Trezor firmware

This update fixes a bug where rebooting a Trezor device from its on-device menu did not properly restart the Bluetooth chip (nRF). The fix makes sure the Bluetooth chip is turned off and rebooted before the device restarts, so both sides come back up in a clean, synchronized state. Without this, Bluetooth could be left in a confused or half-working state after a reboot.

This commit fixes a battery-drain bug in the Trezor bootloader that occurs when the device is left waiting for the user to confirm unofficial firmware. The old code kept the processor awake in a tight loop polling the touchscreen or buttons. The new code lets the device sleep and only wakes it when the user actually touches the screen or presses buttons, and it hibernates after 40 seconds of inactivity. There is no direct security vulnerability being patched; it is a power-management and usability fix.

This commit is a routine user-interface cleanup. It changes the on-screen 'please wait' message in three Trezor firmware layouts to use a standard text paragraph component instead of a dedicated 'Connect' component. There is no indication this fixes a security bug or changes security behavior.

This commit removes an unused 'More info' option from several on-screen confirmation helpers in the Trezor firmware. The change is a UI cleanup: screens that never actually provided extra information no longer offer a 'More info' button. There is no direct evidence in the commit that this fixed an exploitable security vulnerability.

This is a user-interface cleanup change for the Trezor Safe 5 (delizia layout). It removes a special narrow text style that was used only when long addresses needed a scrollbar. Because the new delizia layout no longer uses a scrollbar on these screens, the code now always uses the standard address-chunk style. The only visible effect is slightly different address formatting on some screens, and the corresponding screen-test snapshots were updated. There is no indication this affects security, cryptography, or how transactions are approved.

This commit only reorganizes the bootloader's written changelog. It deletes small draft files and copies their text into the main CHANGELOG.md, adding version numbers and pull-request links. No program code was changed, so this cannot introduce or fix a security bug by itself.

This commit is a purely cosmetic UI fix. It changes the text and icon color of a warning-style action-bar button from bright orange to a dimmed orange when the button is active/pressed. The large number of changed lines are just updated test screenshot hashes (fixtures) reflecting the new color, not functional code changes. There is no security relevance.

This commit fixes a visual timing issue in the setup tutorial on the Trezor T3W1 hardware wallet. Previously, the on-screen background color and the device's RGB LED could change at slightly different moments because they were driven by separate timers. The patch removes the separate LED timer and ties the LED color change directly to the same progress check used for the on-screen loader/background, so they stay synchronized. There is no indication this was a security vulnerability.

This commit fixes a cosmetic bug where the RGB LED on the Trezor T3W1 would briefly blink or flicker when the device's user-interface event loop restarted (for example, when leaving the homescreen). The fix moves LED color control into the normal screen-drawing pipeline so the LED state is set consistently during rendering rather than being turned off when a screen object is destroyed. There is no indication this is a security vulnerability.

This commit adds public verification keys for the nRF wireless/Bluetooth chip to the Trezor library's list of known device model keys. It is a routine data update with no code logic change and no indication of a security vulnerability.

This commit renames a helper function back from `raise_if_cancelled` to `raise_if_not_confirmed` and changes its behavior. Previously, the code only raised an error when the user explicitly cancelled. Now it also raises an error if the UI returns any unexpected result other than a confirmed success. This is a defensive hardening change across many on-device confirmation screens, intended to prevent the device from silently continuing when something other than a clear confirmation happens.

This update fixes a bug in the Trezor hardware wallet where entering a 'wipe code' (a special PIN that securely erases the device) did not remove saved Bluetooth pairings on the T3W1 model. After the fix, the device reboots into a dedicated wipe routine in the bootloader that both erases storage and clears Bluetooth bonding information, preventing a wiped device from remaining paired to a previously trusted phone or computer.

This commit changes how Trezor T3W1 devices generate their temporary Bluetooth (BLE) name during pairing. Previously the name contained three random characters from a pool of 26 letters plus 10 digits. Now it uses a digit-letter-digit pattern. This reduces the number of possible names from 36×36×36 (about 46,656) to 10×26×10 (2,600), making it easier for a nearby attacker to guess or collide with the advertised name during pairing. The change appears intentional to make the displayed name easier to read or type, but it weakens the randomness that helps distinguish devices.

This commit only updates version numbers and translation metadata across Trezor firmware components. It does not change any executable code, fix any behavior, or alter security logic. There is no indication this is a security patch.

This commit is a simple internal rename of a user-interface text label from 'ble__waiting_for_host' to 'words__waiting_for_host'. It does not change what the device does, what data it handles, or how it protects that data. It only reorganizes where a translation string is stored so it can be reused for a future on-screen message.

This commit is a routine code cleanup of the screen backlight driver in Trezor hardware wallets. It changes function return types from plain integers to booleans and from signed to unsigned 8-bit values, and removes redundant range checks. There is no indication this fixes a security vulnerability; it appears to be a refactoring for code clarity and type correctness.

This commit refactors how the Trezor hardware wallet's screen brightness is controlled from Rust code. The old single 'backlight' function is split into separate 'set_backlight' and 'get_backlight' functions, and the brightness value type is narrowed from a wider signed integer to an unsigned 8-bit value (0-255). The commit message and code comments explicitly flag that some callers still pass a 16-bit value, and the patch adds defensive clamping to 255 in those cases. There is no direct evidence of an exploitable security bug, but the change is clearly defensive hardening against potential type-conversion issues.

This is a code cleanup change in the Trezor hardware wallet's screen-brightness controls. It changes internal number types from 16-bit to 8-bit to match the display driver, and removes temporary workarounds that converted the values. The commit message says the code was reviewed and no safety problems were found. There is no indication this fixes an active security bug; it is a defensive type-safety refactor.

This commit replaces the deprecated Ethereum Holesky testnet with the new Hoodi testnet across Trezor firmware. It updates network names, chain IDs, SLIP44 derivation indices, staking contract address labels, and test fixtures. There is no indication of a security vulnerability being fixed; it is a routine network-maintenance change.

This commit is a simple housekeeping change: it deletes a top-level 'assets' folder and moves the same PNG image files into the resource folders used by each user-interface layout. No code was changed, no functionality was altered, and there is no security relevance.

This commit only adds and updates automated tests for Trezor's device-authentication feature. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability in the product itself. The tests verify that certificate chains and signatures from two hardware security chips (Optiga and Tropic) are accepted correctly.

This commit updates three pre-built binary files for the T3W1 hardware model (bootloader, security monitor, and Bluetooth firmware) plus the matching bootloader hash header. The actual code inside the binary files is not shown in the diff, and the commit message only describes it as a routine binary update with no changelog. There is no visible security fix or vulnerability indicator in the materials provided.

This commit updates three pre-built binary files for the Trezor T3W1 hardware wallet model: the bootloader, a security monitor, and a Bluetooth Low Energy firmware image. It also updates the corresponding bootloader hash header so the firmware can verify the new bootloader. The commit message calls this a routine chore with no changelog entry. There is no description of any security fix, bug, or functional change in the commit itself, and the binary differences cannot be inspected as source code.

This commit swaps in a newer QA (quality assurance) bootloader binary for the T3W1 hardware model and updates the matching hash table used by the firmware to recognize it. The change is labeled as a routine chore with no changelog entry. There is no information in the commit or supplied references indicating this fixes or introduces a security problem.

This commit is a purely cosmetic UI adjustment for the Trezor hardware wallet's 'Eckhart' layout. It increases the spacing between descriptive labels and their content on the receive-crypto screen, replacing hard-coded padding numbers with shared theme constants. There is no security relevance.