CommitWatch RSS
TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

2655 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue1048AI analyses
343commits · 30 days
582commits · 60 days
1357commits · 180 days
2654commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1318Adequate · 60–79
859Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Andrew Kozlik702427266
Roman Zeyde571177209171
tychovrahe292104109161
PrisionMike945975173
Jakub Janků19915184
Martin Pastyřík2389173
cepetr1968282059
Ioan Bizău23076117059
obrusvit2137684064
M1nd3r2067177071
Lukas Bielesch846767067
Martin Milata1744646063
Analysis record

Published AI watches

Last scanned 1 hour ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(ethereum): fix incorrect address checksum

This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…

2b1938ccby Tomas Martykan+52−523 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove scons related files

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…

a4b25c31by cepetr+5−927554 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): assorted micropython-1.28.0 fixes

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…

Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
7ba7879dby Martin Milata+36−4012 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_cstr

This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.

6a889e6aby Martin Milata+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace hexlify with bytes.hex()

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…

44aa469eby Martin Milata+1334−1383120 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace m_new_obj_with_finaliser

This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…

No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
142794eaby Martin Milata+40−5619 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): bundle the utimeq module

This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…

617bc806by Martin Milata+284−2211 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_vstr

This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…

Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
7ea11191by Martin Milata+72−7433 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): switch to slots-based mp_obj_type_t

This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…

ab51798fby Martin Milata+163−16624 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): bindgen wrapper for calling static micropython functions

This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…

d5121d92by Martin Milata+20−06 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): adjust mpy-cross paths

This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…

2ef70e16by Martin Milata+18−264 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): collect micropython GC root pointers

This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…

GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
fc128f3dby Martin Milata+75−107 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedchore(deps-dev): bump wheel from 0.45.1 to 0.46.2by dependabot[bot] · aea24a58 · Feb 9, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps-dev): bump wheel from 0.45.1 to 0.46.2

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
dependency-version: 0.46.2
dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedchore(python): update `click` dependency versionsby Roman Zeyde · 34d382d4 · Feb 9, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde

chore(python): update `click` dependency versions

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedfeat(tron): Clear sign some TRC20 transfers.by PrisionMike · adf70c8e · Feb 8, 2026 · 3 filesMessage 57 · ThinLow 28Details
Commit message · PrisionMike

feat(tron): Clear sign some TRC20 transfers.

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 28/100

This commit expands the Trezor hardware wallet's ability to clearly display details for more Tron TRC20 token transfers on the device screen. Previously, only one test token was recognized; now a built-in list of popular tokens (like USDT, USDD, BTT, etc.) is shown with their proper names and decimal places when a user signs a transfer. This is a user-experience and safety improvement, not a fix for a known exploit.

AI review queuedrefactor(python): move protocols out of transportby matejcik · 61783a05 · Feb 3, 2026 · 9 filesMessage 57 · ThinTriage 7Details
Commit message · matejcik

refactor(python): move protocols out of transport

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedchore: use separate sc_constants for Tronby Ioan Bizău · 3f38c8e8 · Feb 2, 2026 · 3 filesMessage 57 · ThinInformational 15Details
Commit message · Ioan Bizău

chore: use separate sc_constants for Tron

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup: it creates a Tron-specific copy of some smart-contract constants that were previously borrowed from the Ethereum app, and updates the Tron signing code to use its own copy. There is no functional change to how transactions are validated or signed, and no security bug is fixed or introduced.

AI review queuedchore(deps): bump cbor2 from 5.6.5 to 5.8.0by dependabot[bot] · 4b47486b · Jan 30, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps): bump cbor2 from 5.6.5 to 5.8.0

Bumps [cbor2](https://github.com/agronholm/cbor2) from 5.6.5 to 5.8.0.
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](https://github.com/agronholm/cbor2/compare/5.6.5...5.8.0)

---
updated-dependencies:
- dependency-name: cbor2
dependency-version: 5.8.0
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedchore(deps): bump pyasn1 from 0.6.1 to 0.6.2by dependabot[bot] · 5bfff236 · Jan 30, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps): bump pyasn1 from 0.6.1 to 0.6.2

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](https://github.com/pyasn1/pyasn1/compare/v0.6.1...v0.6.2)

---
updated-dependencies:
- dependency-name: pyasn1
dependency-version: 0.6.2
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedchore(deps): bump virtualenv from 20.34.0 to 20.36.1by dependabot[bot] · 5f9d370a · Jan 30, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps): bump virtualenv from 20.34.0 to 20.36.1

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.34.0 to 20.36.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/20.34.0...20.36.1)

---
updated-dependencies:
- dependency-name: virtualenv
dependency-version: 20.36.1
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedchore(deps): bump urllib3 from 2.5.0 to 2.6.3by dependabot[bot] · 6bd6736f · Jan 30, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps): bump urllib3 from 2.5.0 to 2.6.3

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
dependency-version: 2.6.3
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedchore(translations): sync Crowdin translationsby obrusvit · 12e02478 · Jan 27, 2026 · 7 filesMessage 57 · ThinInformational 15Details
Commit message · obrusvit

chore(translations): sync Crowdin translations

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates Czech, German, Spanish, French, and Portuguese translations, refreshes the cryptographic signature that verifies those translations, and updates the expected screen hashes used in automated UI tests. There is no code that handles secrets, cryptography, network communication, or user authorization, and nothing in the changes suggests a security vulnerability.

