Trezor firmware

This commit adds support for two new TRON transaction types on Trezor hardware wallets: unfreezing staked TRX and withdrawing expired unfrozen balances. It also renames a field in the freeze/unfreeze messages from 'frozen_balance' to 'balance' and removes unused smart-contract function signatures. The changes are a routine feature addition for TRON staking operations and do not, on their own, look like a security fix or vulnerability.

This commit is a routine feature addition for the Trezor hardware wallet: it adds support for two new TRON blockchain operations (unstaking/unfreezing TRX and claiming unfrozen TRX). It updates protocol definitions, generated message bindings, translations, and test fixtures. There is no indication of a security vulnerability or fix in the changes themselves.

This is a one-line code cleanup in the Trezor firmware's transport protocol code. It changes how a single sync bit is read from a byte, switching from a right-shift to a bitwise AND. The old and new code should behave identically when the byte only ever holds 0 or 0x80 in that bit position. The change is labeled a 'refactor' with '[no changelog]', so the project does not present it as a security fix. There is no direct evidence of an exploitable bug, but the change removes a subtle assumption that could matter if other bits in the byte were ever set.

This commit is a routine update of translated user-interface text strings for the Trezor hardware wallet. It changes wording in Czech, German, Spanish, French, and Portuguese translation files, adds a couple of empty placeholder strings for an upcoming Ethereum feature, updates the translation signature file, and refreshes the expected UI test screenshot hashes. There is no code change that affects security, cryptography, or device behavior.

This is a routine automated dependency update by Dependabot. It bumps the urllib3 library used inside a non-production battery-testing tool from version 2.5.0 to 2.6.3. There is no indication in the commit that this fixes a security issue, and the changed file is not part of the Trezor firmware that runs on devices or handles cryptocurrency.

This is a routine dependency update generated by Dependabot. It upgrades the Python imaging library Pillow from version 11.3.0 to 12.1.1 inside a small internal tool used for battery testing. The change is a single line in a requirements file. There is no direct evidence in the commit that this fixes a specific security vulnerability, and the tool is not part of the Trezor firmware that runs on the hardware wallet itself.

This commit adds support for a new Tron blockchain operation called FreezeBalanceV2, which lets users stake TRX tokens to gain Energy or Bandwidth. The change is a feature addition: it adds the contract type to the list of supported transactions, shows the user a confirmation screen with the staking amount and resource type, and handles a protocol quirk where the default resource value must be omitted when serializing the transaction. There is no direct evidence in the commit of a security vulnerability, but any new signing path deserves careful review.

This commit adds support for a new Tron blockchain operation called FreezeBalanceV2, which lets users stake TRX tokens to gain Energy or Bandwidth. The change only updates message definitions, generated code, test fixtures, and translation strings. There is no actual signing or user-interface logic in this commit, and nothing in the diff suggests a security vulnerability.

This commit only adds two new English text labels, 'Confirm all' and 'Show next', to the Trezor firmware's translation system. It updates the generated code that maps internal keys to user-visible strings and refreshes the translation signature metadata. There is no change to security logic, user prompts, or how confirmations work.

This commit is a small internal code cleanup in Trezor's Ethereum transaction signing code. It changes a function that detects and handles Ethereum staking transactions from an 'async' (pause-able) style to a regular function that returns a confirmation task. There is no visible change in behavior, no bug fix, and no security-relevant change described by the vendor.

This commit is a minor user-interface cleanup. It removes a fallback English string ('Path ...') that was not part of the device's translation system and instead reuses an already-translated derivation-path label. It also stops the wallet from showing the same account information twice on screen when no proper account name is available. There is no security issue here.

This commit only updates test helper code in tests/input_flows.py. It renames a helper method and changes which on-screen text labels the tests look for, matching the tests to updated wording in the device firmware's user interface. There is no change to the actual Trezor firmware or wallet logic, so it has no security relevance for end users.

This is an automated dependency update by Dependabot that bumps the Python protobuf library from version 6.32.0 to 6.33.5 in the project's lock file. It also removes an unused 'ecdsa' dependency entry. There is no indication in the commit itself that this fixes a known security vulnerability, and no security advisory was supplied. Dependency updates can in principle include security fixes, but this change alone does not demonstrate any exploitable flaw.

