Trezor firmware

This commit updates the Trezor Ethereum app's 'clear signing' feature so it can handle data formats that slice inside arrays or structs (for example, taking only a portion of a list). It is a small feature addition, not a fix for a known security bug. There is no evidence in the commit or supplied references that this resolves an active vulnerability.

This commit refactors how Trezor firmware handles unknown Ethereum tokens when showing transaction details on screen. Previously, if a transaction involved an unknown token, the device showed one generic warning. After this change, the code can detect and warn about multiple unknown tokens within a single transaction's data. It is a defensive code improvement rather than a fix for a known exploit.

This commit is a feature expansion for Trezor's Ethereum 'clear signing' system, which decodes smart-contract call data so users see human-readable details instead of raw hex. It adds support for dynamic Solidity types such as strings, byte arrays, structs, and arrays. The change is large and refactors how transaction data is parsed and presented. It does not appear to be a disclosed security fix, but because it handles untrusted transaction data, any parsing bugs could in principle let a malformed transaction bypass warnings or crash the device. The diff itself shows explicit bounds checks and validation, which is a positive sign, but the new code paths are complex and have not been externally audited in the provided materials.

This commit changes how the Trezor hardware wallet formats token amounts shown on screen during Ethereum transactions. It adds support for treating certain addresses as the network's native currency (like ETH on Ethereum mainnet) rather than as ERC-20 tokens when displaying amounts. There is no indication in the commit that this fixes a security vulnerability; it appears to be a user-interface correctness feature.

This commit changes how Trezor firmware handles Ethereum transaction data (calldata). Previously, the code only tried to 'clear sign' transactions where the entire calldata fit in the first chunk. Now it stores and processes up to 4 KB of calldata across multiple chunks, and gives up gracefully if the data is too large. The change appears to be a hardening/capacity improvement rather than a fix for an active exploit, but it removes a risky assumption that all data is present in the initial chunk.

This commit only updates German translation text and the corresponding test snapshots (expected screen hashes). It removes a few old variant translations for the term 'hidden wallet' and standardizes it to 'Passphrase-Wallet'. There is no code change and no security relevance.

This commit only updates translated text strings in the Trezor firmware. It adds new translations (for example, phrases like 'Confirm contract' and 'Intent' in several languages), fixes existing wording, and refreshes the translation signature file. There are no code changes that affect security, cryptography, or device behavior.

This commit is a routine maintenance update for translation files and test snapshots. It changes one French translation string, updates a cryptographic signature record for the translation set, and refreshes many expected visual test hashes. There is no code change that affects security functionality, and nothing in the commit suggests it fixes or introduces a vulnerability.

This commit adds support for native Solana (SOL) payment requests using the SLIP-24 standard on Trezor hardware wallets. It extends existing token payment-request logic to also cover plain SOL transfers, and updates tests and UI fixtures accordingly. There is no direct evidence in the commit of a security vulnerability, but any change to payment verification and confirmation flows carries a low level of implementation risk.

This commit adds a new factory/production tool command that permanently exits 'manufacturing mode' by writing and locking a special one-time-programmable memory block. It also reorganizes how each Trezor model defines its OTP memory layout and unit properties. The change is a feature addition for the production-test firmware, not a fix for a known exploitable bug in user-facing firmware. It does not appear to introduce an obvious vulnerability, but it changes security-relevant manufacturing state logic.

This is a routine automated dependency update by Dependabot that bumps the Python library pyasn1 from version 0.6.2 to 0.6.3 in the project's lock file. The commit itself only changes package metadata (download URLs and cryptographic hashes) and contains no code changes, bug fixes, or security claims. There is no evidence in the commit or supplied references that this update addresses a security issue.

This commit simply adds a new cryptographic signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. There is no code change, no bug fix, and no visible security issue in the diff itself.

