BTCPay Server

This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation and contains no security fix.

This commit marks several public methods on ASP.NET Core controllers with [NonAction], which prevents them from being exposed as web-accessible HTTP routes. Without this attribute, these helper methods could be reached directly via URL, potentially allowing users to bypass intended workflows, access internal logic, or trigger actions that were only meant to be called by other controller code. The change is a hardening fix rather than a clear-cut exploit patch, because the diff alone does not show that any of these routes were actually reachable or dangerous in practice.

This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authentication bypass when using Greenfield Basic authentication. The actual code fixes are not shown in this commit, so we can only see the vendor's description of the issues. The vendor rates these as 'not critical' but still recommends updating.

This commit only adds, removes, and reorders English text strings used for translations and user-interface labels in BTCPay Server. There are no code logic changes, no security settings being enabled or disabled, and no behavior changes. It is a routine localization/string update.

This commit updates several third-party software libraries and a test Docker image to newer versions. It also removes one library (AngleSharp) that was no longer needed. Dependency updates can fix security bugs in those external packages, but the commit message gives no details, and the diff itself does not show any direct vulnerability or attack path in BTCPay Server's own code.

This change makes BTCPay Server's Greenfield API stop accepting username-and-password 'Basic' authentication by default for existing users. New accounts can still use it for only the first five minutes after creation to set up an API key. After that window, Basic auth is blocked unless the user explicitly turns it on in their profile. The goal is to reduce the risk of password-based attacks on API access.

This commit is a user-interface redesign, not a security fix. It wraps store settings pages in new visual 'section' containers, updates headings and spacing, and adjusts CSS styling. No code behavior, permissions, or data handling changed.

BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (2FA) could access the Greenfield API using just an email and password, skipping the second factor. The change now blocks Basic authentication for any account that has any form of 2FA enabled, not just those using FIDO2 security keys. The vendor calls this a critical vulnerability under active exploitation and urges immediate upgrades.

This commit adds a user-facing preference feature to BTCPay Server's wallet transactions table: a dropdown that lets users show, hide, and reorder columns. Preferences are saved in the browser's localStorage. The change is a routine UI enhancement and does not appear to be a security fix. There is no indication from the commit that the vendor considers it security-relevant.

This commit changes how BTCPay Server decides whether a Bitcoin transaction input is a SegWit (witness) type when building PSBTs (Partially Signed Bitcoin Transactions). Previously the code only recognized three specific SegWit formats: native SegWit pay-to-pubkey-hash, native SegWit pay-to-script-hash, and Taproot. The new code uses a broader check that covers any script type classified as a witness script, including possible future SegWit versions. It also adds calls to fill in the 'witness UTXO' field in two wallet controller flows that previously did not do so. The practical effect is to make PSBTs more complete and compatible with future Bitcoin upgrades, and to reduce the chance that a wallet or signer will fall back to less secure non-witness data handling.

This commit removes a single line that automatically added witness UTXO data to SegWit inputs when decoding a PSBT. The change is titled 'Preserve imported PSBTs,' suggesting the previous behavior was modifying user-supplied transaction data in an unwanted way. Without more context, it is unclear whether this is a security fix or a functional/data-integrity change. The removed operation could, in some PSBT workflows, alter the information a hardware wallet or signer sees, which can affect how transactions are validated or signed.

This commit fixes a bookkeeping bug in BTCPay Server's multisig (multi-signature) transaction tracker. Previously, a pending transaction could silently collect enough signatures to be finalized, but the system would still label it as 'Pending' until something else happened. The change makes the service automatically mark such transactions as 'Signed' whenever they are read, and it adds tests to confirm the state is corrected. There is no direct evidence this was a security vulnerability or that it was exploited; it appears to be a state-consistency fix.

This commit changes BTCPay Server so that when it builds or decodes Partially Signed Bitcoin Transactions (PSBTs), it explicitly adds a compact 'witness UTXO' record for any SegWit inputs. Previously, some SegWit PSBTs may only have carried the full previous transaction (non-witness UTXO). Adding the witness UTXO improves compatibility with hardware wallets and signers that require or prefer it, and can reduce the data those devices need to process. The change itself is a correctness/compatibility improvement rather than an obvious vulnerability fix, but the absence of witness UTXOs in SegWit PSBTs can cause signing failures or force fallback behaviour in some wallets.

This commit is a follow-up code review patch for BTCPay Server's pending Bitcoin transaction (multisig) signing feature. It tightens when the service logs a warning versus a debug message after a failed finalization attempt, and it removes an unused optional parameter from an internal helper method. The changes are defensive: they reduce false-warning noise and make the per-input signature tracking more accurate. There is no direct evidence in the commit of an exploitable vulnerability being fixed.

This commit is a minor code cleanup that simplifies how BTCPay Server writes log messages when a pending multi-signature transaction fails to finalize. It removes the list of failed input indexes from the log and merges two nearly identical log statements into one. There is no security-relevant change.

This change tightens how BTCPay Server stores signature attempts for multi-signature Bitcoin transactions. Previously, every submitted PSBT (a partially signed transaction file) was kept in history, even if it added no real progress. Now only PSBTs that actually advance signing or successfully finalize the transaction are retained. This prevents unbounded growth of stored signature history, which could waste storage and potentially be abused to clutter or inflate a pending transaction record.

This commit only adds more detailed logging when a pending multi-signature Bitcoin transaction fails to finalize. It does not change how transactions are validated, authorized, or executed. There is no security vulnerability being fixed here; it is purely an observability improvement for operators.

This commit fixes a bug in BTCPay Server's multisig transaction handling. Previously, the service could get stuck in a 'Pending' state even when enough valid signatures had been collected, because it discarded new signature submissions that didn't immediately improve progress and didn't retry finalizing the transaction. The fix keeps distinct-but-not-yet-helpful PSBTs (partially signed transactions), records them, and retries finalization each time a new PSBT arrives, allowing later valid signatures to complete the transaction.

This commit changes one word in the project's changelog, adding the word 'the' to a bullet point. It is a grammatical typo fix with no effect on software behavior, security, or user data.

This commit changes how BTCPay Server stores invoice comments and metadata. Previously, comments were saved in a separate field and could be updated with a method that was not safe when multiple requests happened at the same time. The patch moves comments into the invoice metadata and uses database-level JSON operations to update only the requested field, reducing the chance that simultaneous updates overwrite each other. It also removes the dedicated 'comment' field from the public API, so comments can only be updated through the UI or via metadata. The commit title explicitly calls this a race-condition safety fix.

This commit adds a direct package reference to AngleSharp version 1.5.2 in one of BTCPay Server's project files. AngleSharp is a library for parsing HTML and other markup. The change itself is a dependency bump/addition, but the commit message and diff do not explain why it was needed or whether it fixes a security issue. Without additional context, we cannot tell if this is a routine maintenance update or a response to a known vulnerability.