CommitWatch RSS
BT
← All projectsBTCPay Server

BTCPay Server

Free, open-source, self-hosted Bitcoin payment processor supporting on-chain and Lightning payments.

BitcoinLightning NetworkPayment infrastructureNormal
Source repository ↗Security policy ↗
Repository coverage

563 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

77security candidates198second-pass queue275AI analyses
65commits · 30 days
111commits · 60 days
313commits · 180 days
563commits · 365 days
Backfill bands
Aug 8 → Feb 9247 seen22 candidatesComplete
Feb 9 → Jun 9197 seen39 candidatesComplete
Jun 9 → Jul 954 seen0 candidatesComplete
Jul 9 → Aug 865 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

53/100 average clarity
76Strong · 80–100
134Adequate · 60–79
215Thin · 40–59
138Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Nicolas Dorier36544203346
Cerberus622290
rockstardev31612049
Abhijay Jain26610087
Chukwuleta Tobechi1857070
thgO.O29411065
Tim522074
Atharva Borade711067
dstrukt413065
Pavlenex412065
psam21312068
Nicholas Halka111091
Analysis record

Published AI watches

Last scanned 7 minutes ago

Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update Changelog

This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation a…

Changelog language changed to describe a critical, actively exploited vulnerability in release 2.4.2No code, configuration, or dependency changes present in the commitSecurity issue is referenced but not fixed or explained in this diff
fbf761f3by Nicolas Dorier+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Disabled unwanted routes

This commit marks several public methods on ASP.NET Core controllers with [NonAction], which prevents them from being exposed as web-accessible HTTP routes. Without this attribute, these helper methods could be reached directly via URL, po…

Public controller methods exposed as unintended HTTP routesRouting-level access-control hardeningPotential bypass of intended controller action flow
6689cad4by Nicolas Dorier+9−05 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Changelog for 2.4.2

This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authenticatio…

Vendor describes security fixes in changelogTOTP two-factor authentication bypass via Greenfield Basic authenticationBasic authentication disabled by default after account creation
3e2928cfby Nicolas Dorier+29−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update translations

This commit only adds, removes, and reorders English text strings used for translations and user-interface labels in BTCPay Server. There are no code logic changes, no security settings being enabled or disabled, and no behavior changes. I…

8d5f52daby Nicolas Dorier+17−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

bump deps

This commit updates several third-party software libraries and a test Docker image to newer versions. It also removes one library (AngleSharp) that was no longer needed. Dependency updates can fix security bugs in those external packages, …

Dependency version bumps for packages that handle HTML sanitization (HtmlSanitizer) and Bitcoin protocol parsing (NBitcoin/NBXplorer)Removal of unused AngleSharp package referenceNo commit-level description of security fixes or CVEs
1c16e265by Nicolas Dorier+10−1110 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 63 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Disable Greenfield Basic Auth by default after 5 min of user creation (#7492)

This change makes BTCPay Server's Greenfield API stop accepting username-and-password 'Basic' authentication by default for existing users. New accounts can still use it for only the first five minutes after creation to set up an API key. …

Disables Basic authentication by default after a 5-minute onboarding windowAdds per-user opt-in flag for Basic auth in data model, API, and UITightens rate-limit bypass to require a recently created account
61cb0702by Nicolas Dorier+74−612 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Containerize store settings views into sections & clean up views (#7448)

This commit is a user-interface redesign, not a security fix. It wraps store settings pages in new visual 'section' containers, updates headings and spacing, and adjusts CSS styling. No code behavior, permissions, or data handling changed.

b8774051by dstrukt+715−54920 files
No security note in commit
Open full analysis →Source commit ↗
Critical 86 AI analysisMessage 75 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)

BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (2FA) could access the Greenfield API using just an email and password, skipping the second factor. The change now blocks Basic authentication …

2FA bypassauthentication logic flawTOTP bypass
c173a919by Nicolas Dorier+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Adds table (wallet transactions) column controls (hide/show/re-order) (#7474)

