Trezor firmware

This update fixes a bug in the Trezor hardware wallet's Bitcoin transaction signing. When a transaction included an external input (someone else's coin) with empty placeholder fields, the device could mistake it for an already-signed input. That would let it skip both signature verification and the warning that tells the user the input is unverified. The fix makes the device treat empty bytes the same as missing fields and rejects ownership proofs on internal or already-signed inputs.

This update fixes a security gap in how Trezor handles Bitcoin 'replacement transactions' (used to speed up or adjust a pending payment). Before the fix, a non-payjoin replacement could silently add a brand-new external recipient output, potentially redirecting some of the user's funds without asking for on-device confirmation. The patch now rejects any new external output in non-payjoin replacement transactions, so the device will block such changes and show an error instead of signing.

This commit simplifies how a Trezor hardware wallet asks the user to confirm details when signing Ethereum typed-data messages (EIP-712). Previously, the device first showed only the domain name and version and asked the user to press 'show more' to see the rest; now it always shows all domain fields. The change removes about 50 lines of caching and preview logic. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a user-interface simplification.

This commit changes how Trezor devices ask the user to confirm details for EIP-712 typed Ethereum signatures. Instead of showing each piece of the 'EIP712Domain' section one by one, it groups them into a single screen on newer devices. It also adds a warning when the dApp provides an empty EIP712Domain, which means the app did not identify itself. The change is a user-experience improvement with a small defensive-security side effect, not a fix for an active vulnerability.

This update fixes a display issue in Trezor's Solana token support. When a user approves a delegate (someone who can spend tokens on their behalf) using the older 'Approve' instruction, the device screen previously did not show which token account was being delegated. If a user owns several token accounts, they could accidentally approve the wrong one. The fix adds the source account to the on-screen confirmation, matching what the newer 'ApproveChecked' instruction already shows.

This commit is a documentation-only changelog update for the Trezor firmware release 2.12.2 and prodtest 0.3.8. It does not change any code, but it lists several security fixes that are part of this release. The most important ones affect Bitcoin and Solana transactions: Bitcoin signing could misidentify external inputs, and replacement transactions (RBF) could silently add new external outputs. Solana token transfers could display the wrong recipient address when using address lookup tables, and some Solana instruction parameters were not shown to the user for confirmation. Because the actual code changes are not in this commit, the risk assessment is based on the vendor's own changelog descriptions.

This commit changes how Trezor's Python library builds Merkle trees so that the trees are balanced. Previously, leftover odd nodes were pushed upward, which could make some membership proofs much longer than others. The change is described as a routine improvement ('chore') with no security claim by the vendor. There is no direct evidence in the commit that this fixes an active vulnerability, but unbalanced Merkle trees can theoretically leak information about which item is being proved or create subtle correctness/performance issues in protocols that assume balanced trees.

This commit only updates test data and a test assertion for Stellar payment request tests. It does not change any production firmware code, so it has no direct security impact on users.

This commit is a routine refresh of automatically generated translation files. It updates user-facing text strings (for example, changing punctuation or wording of on-screen messages) and adds one new string used during PIN setup. There is no change to security logic, cryptography, or how the device protects funds.

This commit only adds a new user-facing text label, 'ERC-8213 digest', used when a Trezor device displays Ethereum transaction details. There is no code that processes transaction data, cryptography, or user authorization. It is a translation/string asset change with no security relevance on its own.

This commit is a straightforward internal code cleanup in the Ethereum transaction signing flow. It turns a callback-creating helper function into a class and moves where that object is created. There is no change to user-visible behavior, security checks, or cryptographic handling.

This commit only adds new automated tests for the Trezor hardware wallet's Ethereum transaction signing. It checks that the device correctly rejects malformed transaction data sent during signing. There are no changes to the actual firmware code that users run, so this commit does not fix or introduce a security issue by itself.

This is a small code cleanup in Trezor's Ethereum transaction signing. When an Ethereum transaction has no extra data (calldata), the device no longer runs a now-unnecessary progress-indicator step. This only changes the user-interface flow for no-data transactions; it does not change what is signed or how the signature is computed. The large diff is mostly updated test screenshot fingerprints (hashes) reflecting the changed on-screen sequence.

This commit is a code cleanup in the Ethereum transaction signing module. It replaces a manual byte-copying loop with a simpler buffer extension approach and removes duplicate code that wrote the RLP header and hashed the data in two different places. There is no indication of a security bug being fixed.

This commit refactors how a Trezor hardware wallet asks for pieces of an Ethereum transaction's data from the host computer. It renames an internal helper and, importantly, adds a size check so the host cannot return a chunk larger than the device requested. That oversized-chunk condition could previously lead to memory corruption or unexpected behavior during transaction signing.

This is a minor code cleanup in the Ethereum transaction signing module. It moves an import statement so that a helper class (`HashWriter`) is only imported during type-checking, not at runtime. There is no functional change, no bug fix, and no security relevance.

This commit only adds and updates user-facing text strings (labels, warnings, and confirmation messages) for a new Ethereum feature called EIP-7702. It does not change any code that handles private keys, signing logic, transaction parsing, or security checks. There is no direct security issue visible in this change.

This commit changes only a test helper function in the Trezor firmware test suite. It moves a common-name check to the beginning of certificate-chain verification so the function can handle chains longer than before. There is no change to the actual device firmware or to any security-critical runtime code.

This is a code cleanup (refactor) in Trezor's Ethereum transaction signing. It merges two internal steps into one so that transaction data is streamed, hashed, and shown to the user in a single pass instead of two. The commit message says there is no functional change, and the visible code preserves the same hashing and confirmation behavior. UI test snapshots changed, which is expected because the on-screen flow order changed, but no security bug is evident from the diff alone.

This commit updates Trezor's Bluetooth firmware build system so it can compile against two different Nordic SDK versions (an older 2.9 and a newer 3.3). It adds version checks, pins the correct compiler toolchain, and renames a few Bluetooth and SPI constants so the same source code works with both SDKs. There is no obvious security bug being fixed; it is primarily a compatibility and build-reliability change.

This is an internal code cleanup in Trezor's Ethereum transaction signing. It changes how staking and yield-farming transactions hand off their user-confirmation step so the confirmation happens inside the same routine instead of being returned as a separate progress indicator. The commit message says the goal is to avoid needing a progress indicator because all transaction data is already loaded and hashed. There is no direct evidence in the commit of a security bug being fixed, but the change touches the code that decides what users see before they approve high-value operations like staking and vault deposits/withdrawals. The large set of updated UI test hashes shows the on-screen flow changed, which is expected for a refactor of this kind.

This commit fixes a length-check bug in Trezor's Stellar cryptocurrency support. The device was measuring string length in characters (Unicode code points) instead of bytes. Because some characters use multiple bytes, a string could pass the old check yet be too long for the Stellar protocol, potentially causing malformed transaction data or unexpected device behavior when signing.

This commit changes how a hardware wallet's screen-layout code handles the case where a user-interface layout has been closed or dropped earlier than expected. Previously the code would panic (crash). Now it returns a controlled RuntimeError instead. It is a defensive hardening change, not a fix for an active exploit, and it follows an earlier related pull request.

This is a clean internal code cleanup in the Ethereum app of the Trezor firmware. It moves the Keccak hashing helper to a shared location and updates callers to use it. There is no user-facing behavior change and no security fix.

This is a small internal code cleanup in Trezor's Ethereum transaction signing. It replaces two separate return values with a single tuple, because they are always either both present or both absent. There is no user-visible behavior change and no indication of a security fix.