Trezor firmware

This commit fixes a user-interface timing issue in the Trezor bootloader. Previously, the firmware-installation progress bar could start moving before the user had actually confirmed the update on the device screen. The change makes the progress bar wait until the user explicitly confirms, so the on-screen feedback matches the real installation state. There is no direct evidence this is a security vulnerability, but it removes a small window where UI state could be misleading during a firmware update.

This commit is a routine version bump from 2.9.1 to 2.9.2 for the Trezor firmware. It only changes version numbers in one header file and in translation metadata, plus updates the signed translation package timestamp and hash. There are no code behavior changes, no bug fixes, and no security-related changes visible in the diff.

This commit tweaks how quickly a menu scrolls when the user swipes the touchscreen on a Trezor hardware wallet model, and adds a request to redraw the screen during scrolling. It is a user-interface polish change with no apparent security relevance.

This commit simply lowers the default screen brightness for the T3W1 hardware model of the Trezor hardware wallet from 150 to 85. It is a product tuning change, not a security fix or vulnerability. The change affects bootloader, production test, and UI theme code, and updates expected test screenshots (UI fixtures) accordingly.

This commit is a routine UI code cleanup for the Trezor hardware wallet's on-screen menu. It splits one type of menu screen into two separate types—one for general submenus and one specifically for device-related options—so the code can use a shorter menu for device screens. There is no security fix or vulnerability here; it is purely a maintainability and layout refinement.

This commit adds a new optional subtitle label to a vertical menu screen in the Trezor hardware wallet's user interface. It is a routine UI feature change with no apparent security relevance.

This commit updates the on-screen device menu for a new Trezor hardware wallet design (codename Eckhart). It adds Bluetooth pairing controls such as 'Connect', 'Forget', and 'Forget all', and wires some of those buttons to existing unpair/disconnect routines. The changes are almost entirely user-interface code; there is no obvious security bug, but several TODO comments show the underlying Bluetooth actions are still incomplete or mocked.

This bootloader patch changes the order of operations during a factory reset (wipe). Previously, the device tried to delete Bluetooth pairing information ('bonds') before telling the host computer that the wipe succeeded. Deleting bonds can disconnect the device, so the success message might never reach the host, leaving the user or software unsure whether the wipe completed. The fix sends the success message first, then waits briefly, then deletes the bonds. This is primarily a reliability/UX fix; it does not appear to be a security vulnerability in the sense of theft or unauthorized access.

This commit adds a new Trezor feature that lets users derive a special cryptographic key (a SLIP-21 node) for a third-party storage framework called Evolu. The device will show an on-screen confirmation before releasing the key. It is a feature addition, not a fix for a known vulnerability. The main security consideration is that any host application able to send the new message type can request this key, but only after the user confirms on the device. The key is tied to a fixed path ("TREZOR"/"Evolu"), so it cannot be used to steal cryptocurrency directly, but if a user is tricked into approving it, the key could be leaked to a malicious application.

This commit only changes the text labels shown on the Trezor Safe 7 (Eckhart) home screen action bar. It replaces 'Tap to connect' with 'Tap to start' on the boot screen and 'Tap to unlock' with 'Unlock' on the lock screen, plus adds the new translation key and updates translation metadata. There is no security-relevant code change.

This commit is a routine user-interface polish change for the PIN entry screen on Trezor hardware wallets. It renames an internal parameter from 'subprompt' to 'attempts', adds a new flag so the screen can visually highlight the final PIN attempt, and fixes text alignment and spacing. There is no indication this change fixes a security vulnerability or introduces one.

This commit is a cosmetic user-interface fix for the Trezor hardware wallet's new 'Eckhart' layout. It adjusts how recovery seed words are displayed on screen—text alignment, prompt placement, and spacing—without changing any security logic, cryptography, or how secrets are handled.

This commit rewrites the on-screen keyboard used to type text into the Trezor Safe 5 (Eckhart layout). It renames the component, removes a separate confirmation screen for empty labels, lets users submit an empty string directly, and allows cancelling even when nothing has been typed. The change is described as a UI/UX cleanup, not a security fix. There is no direct evidence in the commit that it patches an exploitable vulnerability, but removing an extra confirmation step for empty device names slightly changes the safety surface around user input.

