Trezor firmware

This commit fixes a coding issue in the older Trezor firmware where a temporary memory buffer could be created with zero size when handling multi-signature Bitcoin wallets. The fix replaces a variable-length buffer with a fixed maximum-size buffer. A zero-length variable-length array is undefined behavior in C and could, in theory, be exploited to destabilize the device, though the commit itself does not describe a practical attack.

This commit is a small internal refactor of the Trezor firmware's Tropic secure-element integration. It adds a software cache for a hardware-backed 'change PIN counter' so the firmware does not have to repeatedly ask the secure chip for the same value during PIN operations. There is no indication in the commit or title that this fixes a security bug; it appears to be a performance or timing-predictability improvement.

This commit changes the order in which a Trezor hardware wallet resumes internal components after waking from a low-power suspend state. Previously, secure drivers were resumed after the Optiga security chip was resumed. The fix moves secure-driver resumption before Optiga resumption. The commit title says this fixes a problem that occurs when the Optiga chip is properly paired and the bootloader is locked. Without more context, the exact security impact is unclear, but an incorrect resume order could in principle cause a secure-driver failure or leave a security-critical component in an inconsistent state during wake-up.

This commit is a routine housekeeping change that only updates version numbers from 2.9.6 to 2.9.7 for the main firmware and from 1.0.5 to 1.0.6 for the security monitor, plus refreshes translation file metadata and their cryptographic signature. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

This commit adds a new command-line option to the Trezor bootloader emulator that lets developers pre-load a firmware image into the emulated flash memory before running tests. It is a development/testing convenience feature and does not change the real hardware bootloader or wallet behavior.

This commit adds a new command-line option (-w) to the Trezor bootloader emulator, a software-only testing tool. When used, it erases any simulated firmware image before the emulator starts booting. It is a development/testing convenience and does not change real hardware behavior or fix a security problem.

This commit adds a build-time and emulator option to turn off visual animations in the bootloader. It is a routine developer convenience change and does not fix, introduce, or change any security behavior.

This commit adds a new build option, DISABLE_TROPIC, that lets developers compile Trezor firmware test builds without the Tropic secure-element feature. It mirrors the existing DISABLE_OPTIGA flag and is blocked from production builds. There is no indication this is a security fix or vulnerability patch; it is a build-system convenience for hardware testing.

This commit only updates version numbers and translation metadata. It changes the firmware version from 2.9.5 to 2.9.6, the secure monitor version from 1.0.4 to 1.0.5, and updates translation file headers and their signed metadata. There are no code changes that affect security or functionality.

This is a large cleanup commit that improves Python type annotations and fixes minor code-quality issues across build tools, helper scripts, and test utilities. It does not change any security-critical firmware behavior, cryptographic operations, or device-facing code. There is no indication this commit fixes a security vulnerability.

This commit is a test-infrastructure and UI-layout change for the upcoming Trezor Safe 5 (Eckhart layout). It lets automated UI tests detect whether a text screen has an external menu, and it swaps a red cancel menu item for a dedicated themed cancel button. There is no security-relevant behavior change visible in the diff.

This commit changes the default value of an optional UI parameter called `info` from `True` to `False` in a function that displays confirmation screens on Trezor hardware wallets. The change only affects documentation-style comments and a generated mock file, making the documented default match the actual implementation. There is no direct evidence this fixes a security vulnerability.

This is a minor Rust code cleanup that removes a compiler warning in non-debug builds. The change splits one function into two versions: one for debug builds that sets a test-only flag, and one for release builds that does nothing. There is no security-relevant change to actual device behavior.

This commit removes the 'experimental' label from two existing Trezor features—PaymentRequest (used in several cryptocurrency transaction flows) and GetNonce (a management message). It also removes the need to enable an 'experimental features' flag to use them. The change is a feature graduation, not a security fix. There is no evidence in the commit of a vulnerability being patched.

This commit swaps out the 'ecdsa' Python library for the more widely used 'cryptography' library when verifying digital signatures on Trezor legacy firmware updates. It is a maintenance-style dependency change. There is no direct evidence in the commit that it fixes an active security vulnerability, but moving away from the older 'ecdsa' package reduces long-term supply-chain and implementation risk.

This commit is a straightforward internal code cleanup. It renames a parameter from 'token_address' to 'extra_menu_items' and changes it from a single Ethereum token address string into a generic list of extra label/value pairs. The Ethereum app now passes the token contract address as one item in that list, while other cryptocurrency apps simply pass an empty list. There is no change to user-facing security behavior and no bug fix or vulnerability patch.

This is a routine internal code cleanup. It replaces loose groups of payment-request data (tuples) with named data classes (Refund and Trade) and moves shared helper code into a new file. There is no change to what the device shows or signs, and no security fix or vulnerability is present.

This commit refactors how Trezor hardware wallets display payment requests when no recipient address is provided. Previously, the code always expected a recipient address and would include it in the confirmation screen. Now, it handles cases where the recipient address is missing by either omitting that detail or showing a simpler confirmation. There is no direct evidence this fixes an active security vulnerability; it appears to be a UI robustness improvement.

This commit moves the same on-screen trade-confirmation helper from the non-Bitcoin code block into the common, always-compiled section across four Trezor device layouts. The function itself is not changed; it is only made available in the Bitcoin-only firmware build as well as the full build. There is no direct evidence in the commit that this fixes a security bug.

This commit is a user-interface refactor that lets the Trezor device display trade confirmations even when there is no 'sell' amount. Previously the code assumed every trade was a swap (sell something to buy something). Now it can handle cases where only a buy amount is shown, such as a direct purchase or sale-to-fiat. The change touches UI layout code across several Trezor models and updates type hints, but it does not alter cryptographic signing, transaction parsing, or security checks.

This commit is purely a documentation change: it moves five short bug-fix descriptions from individual changelog draft files into the official bootloader CHANGELOG.md for version 2.1.15. No source code was modified, so this commit by itself cannot introduce, fix, or exploit any security issue.

This commit updates pre-built binary files (bootloader and security monitor) for the T3W1 hardware model, along with the matching bootloader hash. The change is presented as a routine chore with no changelog entry. There is no visible source diff or description of what changed inside the binaries, and no security relevance is stated.

This commit is a code cleanup in the user-interface code for the Trezor hardware wallet's 'delizia' layout. It adds a way to mark on-screen cancel buttons as 'cancel' buttons, primarily so automated testing/debug tools can identify them. It does not change what the buttons do or introduce any security-relevant behavior.

This is a small internal code cleanup for the user interface of a new Trezor device layout (codenamed 'Eckhart'). It adds a marker flag called is_cancel to buttons that represent a 'Cancel' action, so automated testing/debug tools can identify them more easily. The visible behavior of the device does not change.

This commit removes several internal 'debug' flags from normal production builds of the Trezor firmware and keeps them only in builds that have the optional 'ui_debug' feature enabled. These flags are used by automated tests (debuglink) to navigate menus and identify cancel buttons; they do not directly control security checks. The change reduces the chance that test-only state could accidentally affect or leak information in production firmware, but it is a cleanup rather than a fix for an active vulnerability.