This commit adds a user-facing preference feature to BTCPay Server's wallet transactions table: a dropdown that lets users show, hide, and reorder columns. Preferences are saved in the browser's localStorage. The change is a routine UI enh…

No security-relevant keywords in commit title or messagePure client-side UI feature using localStorageNo changes to authentication, authorization, or input processing
033460e7by dstrukt+422−157 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Cover all generated witness PSBTs

This commit changes how BTCPay Server decides whether a Bitcoin transaction input is a SegWit (witness) type when building PSBTs (Partially Signed Bitcoin Transactions). Previously the code only recognized three specific SegWit formats: na…

Broadens SegWit detection from a fixed allow-list to any ScriptType.Witness, mitigating future-version compatibility issuesAdds missing WitnessUtxo population in two wallet PSBT creation pathsWitness UTXO data reduces reliance on NonWitnessUtxo (full previous transaction) for SegWit inputs, which is a known PSBT hardening recommendation
ede7cc70by rockstardev+10−133 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Preserve imported PSBTs

This commit removes a single line that automatically added witness UTXO data to SegWit inputs when decoding a PSBT. The change is titled 'Preserve imported PSBTs,' suggesting the previous behavior was modifying user-supplied transaction da…

PSBT mutation behavior changedWitness UTXO data no longer auto-injected for SegWit inputsPotential data-integrity / non-repudiation consideration for imported PSBTs
31ad661aby rockstardev+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Finalize stale pending multisig transactions on read

This commit fixes a bookkeeping bug in BTCPay Server's multisig (multi-signature) transaction tracker. Previously, a pending transaction could silently collect enough signatures to be finalized, but the system would still label it as 'Pend…

State-machine inconsistency: persisted transaction state could diverge from actual signature countMultisig workflow: incorrect 'Pending' label for a transaction that is actually ready to broadcastNo input validation or authorization changes in the diff
1bcfc148by rockstardev+60−62 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Include witness UTXOs in SegWit PSBTs

This commit changes BTCPay Server so that when it builds or decodes Partially Signed Bitcoin Transactions (PSBTs), it explicitly adds a compact 'witness UTXO' record for any SegWit inputs. Previously, some SegWit PSBTs may only have carrie…

PSBT data completeness change for SegWit inputsPotential prior state: SegWit PSBTs may have been distributed without witness UTXOsHardware-wallet compatibility / BIP-174 compliance improvement
63236df4by rockstardev+83−04 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Address pending signature retry review feedback

This commit is a follow-up code review patch for BTCPay Server's pending Bitcoin transaction (multisig) signing feature. It tightens when the service logs a warning versus a debug message after a failed finalization attempt, and it removes…

Logging level change reduces false-warning noise but could mask real finalization failures if SignaturesNeeded is incorrectly zeroRemoval of additionalPsbt parameter prevents accidental combination of an unvalidated extra PSBT into the effective PSBTPer-input signature progress tracking refined to avoid prematurely counting aggregate signatures
89b8f49cby rockstardev+109−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Simplify pending finalization failure logs

This commit is a minor code cleanup that simplifies how BTCPay Server writes log messages when a pending multi-signature transaction fails to finalize. It removes the list of failed input indexes from the log and merges two nearly identica…

7e71c45eby rockstardev+11−271 file
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Bound pending multisig signature history

This change tightens how BTCPay Server stores signature attempts for multi-signature Bitcoin transactions. Previously, every submitted PSBT (a partially signed transaction file) was kept in history, even if it added no real progress. Now o…

Unbounded history/list growth bounded by logical retention gateResource consumption / storage abuse vector mitigatedLogic change in multi-signature signature collection path
eb0f15caby rockstardev+32−242 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Log pending transaction finalization errors

This commit only adds more detailed logging when a pending multi-signature Bitcoin transaction fails to finalize. It does not change how transactions are validated, authorized, or executed. There is no security vulnerability being fixed he…

c3fe1d7bby rockstardev+29−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix pending multisig signature retries

This commit fixes a bug in BTCPay Server's multisig transaction handling. Previously, the service could get stuck in a 'Pending' state even when enough valid signatures had been collected, because it discarded new signature submissions tha…

Logic flaw in multisig signature collection could leave transactions permanently pending despite sufficient valid signaturesPreviously ignored distinct PSBTs that did not immediately increase signature progressMissing retry of transaction finalization after collecting additional signatures
ebeafc5aby rockstardev+153−182 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix typo

This commit changes one word in the project's changelog, adding the word 'the' to a bullet point. It is a grammatical typo fix with no effect on software behavior, security, or user data.

