Trezor firmware

This commit removes the option to sign a hash of a Cardano message instead of the message itself. The device now always signs the actual message payload directly, up to a size limit. This is a feature/API change rather than a fix for an active security flaw, but it does eliminate a mode where users might have signed data they could not fully inspect.

This commit only adds new test cases for the Ethereum signing feature. It does not change any production firmware code, so it cannot introduce a security vulnerability by itself. The tests verify that the Holesky Ethereum testnet can be signed using both a testnet-style and a mainnet-style derivation path.

This commit adds a user-facing setting to turn the device's RGB LED on or off. It is a routine feature addition (a 'chore') with no apparent security relevance. There are no changes that introduce memory corruption, bypass authentication, leak secrets, or alter cryptographic behavior.

This commit updates Trezor's Python library so it can recognize and verify digital signatures for a new 'secure monitor' (secmont) firmware component. It fixes a mismatch where the secmon image verifier was accidentally returning bootloader keys instead of secmon keys, and adds the correct public keys and signature-count rules for two development hardware models. There is no direct evidence this is a security vulnerability fix; it reads as a routine key-registry update for a new feature.

This commit is a routine user-interface update for the Trezor hardware wallet. It changes the 'About' screen in the device menu to show more information—firmware version, firmware type (Bitcoin-only or Universal), and a Bluetooth version number—instead of only the firmware version. There is no security-relevant change; it is purely a display/layout improvement.

This commit is a routine UI translation update for the Trezor hardware wallet's device menu. It replaces hard-coded English text strings with references to the device's translation system so the menu can be displayed in multiple languages. There are no security fixes or functional behavior changes.

This commit is a routine feature expansion of the Trezor hardware wallet's on-device settings menu for the upcoming 'Eckhart' model. It adds new menu options and result codes for Bluetooth pairing, PIN/wipe-code management, screen brightness, haptic feedback, and LED toggles. Most of the new menu items are not yet wired to real functionality and are marked with 'TODO implement' placeholders. There is no indication this change fixes or introduces a security vulnerability.

This commit is a routine UI code cleanup. It introduces a new medium-length menu size (10 items) and updates the device menu screen to use it instead of the previous short size (5 items). There is no security-relevant change here.

This is a routine user-interface cleanup for the upcoming Trezor 'Eckhart' device layout. It makes menu divider lines always appear instead of requiring each screen to opt in. There is no security change, no bug fix, and no handling of secrets or sensitive data.

This is a routine user-interface cleanup for the upcoming Trezor Safe 5 (Eckhart layout). It makes header buttons slightly larger and easier to tap, and switches several screens to use a shared 'close button' helper. The only functional change visible in the code is a larger touch target and a small visual radius on header icon buttons; there is no evidence this affects security-sensitive behavior such as transaction confirmation, PIN entry, or seed handling. The huge list of changed test hashes is simply because every screen screenshot changed by a few pixels.

This commit is a routine user-interface polish change for the Trezor hardware wallet. It updates the on-screen button label and color when changing the device's name, and adds a short 'Device name changed' confirmation screen afterward. There is no security fix or vulnerability here.

This is a cosmetic user-interface tweak for the Trezor hardware wallet's new 'Eckhart' layout. It makes the up/down pagination buttons the same size and updates the expected screen snapshots used in automated tests. There is no indication it fixes or introduces any security vulnerability.

This commit is a routine user-interface styling change for the Trezor hardware wallet's QR-code display screen. It swaps the foreground and background colors (inverts them) and adjusts the layout code accordingly. There is no indication this change affects security, cryptography, private keys, or transaction signing. The large number of changed test hashes is simply because the on-screen appearance changed, which is expected for a visual update.

This commit replaces a pre-built bootloader binary file for the T3W1 hardware model and updates the matching cryptographic hashes in a header file. The change itself is a routine binary refresh with no source-code diff, no changelog entry, and no stated security relevance. There is no visible evidence of a vulnerability or malicious change, but the opaque binary blob cannot be independently verified from the commit alone.

