What the developer wrote
Authored by Peter D. Gray
version bump
What changed, and why it matters
This commit is a routine version bump and changelog tidy-up for the COLDCARD firmware. It changes two Makefile version numbers (5.4.3 → 5.4.4 for Mk4, 1.3.3Q → 1.3.4Q for Q1) and rewrites the draft release notes. No code, cryptographic, or security logic is modified.
No security action needed; treat as normal release bookkeeping.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff only touches release metadata: VERSION_STRING in stm32/MK4-Makefile and stm32/Q1-Makefile, plus markdown edits in releases/Next-ChangeLog.md. There are no source-code, build-system behavior, or configuration changes that could affect security. The changelog entries describe pre-existing features/bugfixes but are not part of this patch.
Changed components
releases/Next-ChangeLog.mdstm32/MK4-Makefilestm32/Q1-MakefileInspect captured patch +17 / −13
diff --git a/releases/Next-ChangeLog.md b/releases/Next-ChangeLog.md
index cd01990..f0959b6 100644
--- a/releases/Next-ChangeLog.md
+++ b/releases/Next-ChangeLog.md
@@ -4,30 +4,34 @@ This lists the new changes that have not yet been published in a normal release.
# Shared Improvements - Both Mk4 and Q
-- New: Added `Bull Bitcoin` export to `Export Wallet` menu
+- Added `Bull Bitcoin` export to `Export Wallet` menu
- Enhancement: Add warning for zero value outputs if not `OP_RETURN`
-- Enhancement: Show QR codes of output addresses in Txn output explorer. Output explorer is
- now offered for transactions of all sizes.
-- Bugfix: If all change outputs have `nValue=0` they're not shown in UX.
+- Enhancement: Show QR codes of output addresses in transaction output explorer. Explorer is
+ now offered for transactions of all sizes, not just complex ones.
+- Bugfix: If all change outputs have `nValue=0` they were not shown in UX.
- Bugfix: Disallow negative input/output amounts in PSBT.
-- Bugfix: Fix filesystem initialization after Wife LFS or Destroy Seed
+- Bugfix: Fix filesystem initialization after Wife LFS or Destroy Seed.
-# Spending Policy Feature
+## Spending Policy Feature
+
+- new feature: Spending policies for "Single Signer" adds spending policy options:
+ - limit your Coldcard so it refuses to sign transactions that are "too big"
+ - require 2FA authentication before signing any transaction (NFC+web)
+ - velocity limits can restrict how often new transactions can be signed
+ - see `docs/spending-policy.md` for details
- "Enable HSM" and "User Management" have moved into Advanced > Spending Policy
-- old "CCC" feature has been renamed and moved into that menu
-- new feature: Spending policies for "Single Signer" added:
- - power new stuff
+- old "CCC" feature has been renamed and moved into that menu as well
# Mk4 Specific Changes
-## 5.4.? - 2025-08-xx
+## 5.4.4 - 2025-09-1x
- Bugfix: Part of extended keys in stories were not always visible.
# Q Specific Changes
-## 1.3.?Q - 2025-08-xx
+## 1.3.4Q - 2025-09-1x
- Bugfix: Correct line positioning when 24 seed words displayed.
diff --git a/stm32/MK4-Makefile b/stm32/MK4-Makefile
index 33964ea..1916ba1 100644
--- a/stm32/MK4-Makefile
+++ b/stm32/MK4-Makefile
@@ -19,7 +19,7 @@ LATEST_RELEASE = $(shell ls -t1 ../releases/*-mk4-*.dfu | head -1)
# Our version for this release.
# - caution, the bootrom will not accept version < 3.0.0
-VERSION_STRING = 5.4.3
+VERSION_STRING = 5.4.4
# keep near top, because defined default target (all)
include shared.mk
diff --git a/stm32/Q1-Makefile b/stm32/Q1-Makefile
index 2b6b1b2..081c4cc 100644
--- a/stm32/Q1-Makefile
+++ b/stm32/Q1-Makefile
@@ -16,7 +16,7 @@ BOOTLOADER_DIR = q1-bootloader
LATEST_RELEASE = $(shell ls -t1 ../releases/*-q1-*.dfu | head -1)
# Our version for this release.
-VERSION_STRING = 1.3.3Q
+VERSION_STRING = 1.3.4Q
# Remove this closer to shipping.
#$(warning "Forcing debug build")
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.