This is a routine automated update by Dependabot that bumps the Python 'wheel' development dependency from version 0.45.1 to 0.46.2 in the project's lock file. It only changes a package metadata entry and does not alter any device firmware, wallet logic, or runtime code. There is no indication this fixes or introduces a security issue.

This commit simply widens the allowed version range for the Python 'click' command-line library used in Trezor's Python tools. It does not change any device firmware, wallet logic, or security-sensitive code. There is no indication this is a security fix or that it addresses any vulnerability.

This commit expands the Trezor hardware wallet's ability to clearly display details for more Tron TRC20 token transfers on the device screen. Previously, only one test token was recognized; now a built-in list of popular tokens (like USDT, USDD, BTT, etc.) is shown with their proper names and decimal places when a user signs a transfer. This is a user-experience and safety improvement, not a fix for a known exploit.

This commit is a pure code reorganization: it moves the Trezor host-side protocol implementation files from one Python package directory (transport/thp) to another (thp) and adds a new protocol_v1.py module. The actual logic, constants, and behavior appear unchanged. There is no indication this fixes or introduces a security vulnerability.

This commit is a routine code cleanup: it creates a Tron-specific copy of some smart-contract constants that were previously borrowed from the Ethereum app, and updates the Tron signing code to use its own copy. There is no functional change to how transactions are validated or signed, and no security bug is fixed or introduced.

This is a routine automated update by Dependabot that bumps the Python library cbor2 from version 5.6.5 to 5.8.0 in the project's lock file. The change only records new package download URLs and cryptographic hashes; no Trezor source code was modified. There is no indication in the commit that this fixes a security issue, and no verified security advisory was supplied. It is best treated as normal dependency maintenance.

This is a routine automated dependency update by Dependabot that bumps the Python library pyasn1 from version 0.6.1 to 0.6.2 in the project's lock file. There is no indication in the commit itself that this fixes a security issue, and no verified security references were provided. On its own, a patch-version bump of a pure-Python ASN.1 parsing library is normally treated as a maintenance change.

This is a routine automated dependency update by Dependabot. It bumps the Python build tool 'virtualenv' from version 20.34.0 to 20.36.1 in the project's lock file. The change only affects development tooling used to create isolated Python environments, not the Trezor firmware that runs on devices or handles cryptocurrency. There is no indication of a security fix or vulnerability in the commit itself.

This is an automated dependency update by Dependabot that bumps the Python urllib3 library from version 2.5.0 to 2.6.3 in the project's lock file. urllib3 is a widely used HTTP client library, but it is an indirect dependency here, meaning it is pulled in by another package rather than being used directly by Trezor's firmware code. The commit itself only changes version numbers and download hashes; it does not modify Trezor's own code. Without knowing which known urllib3 vulnerabilities exist between these versions or how Trezor's tooling uses it, the direct security risk from this single commit is low.

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates Czech, German, Spanish, French, and Portuguese translations, refreshes the cryptographic signature that verifies those translations, and updates the expected screen hashes used in automated UI tests. There is no code that handles secrets, cryptography, network communication, or user authorization, and nothing in the changes suggests a security vulnerability.

This patch fixes a kernel crash that could occur when an external (untrusted) application running on the Trezor device faults. The crash happened because the kernel tried to read a return address from a memory region it was not allowed to access. The fix temporarily relaxes memory protection just long enough to safely read that address, then restores it. It is a stability/reliability fix in a security-sensitive component, but the commit itself does not claim it is exploitable for theft of funds or secrets.

This commit introduces a new application loader and cache subsystem for the Trezor firmware. It adds code that loads external ELF-format applications into memory, manages their execution as isolated applets, and handles memory allocation for them. The change is a feature addition, not a documented security fix. The code includes a prominent warning that the STM32 ELF loader implementation should not be shipped in production devices. There is no evidence in the commit or supplied references that this resolves a known security incident or vulnerability.