This commit fixes a bug where opening the device menu on a Trezor hardware wallet would crash with a red screen of death (RSOD) if a Bluetooth device was connected. The fix simply increases the maximum number of subscreens the menu system can handle from 8 to 10, because the Bluetooth menu entries push the count over the previous limit. There is no evidence this is exploitable by an attacker.

This commit changes the vibration pattern that the Trezor hardware wallet produces when it powers on. It adds a new dedicated 'power on' haptic effect and uses it instead of reusing the existing button-press vibration. There is no security relevance in this change.

This commit is a large internal refactor of the Trezor firmware's THP (Trezor Host Protocol) event loop and message handling. It removes an old global buffer-locking scheme and a separate retransmission task, replacing them with per-channel buffer objects and a simpler synchronous send-and-wait-for-ACK flow. The change also removes the old `loop.clear()` restart-on-error behavior in favor of explicitly joining workflows before restarting. The diff itself is a feature rewrite with no explicit security claims, but it touches sensitive code paths (encrypted channel setup, session scheduling, buffer management) and removes some safety checks, so it should be reviewed carefully for regressions.

This commit is a user-interface refactor for Stellar transaction signing on Trezor hardware wallets. It changes the wording and order of confirmation screens, adds warnings when the transaction source account does not belong to the device, and streamlines how operation outputs are shown. There is no direct evidence in the diff of a security vulnerability; it appears to be a UX improvement. However, any change to what users confirm before signing deserves a careful look to ensure nothing important was removed or weakened.

This commit adds a new 'Regulatory certification' screen to the Trezor hardware wallet's user interface. It is purely a UI feature that displays certification marks (FCC, CE, RCM, etc.) and regional compliance information. There is no security-relevant code change, no handling of secrets, and no network or cryptographic logic.

This commit adds a new on-device screen for changing the device's name (label) on the upcoming Trezor 'Eckhart' model. It also makes the passphrase input code more flexible by allowing the caller to specify the prompt text and maximum length, and it wires up a new 'Device name' menu item. There is no obvious security bug in the diff, but it is a large feature patch touching keyboard input, menu navigation, and device settings, so it carries normal implementation risks.

This commit changes how the Trezor T3W1 hardware wallet enters its bootloader. It shortens the required power-button hold from 3 seconds to 2 seconds, adds a new on-screen progress message telling the user to release the button, and moves the haptic buzz and display initialization to occur only after the user has committed to bootloader mode. The changes appear to be a user-experience and timing refinement rather than a fix for an exploitable security flaw. There is no vendor statement or independent report linking this commit to a security vulnerability.

This commit changes how a Trezor hardware wallet starts up when you press its button. Previously, the device would only fully power on after a long button press (about one second) or when in a special factory mode. After this change, a short button press is enough to start the device in normal use. The change also adds a small haptic buzz at 500 milliseconds to give the user feedback. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a user-experience or behavior change in the bootloader.

This commit updates Trezor firmware to match a newer version of an external secure-chip library called libtropic. The main user-visible change is that a cryptographic signing function no longer takes a caller-supplied signature-buffer length; instead the firmware always uses a fixed, library-defined size. The patch also swaps the low-level random-number callback to a different API that the updated library expects. There is no claim in the commit that this fixes a security bug; it reads as a compatibility update after a dependency upgrade.

This commit adds vibration feedback to the 'hold to confirm' animation on a specific Trezor hardware wallet layout (Eckhart). It only introduces haptic effects behind a compile-time feature flag and does not change security logic, transaction confirmation behavior, or access controls.

This commit is a routine user-interface refactor for the Trezor hardware wallet's bootloader screen header. It changes how a battery/charging icon is displayed in the header and tidies up event handling for that icon across several bootloader screens. There is no indication it fixes a security bug or introduces a security-relevant change.