From 624f1305729a58677b73ece7d23eca356c1b03b1 Mon Sep 17 00:00:00 2001
From: k9ert <117085+k9ert@users.noreply.github.com>
Date: Thu, 30 Apr 2026 14:01:23 +0200
Subject: [PATCH 1/2] deps: relax cbor2 upper bound to permit >=5.9.0

The <5.8 cap from #817 traps downstreams at cbor2 versions
vulnerable to GHSA-3c37-wwvx-h642 (high-severity DoS in
cbor2.loads), first patched in 5.9.0.

Empirical testing on real Jade hardware shows stock HWI 3.2.0
+ cbor2 5.9.0 completes signing successfully. Whatever broke
in 5.8.0 is fixed in 5.9.0 itself. Test matrix and logs at
https://github.com/al-munazzim/hwi-jade-cbor-repro

Excludes 5.8.0 explicitly (still freezes Jade on pyserial
transports per the test matrix).

poetry.lock not regenerated in this commit; maintainers may
prefer to handle that separately or defer until next release.
---
 pyproject.toml | 2 +-
 setup.py       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index ab98299ba..c49f4fcbb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,7 +24,7 @@ mnemonic = "~0"
 typing-extensions = "^4.4"
 libusb1 = ">=1.7,<4"
 pyside2 = { version = "^5.14.0", optional = true, python = "<3.10" }
-cbor2 = ">=5.4.6,<5.8"
+cbor2 = ">=5.4.6,!=5.8.0,<6.0.0"
 pyserial = "^3.5"
 dataclasses = {version = "^0.8", python = ">=3.6,<3.7"}
 semver = "^3.0.1"
diff --git a/setup.py b/setup.py
index e821a4ca2..2291e2603 100644
--- a/setup.py
+++ b/setup.py
@@ -26,7 +26,7 @@
 modules = \
 ['hwi', 'hwi-qt']
 install_requires = \
-['cbor2>=5.4.6,<5.8',
+['cbor2>=5.4.6,!=5.8.0,<6.0.0',
  'ecdsa>=0,<1',
  'hidapi>=0.14.0',
  'libusb1>=1.7,<4',

From 400f89c0dddcd5fed9ea4b3b075ea7335bf45702 Mon Sep 17 00:00:00 2001
From: Nazim <nazim@openclaw.ai>
Date: Fri, 1 May 2026 09:21:00 +0000
Subject: [PATCH 2/2] chore: regenerate poetry.lock for cbor2 bound change

---
 poetry.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 88af47e0e..8665bbe99 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.3.4 and should not be changed by hand.
 
 [[package]]
 name = "alabaster"
@@ -1311,4 +1311,4 @@ qt = ["pyside2"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.9,<3.13"
-content-hash = "ffa2aebd594ec1a5db15d7325c7bb26036b593faccf363163379e276bff1c191"
+content-hash = "d1499aefeb28562b02a108fb994e551b0dca96750984865cc6fcb494a2bbf58d"