Trezor firmware

This commit adds the ability for a Trezor hardware wallet to forget (unpair) a specific Bluetooth device by its MAC address, instead of only being able to unpair the currently connected device or all devices. It is a feature-completion change for the new Eckhart model's Bluetooth settings menu. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine user-facing feature implementation.

This commit fixes a build configuration problem in the RGB LED code for Trezor hardware wallets. It moves some shared color definitions outside a KERNEL_MODE guard and wraps an effects source file in the same guard, plus adds a missing dependency. There is no direct evidence this is a security vulnerability; it appears to be a build/dependency fix.

This commit simply adds a new approved digital signature for translation files used in Trezor firmware version 2.9.1. It is a routine maintenance task with no visible security-relevant code change.

This commit adds a verification step in the Trezor hardware wallet's factory production-test tool before writing a device certificate to secure storage. It now checks that the supplied certificate chain is cryptographically valid and matches the device's own MCU authentication key, preventing a malformed or mismatched certificate from being permanently written during manufacturing.

This commit adds a numeric model identifier for a specific Trezor hardware board (the T3W1 revision A with Nordic nRF52832 chip) into the firmware signing process as a protected custom TLV field. It is a feature addition that embeds device-model metadata into signed firmware images. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

This commit adds four pre-signed binary files called 'vendor headers' for a new Trezor hardware model (T3W1). These files are part of the device's firmware build and boot trust chain, but the commit itself only adds already-signed binaries. There is no code change, no evidence of a vulnerability, and no indication these files are malicious or improperly signed.

This commit is a routine user-interface change for the Trezor hardware wallet. It adds a small connection-status icon and a new 'Disconnected' label to buttons that represent Bluetooth Low Energy (BLE) paired devices. There is no security-relevant behavior change in the code.

This commit is purely a documentation update: it compiles the changelog for Trezor firmware version 2.9.1 by deleting individual changelog fragments and adding the final release notes to several CHANGELOG files. No source code, firmware logic, or security behavior is changed.

This is a straightforward internal code cleanup in Trezor's Python library. It replaces two separate flags that tracked whether a device was paired with a single simpler flag, and adds extra debug logging. There is no indication this fixes or introduces a security vulnerability.

This commit changes a single test marker so that a Cardano message-signing test runs on Trezor Model T/Core devices instead of being skipped on the older T1B1 model. It is a test-suite maintenance change with no effect on the actual firmware code that users rely on.

This commit only adds or updates translated text strings for the Cardano cryptocurrency feature. It replaces hard-coded English labels like 'Confirm message' and 'Message text' with references to the device's translation system, and updates the translation files, generated code, and a test marker. There is no change to security logic, cryptography, or how user approvals work.

This commit adds the public key to the Cardano message-signing response. It is a feature enhancement for software wallets, not a fix for a vulnerability. There is no security defect in the change itself.

This commit rewrites how the Trezor device fetches the message payload during Cardano message signing. Instead of the host pushing fixed-size chunks to the device, the device now asks for a specific slice of data by sending a length and offset, and the host replies with exactly that slice. The change also removes the previous 1024-byte maximum payload size limit, so larger messages can now be signed. The code adds bounds checks on both sides, but because the device now requests the entire payload in one go, this could stress limited device RAM. There is no direct evidence in the commit that this fixes a reported security bug; it reads as a feature/refactoring change.

This commit is a routine cleanup after merging (rebasing) other Cardano code changes. It updates the Cardano message-signing flow to use newer internal APIs (sessions instead of raw clients, and a separate SLIP-21 keychain argument) and refreshes automated test snapshots. There is no indication it fixes or introduces a security vulnerability.

This commit is a simple internal code cleanup in the Cardano app of Trezor firmware. It renames a function parameter from 'payload_first_chunk' to 'payload' and switches from keyword arguments to positional arguments in one call. There is no change to user-visible behavior, security logic, or data handling.

This commit fixes a display issue in Trezor's Cardano message signing feature. Previously, very long messages were visually trimmed on the device screen, so the user could not see the full content before approving a signature. The patch removes the trimming limit and adds a test case for a long payload. The risk is that a user might unknowingly sign a message whose full content they did not review, but the signature itself is still produced over the complete message (not a truncated one).

This update makes Trezor's Cardano message-signing feature refuse to sign 28-byte payloads that look like cryptographic hashes. The goal is to prevent users from accidentally signing a hash of an unknown message, which could let an attacker trick them into authorizing something they did not read. The change is a simple heuristic: if the payload is exactly 28 bytes and is not made of ordinary printable text, the device now rejects it with an error.

This commit is a routine code cleanup that renames and reorganizes error/exception types used in Trezor's Python library, particularly for the new THP (Trezor Host Protocol) transport. It does not change security behavior; it only makes error handling more specific and easier to maintain. For example, a generic 'device locked' exception is renamed and moved under a new THP error family, and THP error codes now raise distinct exception classes instead of generic strings.

This commit is a routine build/dependency housekeeping change. It updates Python version constraints and the internal 'trezor' package version requirement so that the project's Poetry lock file can be regenerated without conflicts. There is no indication this fixes a security vulnerability or changes runtime behavior of the Trezor firmware or wallet software.

This commit changes the Trezor Python library's handling of messages sent over the new THP (Trezor Host Protocol) transport. Previously, if a message had a bad checksum, the code would read a new message but did not track whether the newly received message was a fresh one or an old retransmission. The new code loops until it receives a message that passes the checksum and also has the expected sequence/sync bit, ignoring stale or out-of-order retransmissions. This is a hardening change: it makes the host-side protocol implementation more robust against duplicate or replayed packets, which could otherwise confuse state machines or cause commands to be processed twice.

This commit is a simple code cleanup: it removes a small helper method and places its contents directly into the function that called it. No behavior changes, no security fixes, and no new risks are visible.

This is a small code cleanup in Trezor's Python library for a newer transport protocol (THP). It changes a helper function so it returns 'no sequence bit' for message types that don't carry one, and adds an assertion to catch any unexpected case. The change is labeled a refactor with no changelog and appears defensive rather than a fix for an active security bug.

This commit is a simple code cleanup: it replaces a hardcoded number (50) with a named constant (`MAX_RETRANSMISSION_COUNT`) in the Python Trezor library. There is no functional change, no bug fix, and no security relevance visible in the diff.

This commit adds a new low-level keep-alive/ping feature to the Trezor hardware wallet's experimental THP (Trezor Host Protocol) transport. It lets the host send a PING and the device reply with a PONG, echoing back a random 8-byte nonce. The change also updates test tooling to use this new transport-level ping instead of a higher-level application ping. There is no indication this fixes a security vulnerability; it appears to be a feature/refactoring change.

This commit adds support for SLIP-24 payment requests when signing Solana transactions on Trezor devices. It is a feature implementation, not a security fix. The code introduces verification of payment request data against the transaction details and rejects cases with multiple token transfers when a payment request is present. There is no direct evidence in the commit of a vulnerability or security incident.