What the developer wrote
Authored by Pavol Rusnak
chore(python): regenerate uv.lock
[no changelog]
What changed, and why it matters
This is a routine Python dependency lock file update that removes the 'ecdsa' package from the project's dependency list. There is no indication of a security fix, vulnerability, or malicious change in the commit itself.
No security action required. Treat as routine maintenance. If assessing supply-chain risk, verify separately that the removed 'ecdsa' dependency was unused and that its removal does not break any downstream consumers expecting it.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit regenerates ‘uv.lock’ and drops the ‘ecdsa’ dependency (and its version specifier ‘>=0.9’) from the Trezor Python package metadata. This appears to be a normal housekeeping change—likely because the code no longer imports the ‘ecdsa’ library or has switched to an alternative such as ‘cryptography’. The diff contains only two removed lines in a lock file; no source code changes are present.
Changed components
python/uv.lock dependency manifestInspect captured patch +0 / −2
diff --git a/uv.lock b/uv.lock
index 19cbfea9a..02bde72d6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2065,7 +2065,6 @@ dependencies = [
{ name = "construct-classes", version = "0.1.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.10'" },
{ name = "construct-classes", version = "0.2.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.10'" },
{ name = "cryptography" },
- { name = "ecdsa" },
{ name = "libusb1" },
{ name = "mnemonic" },
{ name = "noiseprotocol" },
@@ -2083,7 +2082,6 @@ requires-dist = [
{ name = "construct", specifier = ">=2.9,!=2.10.55" },
{ name = "construct-classes", specifier = ">=0.1.2" },
{ name = "cryptography", specifier = ">=41" },
- { name = "ecdsa", specifier = ">=0.9" },
{ name = "hidapi", marker = "extra == 'full'", specifier = ">=0.7.99.post20" },
{ name = "hidapi", marker = "extra == 'hidapi'", specifier = ">=0.7.99.post20" },
{ name = "libusb1", specifier = ">=1.6.4" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.