Trezor firmware

This commit only adds new user-visible text labels for two backup types ('N4W1 backup' and 'Wordlist backup') to the Trezor firmware's translation system. It does not change any security logic, cryptographic code, or user-flow behavior. The strings are empty on most device layouts and only populated for the 'Eckhart' layout. The translation signature metadata was also updated as part of the normal build process.

This commit is a routine cleanup that removes informal developer notes ('!@# TODO' markers) from six source files and makes one tiny code improvement (using an unsigned integer conversion function). There is no security-relevant change and no indication of a vulnerability being fixed.

This is a routine dependency update by an automated bot, bumping the Python testing library pytest from version 8.4.1 to 9.0.3. It only changes version numbers and download hashes in project configuration files. There is no indication of a security fix or vulnerability in the commit itself.

This is a routine dependency update by Dependabot that upgrades the Python imaging library Pillow from version 12.1.1 to 12.2.0 inside an internal battery-testing tool. The change is a single line in a requirements file. There is no indication in the commit that this fixes a known security issue, and the tool is not part of the Trezor firmware that runs on user devices.

This is an automated dependency update by Dependabot that bumps the Python 'cryptography' library from version 46.0.6 to 46.0.7 in the project's lock file. The change only updates recorded download URLs and cryptographic hashes for the new version. There is no indication in the commit itself that this fixes a known security vulnerability, and no security advisory was supplied. It is best treated as a routine maintenance patch.

This commit only adds new test cases for Ethereum vault deposits. It does not change any production firmware code, so it cannot introduce a security vulnerability in the device itself. The new tests check both valid deposits and cases that should be rejected, such as sending native ETH along with a deposit or a malformed transaction.

This is a routine code cleanup change in the Trezor firmware's Ethereum transaction signing module. It renames several internal constants to start with an underscore and wraps them with MicroPython's `const()` helper so the interpreter can optimize them. The numeric values and program logic are unchanged. There is no security fix or vulnerability here.

This commit fixes several small bugs in Trezor's Python library for Bluetooth (BLE) communication. The main fix prevents a crash when scanning for BLE devices multiple times, caused by a typo that iterated over dictionary values instead of items. Other changes add safety checks before reading or writing to a BLE device and improve error messages. There is no clear security vulnerability being patched; it looks like ordinary bug fixing and hardening.

This is an automated dependency update by Dependabot that bumps the Python syntax-highlighting library Pygments from version 2.19.2 to 2.20.0 in the project's lock file. There is no indication in the commit that this fixes a security issue, and Pygments is an indirect development-only dependency used for documentation or code display, not for handling secrets, cryptography, or user input in the hardware wallet firmware itself. On its own, this change does not present a security concern.

This commit is a simple code cleanup: it moves a small list of known Ethereum contract addresses and their human-readable names from one file to a new dedicated file. The actual addresses and names remain exactly the same, and no security behavior changes.

This commit changes how Trezor handles Ethereum transaction data (calldata). Previously, clear signing only worked if the entire calldata fit in the first chunk sent by the host. Now the device actively requests and stores up to 4 KB of calldata so it can try clear signing on larger transactions. If clear signing succeeds, the user sees a human-readable confirmation instead of raw hex data. The change refactors the code to collect initial data before deciding whether to clear sign or fall back to blind signing. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a feature improvement.

This is a routine automated dependency update by Dependabot. It bumps the Python 'requests' library used in an internal battery-testing tool from version 2.32.4 to 2.33.0. There is no indication in the commit or supplied references that this fixes a security issue, and the affected tool is not part of the Trezor firmware that runs on user devices.

This is a routine dependency update by an automated bot, bumping the Python 'ecdsa' library from version 0.16.1 to 0.19.2 in Trezor's firmware build tooling. The commit itself only changes version numbers and download hashes; it does not show any actual code fix or vulnerability. Dependency updates can sometimes include security fixes, but this commit does not say that is the reason, and no verified security references were provided.

