chore(core/rust): update heapless to 0.9.2
What the developer wrote
Authored by Martin Milata
chore(core/rust): update heapless to 0.9.2
Changes: https://docs.rs/crate/heapless/0.9.2/source/CHANGELOG.md
[no changelog]
What changed, and why it matters
This commit updates a Rust helper library called heapless from version 0.8.0 to 0.9.2 inside the Trezor firmware. The change is described as a routine dependency update. The commit message points to the upstream changelog but no specific security issue is mentioned, and no independent security references were provided. The actual code change is just a version bump and a small import-path adjustment in a code-coverage module. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but dependency updates can sometimes include security fixes from upstream.
Review the upstream heapless 0.9.2 changelog to determine whether this update addresses any security-relevant bugs. If it does, consider whether the fixed bug affects Trezor firmware and, if so, publish an advisory or changelog entry. If no security relevance is found, no further action is needed beyond normal dependency hygiene.
Security signals we found
Dependency version bump of heapless (0.8.0 -> 0.9.2)
Import path change due to upstream API reorganization (heapless::index_map)
No explicit security claim in commit message or title
No CVE, advisory, or researcher credit in supplied materials
Evidence from the diff
The diff bumps the heapless crate from 0.8.0 to 0.9.2 in core/embed/rust/Cargo.toml and Cargo.lock. The new version adds ufmt as a dependency and changes the public module layout: FnvIndexMap and Entry now live under heapless::index_map instead of the crate root, so coverage/mod.rs updates its use statement accordingly. The commit title is ‘chore(core/rust): update heapless to 0.9.2’ and the message says ‘[no changelog]’, indicating the project itself did not treat this as a user-facing or security-relevant change. No CVE, advisory, or researcher attribution is present in the supplied materials.
Changed components
core/embed/rust/Cargo.tomlcore/embed/rust/Cargo.lockcore/embed/rust/src/coverage/mod.rsheapless Rust crate dependencyInspect captured patch +5 / −4
diff --git a/core/embed/rust/Cargo.lock b/core/embed/rust/Cargo.lock
index 85837e1d..2403afad 100644
--- a/core/embed/rust/Cargo.lock
+++ b/core/embed/rust/Cargo.lock
@@ -114,12 +114,13 @@ dependencies = [
[[package]]
name = "heapless"
-version = "0.8.0"
+version = "0.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+checksum = "2af2455f757db2b292a9b1768c4b70186d443bcb3b316252d6b540aec1cd89ed"
dependencies = [
"hash32",
"stable_deref_trait",
+ "ufmt",
"ufmt-write",
]
diff --git a/core/embed/rust/Cargo.toml b/core/embed/rust/Cargo.toml
index 823a7ab8..8c46472f 100644
--- a/core/embed/rust/Cargo.toml
+++ b/core/embed/rust/Cargo.toml
@@ -123,7 +123,7 @@ zeroize = { version = "1.8.2", default-features = false, optional = true }
version = "0.2.2"
[dependencies.heapless]
-version = "0.8.0"
+version = "0.9.2"
features = ["ufmt"]
default-features = false
diff --git a/core/embed/rust/src/coverage/mod.rs b/core/embed/rust/src/coverage/mod.rs
index 191469ca..69d8d033 100644
--- a/core/embed/rust/src/coverage/mod.rs
+++ b/core/embed/rust/src/coverage/mod.rs
@@ -1,5 +1,5 @@
/// Off-heap data structure for collecting code coverage data.
-use heapless::{Entry, FnvIndexMap};
+use heapless::index_map::{Entry, FnvIndexMap};
use spin::RwLock;
use crate::{
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.