This commit fixes visual layout glitches in the passphrase entry screen on a specific Trezor device model (Eckhart). It adjusts prompt spacing, text alignment, and the placement of the last typed character. There is no indication this changes security behavior or introduces a vulnerability.

This is a cosmetic UI alignment change for the Trezor hardware wallet. It makes the default device name shown on the homescreen and in the device menu consistent by using the model's full name (e.g., 'Trezor Safe 5') instead of a hardcoded 'Trezor' fallback. It also tweaks text styling and reorders a translation entry. There is no security-relevant change.

This commit is a purely cosmetic UI tweak for the Trezor hardware wallet. It increases the top padding of the home screen label from a theme-defined value to a fixed 38 pixels. There is no security relevance in the change itself.

This commit changes how the Trezor hardware wallet's Bluetooth Low Energy (BLE) connection behaves when the device reboots from the bootloader into the main firmware. Previously, the bootloader would shut down BLE entirely during this handoff, forcing the user to reconnect. Now it tries to keep the existing BLE connection alive across the reboot. This is a user-experience and availability fix rather than a security patch, but it slightly alters the attack surface during a sensitive transition.

This commit is a routine UI update for the Trezor hardware wallet's device menu. It wires up previously placeholder settings (screen brightness, haptic feedback) and adds a 'Wipe device' option to the menu. There is no security fix or vulnerability visible in the change.

This commit adds a Bluetooth on/off menu item to the device settings screen for the upcoming Trezor Safe 7 (Eckhart layout). It is purely a user-interface change: it shows a label and a confirmation prompt, but the actual Bluetooth enable/disable logic is left as a TODO and does nothing. There is no security fix or security-relevant behavior change.

This commit adds new notification entries and warning styles to the device menu on the Trezor hardware wallet. It is a routine user-interface feature patch: it introduces a 'PIN not set' reminder, changes the visual style of a failed-backup warning, and wires the failed-backup menu item to a device-wipe confirmation prompt. There is no evidence of a security vulnerability being fixed.

This commit wires up the on-device settings menu for a new Trezor hardware-wallet UI (the 'Eckhart' layout). It adds menu entries that let the user change or remove their PIN and wipe code, set auto-lock delay, and check their backup. The change is mostly UI plumbing: it connects existing security-management code to new menu items and adds translated labels. There is no obvious security bug in the diff, but it is a partial implementation (other TODOs remain) and the code now exposes sensitive actions through a new menu surface.

This commit fixes a bootloader wireless setup workflow so it checks whether Bluetooth pairing actually started before continuing. Previously, the code ignored the return value of the pairing-start function, so if pairing failed to initiate, the setup would proceed anyway. The fix makes the workflow return a pairing-failed status instead. This is a defensive hardening change in the bootloader's BLE pairing path.

This commit improves the Cardano message-signing feature on Trezor hardware wallets by showing users more details on the device screen before signing. It displays the signing path, the address parameters (if provided), and a larger chunk of the message payload when appropriate. It also tightens path validation by checking the path against the keychain and allowing minting paths in addition to public-key paths. These are defensive UI and validation hardening changes rather than fixes for an active vulnerability.

This commit adds a new feature to Trezor hardware wallets: the ability to sign arbitrary Cardano messages. It introduces new protocol messages, device firmware code to handle signing, and client libraries to use the feature. The signing process requires user confirmation on the device screen and includes safety checks, such as limiting unhashed payload length and validating ASCII display options. There is no direct evidence in the commit of a security vulnerability, but any new signing feature carries inherent risks if not fully reviewed.

This commit renames and slightly changes a Cardano message-signing display option. Previously, the host had to explicitly request ASCII display, and the device would reject payloads that were not clean, readable ASCII. Now the host can ask the device to prefer hex display, and if ASCII display is preferred but the payload is not clean ASCII, the device falls back to showing hex instead of rejecting the request. This is a user-experience and consistency change, not a fix for a clear security vulnerability.