AI review queuedfeat(core): introduce app_loader/cache moduleby cepetr · c0de3d9e · Jan 16, 2026 · 24 filesMessage 57 · ThinTriage 0Details
Commit message · cepetr

feat(core): introduce app_loader/cache module

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedfix(core): fix kernel crash when ext app faultby cepetr · e79f97af · Jan 16, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · cepetr

fix(core): fix kernel crash when ext app fault

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedfix: approve avantis dexby Ioan Bizău · a2fa7703 · Jan 15, 2026 · 4 filesMessage 40 · ThinLow 43Details
Commit message · Ioan Bizău

fix: approve avantis dex

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 43/100

This update fixes a bug in Trezor hardware wallets when signing certain Ethereum token-approval transactions. Some legitimate DeFi transactions include extra data that the wallet did not expect, which previously caused the device to crash instead of signing. The fix makes the wallet fall back to a simpler, generic signing mode for these unusual transactions. It is a reliability/usability fix rather than a theft-of-funds vulnerability, but a crash could still be used to deny service or trick a user into a less safe workflow.

AI review queuedfix(core/solana): optional program reference for SetComputeUnitLimitby Tomas Martykan · 0e3a8b29 · Jan 14, 2026 · 7 filesMessage 62 · AdequateLow 38Details
Commit message · Tomas Martykan

fix(core/solana): optional program reference for SetComputeUnitLimit

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 38/100

This update changes how Trezor handles one specific Solana instruction (SetComputeUnitLimit) so it can optionally accept a reference to another program account. Previously the device rejected or could not parse transactions that included this extra account reference, which is used by some services such as Jito. The change is a compatibility fix rather than a clear-cut security patch, but the prior strict parsing could have caused transaction failures or user confusion when signing legitimate Solana transactions.

AI review queuedchore(deps): bump tracing-subscriber in /rust/trezor-clientby dependabot[bot] · 2984383a · Jan 14, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

chore(deps): bump tracing-subscriber in /rust/trezor-client

Bumps [tracing-subscriber](https://github.com/tokio-rs/tracing) from 0.3.19 to 0.3.20.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.19...tracing-subscriber-0.3.20)

---
updated-dependencies:
- dependency-name: tracing-subscriber
dependency-version: 0.3.20
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedrefactor(core): remove pvd -> backlight dependencyby cepetr · fc166333 · Jan 13, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · cepetr

refactor(core): remove pvd -> backlight dependency

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedrefactor(core): split and move suspend module into io and sec layersby cepetr · 521cdb2e · Jan 13, 2026 · 23 filesMessage 62 · AdequateTriage 0Details
Commit message · cepetr

refactor(core): split and move suspend module into io and sec layers

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedrefactor(core): move i2c_bus driver to sys layerby cepetr · 01da3643 · Jan 13, 2026 · 23 filesMessage 57 · ThinTriage 0Details
Commit message · cepetr

refactor(core): move i2c_bus driver to sys layer

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedfeat(tests): cancel output flow on amount screenby Ioan Bizău · cee23581 · Jan 9, 2026 · 2 filesMessage 67 · AdequateInformational 15Details
Commit message · Ioan Bizău

feat(tests): cancel output flow on amount screen

[no changelog]

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new automated test for the Trezor hardware wallet. The test checks that a user can cancel a Bitcoin transaction signing flow from the amount confirmation screen on newer device models. It does not change any firmware, wallet logic, or security behavior. There is no security issue here.

AI review queuedbuild(core/rust): debug emulator should not immediately abort on panicby Roman Zeyde · 2b1aef94 · Jan 5, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde

build(core/rust): debug emulator should not immediately abort on panic

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedbuild(core/rust): improve panic message in debug buildsby Roman Zeyde · b4bd84d4 · Jan 5, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · Roman Zeyde

build(core/rust): improve panic message in debug builds

https://doc.rust-lang.org/core/panic/struct.PanicMessage.html#method.as_str should make panic's messages more helpful.

[no changelog]

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedchore: sign language blobsby Ioan Bizău · 17b17241 · Dec 16, 2025 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Ioan Bizău

chore: sign language blobs

[no changelog]

(cherry picked from commit 44d6b3d7c2415c7a7fd3306a35a9a3daf34275a2)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedchore(translations): sync Crowdin translationsby obrusvit · bd329a7e · Dec 16, 2025 · 7 filesMessage 57 · ThinInformational 15Details
Commit message · obrusvit

chore(translations): sync Crowdin translations

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine translation update. It changes translated text strings in Czech, German, Spanish, French, and Portuguese, updates the cryptographic signature that verifies those translations, and refreshes the expected screen hashes used by automated UI tests. There is no code behavior change and no security issue visible in the diff.

AI review queuedtest(legacy): add a test for Base network symbolby Roman Zeyde · afa93c66 · Dec 11, 2025 · 2 filesMessage 67 · AdequateInformational 15Details
Commit message · Roman Zeyde

test(legacy): add a test for Base network symbol

[no changelog]

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new test case for the Base cryptocurrency network. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. It is purely a testing update.

AI review queuedchore(core): sign translationsby Roman Zeyde · d0e6cc09 · Dec 1, 2025 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde

chore(core): sign translations

[no changelog]

(cherry picked from commit 74faaff1c63a545fa5834871639ca7bf89c26ac2)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path