the Trezor bootloader's length is calculated and pads the bootloader image to a 512-byte boundary. The old calculation added the sizes of two memory sections, which could produce a value that does not match the actual padded image size. The new calculation uses a dedicated end marker, and the linker script now explicitly fills unused space with zeros and aligns the image. This is a defensive fix in low-level firmware packaging; it does not by itself show an exploitable bug, but misaligned or incorrectly reported bootloader sizes could theoretically cause verification or update failures.

This commit fixes the horizontal centering of a small vendor logo shown on the bootloader's 'unsafe firmware' warning screen. The old code subtracted 22 pixels from the screen width before dividing by two, which would slightly offset the 24x24 image. The new code simply centers the image using the screen's midpoint. There is no security-relevant change in the diff itself.

This commit only changes the test suite and supporting Python tooling. It renames a model set from TREZORS to ALL_MODELS, splits devices into legacy and core groups, and updates upgrade tests so they can run against individual Trezor models rather than just broad 'legacy' or 'core' categories. There is no change to the firmware that runs on the hardware wallet, no fix for a security bug, and no new attack path.

This commit removes an unused data field called language_data_length from the RebootToBootloader command used during Trezor firmware updates. It is a cleanup change that marks the old field as reserved in the protocol definition and regenerates the corresponding code in Python, Rust, and the device firmware. There is no security-relevant change here.

This commit removes a feature that let a firmware update package include a language translation file. It is a routine cleanup: the device will no longer accept or install a language blob while rebooting into bootloader mode for a firmware update. There is no indication this fixes a security bug or introduces a vulnerability.

This commit removes a feature from Trezor's Python tools that let users upload a language translation file during a firmware update. It is a routine cleanup (chore) that deprecates the language-blob upload option and simplifies the code. There is no indication of a security fix or vulnerability.

This commit loosens address-path validation for older Trezor (legacy) devices when signing Ethereum-style transactions. Previously, only non-standard networks could use Ethereum's mainnet derivation path; now any network except Ethereum mainnet itself can do so, and Ethereum mainnet additionally accepts testnet-style paths. The stated purpose is to support newer networks like Hyperliquid that cannot get an official coin-type registration. The change is a deliberate feature backport, not a covert bug fix, but it does relax a security-relevant boundary that normally prevents cross-network address reuse.

This commit only adds a new automated test to the Trezor firmware test suite. It checks that a non-Ethereum network can still use the standard Ethereum account derivation path when signing a transaction. No product code was changed, so this cannot introduce a security vulnerability or fix one in the firmware itself.

This commit is a routine version bump from 2.9.8 to 2.10.1 for the Trezor firmware. It only changes the version number in one header file and updates the matching version numbers in translation files, plus refreshes the translation signature metadata. There are no code behavior changes, no bug fixes, and no security-related modifications.

This commit adds the ability to sign native TRON (TRX) transfers on Trezor hardware wallets. It introduces new message types, a signing workflow, user confirmation screens, and client-side helpers. The change is a feature addition rather than a fix for a known vulnerability, and there is no vendor statement that this resolves a security issue.

This commit only updates version numbers and translation metadata across the Trezor firmware repository. It does not change any executable code, fix any behavior, or alter security logic. There is nothing in the diff that introduces or fixes a security issue.

This commit only changes a test file for the Tropic cryptographic module. It swaps the hardcoded key index from 0 to 31 in a unit test. There is no change to production firmware code, no security fix, and no vulnerability being introduced or patched.

This commit fixes how cryptocurrency addresses are visually grouped into chunks on Trezor device screens for several wallet models. Previously, addresses could be displayed with missing or incorrect spacing, which might make it harder for users to visually verify an address before approving a transaction. The fix changes the low-level text layout code and passes the chunking option through two user-interface layouts. It is a display/rendering bug fix rather than a cryptographic flaw, but because address verification is a key anti-phishing step, any display issue has security relevance.

This commit is a cosmetic wording fix for the Trezor hardware wallet's backup quiz screen. It changes how the device labels the word the user must select, switching from English-style ordinal text like '2nd' to a neutral '2 of 20' format. There is no security issue here; it is purely a user-interface and localization improvement.

This commit updates the regulatory information screen on the Trezor T3W1 hardware wallet. It adds new country certification icons, reorganizes the order of regions shown, and displays the device's production year on the South Korea page. There is no security-relevant change here—only user-interface text, images, and layout.

This commit fixes a UI bug in the Trezor hardware wallet where scrolling through FIDO/WebAuthn credentials could behave incorrectly. The change updates the displayed account name in place rather than recreating the whole text element each time the page changes. There is no direct evidence this is a security vulnerability; it appears to be a user-experience fix for on-screen credential navigation.

This commit fixes an off-by-one error in a debug-only assertion inside a Trezor hardware wallet screen. The assertion checks whether a button index is valid, but it previously rejected the last valid button (the 'cancel' button). The fix changes '<' to '<=' so the assertion no longer falsely triggers. This is a minor correctness fix in debug builds and does not change release behavior or user-facing security.

This commit simply removes an unused Python import (`shlex`) from five build scripts. It does not change any program logic, behavior, or security boundary. It is a routine code cleanup with no security relevance.