This is an automated dependency update by Dependabot that bumps the Python 'cryptography' library from version 46.0.5 to 46.0.6 in the project's lock file. The commit itself only changes package hashes and download URLs; it does not modify Trezor's own code. The 'cryptography' library is widely used for encryption and secure communications, so keeping it up to date is generally good security hygiene. However, the commit message does not say this update fixes any specific security problem, and no verified references were provided. Therefore, while dependency updates can address vulnerabilities, we cannot confirm from this commit alone that a particular security issue is being fixed.

This commit is a pure code-style cleanup in the Ethereum 'clear signing' module. It removes unnecessary extra parentheses around tuple unpacking assignments. There is no functional change, no security fix, and no behavior change to the hardware wallet's transaction handling.

This commit only adds new user-facing text strings (labels like 'Deposit amount', 'Withdraw', 'Your address') for an upcoming Ethereum ERC-4626 vault feature. It also moves one existing word ('Deposit') from a Cardano-only string to a shared word list. There are no code logic changes, no security fixes, and no behavior changes in how the device handles transactions or private keys.

This is a routine automated update by Dependabot that bumps the Python library cbor2 from version 5.8.0 to 5.9.0 in the project's lock file (uv.lock). Only hashes and download URLs for the package changed. There is no indication in the commit itself that this fixes or introduces a security problem. Without checking the upstream cbor2 release notes, we cannot say whether the new version addresses any vulnerabilities.

This is a routine automated dependency update by Dependabot. It changes the pinned version of the Python 'requests' library from 2.32.5 to 2.33.0 in the project's lock file only. There is no indication in the commit that this fixes a security issue, and the change itself is just a version/hash update with no code modifications.

This commit fixes a bug in the Python Trezor client library that could cause it to crash or fail to connect when probing a Trezor device. The problem happened when leftover or unrelated data packets were still sitting in the communication channel. Previously, the library would see an unexpected packet, treat it as a protocol error, and give up. Now it skips those unrelated packets and waits for the real response. This is a reliability and minor security improvement for the host-side software, not the hardware wallet firmware itself.

This commit only adds new on-screen text strings for a future backup feature called N4W1. It does not change any security logic, cryptographic code, or user-accessible behavior. There is no indication of a vulnerability or security fix.

This commit updates the third-party STMicroelectronics RFAL NFC library inside Trezor firmware from version 3.0.1 to 4.0.2. The vendor's release notes for version 4.0.2 explicitly mention fixing a 'vulnerability during EMD handling on fast systems' that was introduced in version 4.0.0. EMD (Electro-Magnetic Disturbance) handling is part of the NFC radio stack, so the flaw is likely a low-level radio/communication issue rather than something that directly exposes cryptocurrency private keys. Because the commit is a large library drop (almost 8,000 lines changed across 55 files) and the actual code diff is not shown, we cannot independently verify the exact nature or severity of the vulnerability from this commit alone.

This commit enables Trezor hardware wallets to use SLIP-24 payment requests when signing ERC-20 token transfers. Previously, payment requests were rejected for any contract interaction, including ERC-20 transfers. The change adds a new code path that verifies the token transfer amount and recipient against a signed payment request before showing the confirmation screen. It is a feature-enablement change rather than a fix for an active vulnerability, but it touches security-critical signing flow code.

This commit changes how Trezor hardware wallets display and confirm Ethereum transactions that use 'clear signing' (human-readable descriptions of smart-contract calls). Previously, clear signing could be attempted for transactions whose data is split across multiple chunks. Now, clear signing is used only when the entire transaction data fits in the first chunk. If the clear-signing parser fails on that first chunk, the device falls back to the standard raw-data confirmation. The change is described as a feature limitation, not a security fix, but it removes a code path where multi-chunk data might be parsed before all chunks are available or confirmed.

This commit removes built-in 'clear signing' support for the 1inch decentralized exchange from Trezor Ethereum firmware. Clear signing makes complex crypto transactions easier to read and verify on the device screen. Removing it does not create a new security hole, but users interacting with 1inch will now see less human-readable transaction details, which can make it harder to spot malicious or mistaken transactions. It is a feature rollback, not a vulnerability fix.

This commit only adds new automated tests for Ethereum transaction data parsing. It does not change any production code, so it cannot introduce a security vulnerability by itself. The tests verify that the device correctly rejects malformed Ethereum addresses and oversized numeric values.