This update changes how Trezor hardware wallets confirm Ethereum transaction data. Previously, the device asked the user to approve the entire data payload before it began hashing the transaction. Now, it confirms data piece by piece while the transaction is being hashed, and only shows the final transaction summary right before signing. The change is marked as a security fix in the project's changelog, suggesting the old behavior could let a user approve data that does not match what is actually signed.

This commit refactors how Trezor handles Stellar cryptocurrency transaction confirmations when a 'payment request' is used. Previously, the device might skip confirming individual operations during payment requests. The change ensures that only simple payment operations are allowed in payment requests, rejects invalid operation types, and still requires user confirmation. It also adds a test case for an invalid operation in a payment request. The commit appears to be a defensive hardening change rather than a fix for an active exploit.

This commit is a routine maintenance update for translation files and test snapshots. It changes one Spanish tutorial sentence to be clearer, updates the cryptographic signature metadata for the translation files, and refreshes many expected visual-test hashes. There is no code that runs on the device or handles secrets, and nothing in the commit suggests a security fix or vulnerability.

This is a small compatibility fix in the Trezor Python library. Older Trezor firmware versions did not return the wallet's 'root fingerprint' in one specific place, so the library was failing or warning users. The change makes the library read the same fingerprint from an older, always-available field instead. It is a bug fix for backward compatibility, not a security vulnerability patch.

This commit adds the initial protocol and code-generation scaffolding for a new Tron blockchain feature: voting for Super Representatives (called VoteWitnessContract). It defines the new message types in protobuf, regenerates the corresponding Python and Rust message bindings, adds translation strings, and includes test fixtures. It does not contain the actual firmware logic that would parse, validate, display, or sign these votes, so there is no directly exploitable security issue in this patch alone.

This is a routine automated dependency update by Dependabot, bumping the Rust crate 'static-alloc' from version 0.2.4 to 0.2.6. Only two metadata files (Cargo.lock and Cargo.toml) were changed, with no code modifications. There is no indication in the commit of any security fix or vulnerability.

This commit adds a GitHub Actions workflow that automatically assigns a newly opened pull request to the person who created it. It is a repository-management convenience bot with no connection to product security, cryptography, wallet operations, or firmware behavior.

This commit only changes a test file for the Tron cryptocurrency signing feature. It adds 'yield' statements to the test's simulated button-pressing sequence so the test properly waits between simulated user actions. There is no change to the actual Trezor firmware code that users run, and no security fix or vulnerability is present in the diff.

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates Czech, German, Spanish, French, and Portuguese translation files, plus their signature file, with wording changes, additions, and removals. There is no code logic change, no security fix, and no indication of a vulnerability.

This update changes how the Trezor hardware wallet handles unexpected messages while creating a seed backup. Previously, stray or hostile messages (such as a 'Cancel' command) could interrupt the backup process and leave the wallet in an unclear or partially-backed-up state. The fix wraps the backup flow in a new 'continue on errors' mode that ignores unexpected traffic and tells the host the device is busy, so the backup runs to completion. The change is defensive and improves reliability, but it also means a user can no longer cancel a backup from the host side once it has started.

This commit changes how Trezor handles Tron cryptocurrency smart-contract payments. Previously, the device used a programming assertion to assume that certain address-padding bytes were zero. Now it checks those bytes at runtime and rejects the transaction if the padding is wrong. The change likely prevents a malformed Tron token-transfer request from being misinterpreted or from causing the device to behave unexpectedly. It is a defensive hardening fix rather than a clear-cut remote exploit patch.

This commit is a code cleanup that moves the handling of on-screen button prompts into a separate helper function and adds a way to tell the message-reading code to reject any unexpected message. The change itself does not appear to fix a specific security bug, but it touches the code that decides which messages the device accepts while a user is confirming an action. There is no vendor statement that this is a security fix, and no independent researcher is credited.

This commit only changes automated test helper code for Trezor hardware wallets. It adds a way for test scripts to run small callback steps while the test framework clicks through on-screen menus, and updates a few Ethereum transaction test flows to use that mechanism. There is no change to the actual wallet firmware, cryptography, user-facing behavior, or security boundaries.