Trezor firmware

This commit is a code cleanup that changes how Trezor firmware internally labels 32-bit versus 64-bit integer fields in its protobuf handling. It does not add or remove security checks by itself, but it makes the type system more precise so that future integer-overflow mistakes are harder to introduce. The change is described by the author as a refactor with no changelog entry.

This commit fixes the way a Trezor hardware wallet's Rust code reads protobuf message field keys. Previously, if reading a field key failed, the decoder silently stopped and treated the message as complete. Now it explicitly checks whether data remains and reports an error if a malformed or truncated field key is encountered. The change prevents an attacker from sneaking invalid or truncated protobuf data past the parser, which could lead to messages being accepted even though they contain garbage or hidden fields.

This commit adds an on-screen confirmation step for the 'space' (data size) parameter when creating new Solana accounts on a Trezor device. Previously, this parameter was hidden from the user during Create Account instructions, even though it was already shown for a related 'Allocate' instruction. The change improves consistency and helps users spot transactions that request unexpectedly large storage allocations, which could be a sign of a malicious or misleading transaction.

This commit fixes a date-handling bug in Trezor hardware wallets. The device converts Bitcoin transaction lock-time timestamps into human-readable dates on its screen. Before the fix, the code used a 32-bit signed integer on real hardware, so any date after the year 2038 (and in practice after about 2068 in this code) would be misread and the wrong date would be shown to the user. The fix switches to a 64-bit timestamp type and adds tests for far-future dates up to the year 2106. The main risk is that a user could be tricked into approving a transaction whose real lock-time date is different from what the device displays.

This commit is a minor code cleanup in a test file. It reorganizes Python import statements to follow style guidelines by importing Callable and Sequence from collections.abc instead of typing. There is no functional change and no security relevance.

This commit updates Indonesian language translations for the Trezor hardware wallet. It adjusts wording and line breaks for different device models (Bolt, Caesar, Delizia, Eckhart) and updates the translation signature file. There are no code changes and no security implications.

This commit only adds time limits to automated GitHub Actions CI/CD jobs so they stop automatically if they run too long. It does not change any Trezor firmware code, wallet logic, cryptography, or user-facing behavior. There is no security vulnerability being fixed or introduced here.

This commit simply adds a new digital signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. It is a routine metadata update with no code changes and no apparent security relevance.

This commit simply advertises that Trezor Model T / Core devices support a new Ethereum feature called EIP-7702 when a host asks the device for its capabilities. It does not change how transactions are signed, authorized, or validated. There is no security-relevant behavior change.

This commit fixes a bug in the Trezor firmware's translation system where looking up a special 'sentinel' (end-marker) value could cause the device to crash (panic). The fix changes the code to safely check whether the next entry exists before reading it, returning 'not found' instead of crashing. A test was added to confirm the sentinel lookup no longer panics.

This commit rewrites the handling of externally downloaded coin/network definitions from Python into Rust. It moves parsing, signature verification, and protobuf decoding into a new Rust module. The change is described by the vendor as a non-security refactor ('RIIR' = 'Rewrite It In Rust') with no changelog entry. The diff itself does not introduce obvious new vulnerabilities, but it is a partial refactor: the Python side now delegates most validation to Rust, and some safety comments rely on assumptions about MicroPython not mutating buffers. There is no vendor statement that this is a security fix or that it addresses a reported vulnerability.

This commit only changes the wording of one on-screen message in the Trezor firmware. For the 'Eckhart' design theme, the text 'Cancel sign.' is changed to 'Cancel sign?' (and equivalent changes in Czech, German, Spanish, French, and Portuguese). It is a cosmetic localization tweak with no security effect.

This commit is a minor localization cleanup. It removes a trailing period from the 'Cancel sign' translation string in older product layouts (Bolt, Caesar, Delizia) and keeps the period only in the newest layout (Eckhart). It also updates the translation signature file. There is no security relevance.

This commit is a routine localization update. It adds one new translated button label ('Cancel sign'), fixes a punctuation mark in another label, and refreshes the generated translation files and their cryptographic signatures. There is no indication of any security issue.

This commit is a routine localization update. It adds one new user-facing button label, 'Review', to the Trezor hardware wallet's translation system and regenerates the files that store translated strings and their cryptographic signature. There is no change to security logic, no bug fix, and no vulnerability.

This is a routine code cleanup that replaces the older Optional[Type] style with the newer Type | None style in a few Python files. It also updates the project's automated style checker to enforce the newer style. There is no functional change to the code and no security impact.

This commit is a routine code cleanup that updates Python type annotations to a newer, recommended style. It does not change what the code actually does, only how type hints are written. There is no security issue here.

This commit only adds a new unit test file for the Solana transaction parser in the Trezor firmware. It does not change any production code, fix bugs, or alter behavior. It is purely a test/quality improvement with no security relevance.

This commit fixes a bug in how Trezor's Solana app counted account roles inside a transaction. In release builds, safety checks were removed, so a malformed transaction could trick the device into showing a signer account as read-only on screen. The device would not actually sign anything harmful, because the Solana network would reject the bad transaction anyway. The fix replaces the removed checks with proper error handling and corrects one rule: every transaction must have at least one writable signer to pay fees.

This commit only updates test data files (binary .dat fixtures and a UI test fixtures JSON file) to refresh timestamps. The change is explicitly described as avoiding CI test failures when a version number is bumped during release. There is no firmware code change, no user-facing behavior change, and no security relevance.

This commit is a documentation-only changelog update for the Trezor firmware release 2.12.5. It lists several security fixes that were already made in earlier code changes, including protections for Ethereum swaps and staking, Solana token display and stake lockup confirmation, and Stellar network and signer details. The commit itself does not change any firmware code, but it confirms that the vendor considers these items security-relevant for the release.

This commit fixes a bug in the Trezor hardware wallet's Rust UI code that splits text into chunks for display. The old code used byte positions instead of character positions when handling non-ASCII text (like accented letters or non-Latin scripts). This could cause the device to crash with a panic when trying to display certain international characters, because Rust would reject a slice that cut through the middle of a multi-byte character. The fix makes the chunking logic respect character boundaries. There is no direct evidence in the commit that this is exploitable as a security attack, but any device panic during rendering of user-facing text is at minimum a denial-of-service concern.

This update fixes a flaw in how Trezor handled certain Monero 'sweep' transactions. In a sweep, the device normally skips checking whether the change address truly belongs to the user, because the change output is supposed to carry zero coins and go to a random address. A malicious computer or wallet software could have reused that unvalidated change address for an output that actually holds money. The device would then treat that money as change and lock it with a key the user might not control, effectively freezing or misdirecting funds. The fix rejects such transactions unless the address is the user's own primary address, where the math happens to be safe either way.

This commit fixes a build-time race condition in the script that generates a list of internal string identifiers (called 'qstrs') used by the Trezor firmware. Previously, the generator could read a generated translation file while it was being updated, potentially producing an inconsistent list. The fix makes the generator read translation string names directly from the source translation file instead of from a generated file, and also excludes generated files from the grep search. This is a build-system reliability fix, not a runtime security vulnerability in the device itself.

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It only changes wording in Czech, German, Spanish, French, and Portuguese translation files, plus the corresponding translation signature metadata. There is no code change, no security fix, and no functional behavior change.