docs(legacy): update changelog for 1.14.1
What the developer wrote
Authored by Roman Zeyde
docs(legacy): update changelog for 1.14.1
```
tools/changelog.py generate --date "18th March 2026" legacy/firmware 1.14.1
```
[no changelog]
(cherry picked from commit 78d928b4d3dee0bc2b4f8d7e5098468ba982da6f)
What changed, and why it matters
This commit is a documentation-only update that moves a changelog entry into the public release notes for Trezor legacy firmware version 1.14.1. The entry says the firmware now 'Enforce advanced recovery for mnemonics shorter than 24 words.' That wording suggests a prior security weakness: shorter seed phrases may have been recoverable using a simpler, possibly less secure method. However, the actual code change is not present in this commit, so we can only see the vendor's description of a fix, not the fix itself or how it could be attacked.
Review the actual firmware code change that introduced the advanced-recovery enforcement to understand the vulnerability and confirm the fix is complete. Do not rely on this documentation commit alone for security assessment.
Security signals we found
Changelog entry classified under 'Security'
Mentions enforcement of advanced recovery for shorter mnemonics
Implies a prior security boundary around recovery mode selection
No source-code diff is provided in this commit
Evidence from the diff
The diff deletes a fragment file (legacy/firmware/.changelog.d/+recovery.security) and inserts the same text into the public CHANGELOG.md under a ‘Security’ heading for release 1.14.1. No source code is modified. The changelog entry implies that advanced recovery (a Trezor feature where the device asks for specific word positions rather than the full mnemonic) is now mandatory for seed phrases with fewer than 24 words. The commit is a cherry-pick of another changelog commit, so the underlying code change happened elsewhere and is not included in the supplied materials.
Changed components
Trezor legacy firmware changelog/documentationImplied: legacy firmware recovery flow for mnemonics shorter than 24 wordsInspect captured patch +3 / −1
diff --git a/legacy/firmware/.changelog.d/+recovery.security b/legacy/firmware/.changelog.d/+recovery.security
deleted file mode 100644
index 0f90179e..00000000
--- a/legacy/firmware/.changelog.d/+recovery.security
+++ /dev/null
@@ -1 +0,0 @@
-Enforce advanced recovery for mnemonics shorter than 24 words.
diff --git a/legacy/firmware/CHANGELOG.md b/legacy/firmware/CHANGELOG.md
index 98584661..047e15d9 100644
--- a/legacy/firmware/CHANGELOG.md
+++ b/legacy/firmware/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
## 1.14.1 [18th March 2026]
+### Security
+- Enforce advanced recovery for mnemonics shorter than 24 words.
+
### Changed
- Allow using Ethereum mainnet addresses on all non-Ethereum networks. This enables access to networks like Hyperliquid that use conflicting chain IDs and cannot obtain official SLIP-44 registration. [#5134]
- Allow ETH staking operations regardless of source. [#6358]
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.