2ed0fa17by Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add race condition safe InvoiceRepository.UpdateMetadata (#7475)

This commit changes how BTCPay Server stores invoice comments and metadata. Previously, comments were saved in a separate field and could be updated with a method that was not safe when multiple requests happened at the same time. The patc…

Commit title explicitly describes a race condition fixReplaced read-modify-write metadata update with atomic PostgreSQL jsonb_set operationRemoved dedicated API 'comment' field, narrowing update surface
5664bd41by Nicolas Dorier+51−9010 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedBump btcpayby Nicolas Dorier · 05c79c1c · Feb 17, 2026 · 2 filesMessage 0 · OpaqueInformational 15Details
Commit message · Nicolas Dorier

Bump btcpay

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a routine version bump from 2.3.4 to 2.3.5 and updates the changelog. It does not change any application code, configuration, or security settings. There is nothing in the diff that introduces, fixes, or alters a security-relevant behavior.

Lower-priorityRefactor : Added missing translation dynamic strings (#6904)by Abhijay Jain · d9b21234 · Feb 16, 2026 · 10 filesMessage 81 · StrongTriage 0Details
Commit message · Abhijay Jain

Refactor : Added missing translation dynamic strings (#6904)

* Fix missing StringLocalizer for dynamic success messages in store controllers

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Fix missing StringLocalizer for dynamic error messages in UIAppsController

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Add missing Display attributes to dashboard and utility ViewModels

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Add missing Display attributes to user management ViewModels

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: updated translations

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

---------

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedMinor refactoringby Nicolas Dorier · cf30de00 · Feb 16, 2026 · 2 filesMessage 18 · OpaqueInformational 15Details
Commit message · Nicolas Dorier

Minor refactoring

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a small code cleanup in BTCPay Server's admin translation pages. It changes how a helper service is passed into the controller, switching from method-level injection to constructor-level injection. There is no visible change in behavior, no new security feature, and no bug fix apparent from the diff.

Security candidateMerge pull request #7185 from Abhijay007/feat/updateTranslationsby Abhijay Jain · 0df82d8a · Feb 16, 2026 · 6 filesMessage 73 · AdequateLow 29Details
Commit message · Abhijay Jain

Merge pull request #7185 from Abhijay007/feat/updateTranslations

feat: added ability to update translations

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update pathmerge-commit duplicate discount
AI analysis · Low 29/100

This commit adds a feature that lets BTCPay Server administrators download and update language translation packs from a GitHub repository. The code fetches JSON translation files over the internet, stores them in the server's database, and tracks whether a newer version is available. There is no clear security bug in the diff, but the design introduces a supply-chain and server-side request risk that should be reviewed carefully.

Lower-priorityFix error on unsupported payout processor at startupby Nicolas Dorier · 8abfe557 · Feb 15, 2026 · 5 filesMessage 50 · ThinTriage 0Details
Commit message · Nicolas Dorier

Fix error on unsupported payout processor at startup

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateAdd custom textbox for checkout (#7182)by Pavlenex · 9b4b2e41 · Feb 15, 2026 · 8 filesMessage 81 · StrongLow 32Details
Commit message · Pavlenex

Add custom textbox for checkout (#7182)

* Add custom textbox for checkout

* Use overflow-wrap instead of deprecated word-break for checkout text

* Add client-side maxlength to checkout text textarea

81/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
memory safety
AI analysis · Low 32/100

This commit adds a new store setting that lets merchants type a short custom message shown on the checkout page. The text is limited to 500 characters, stored as plain text, and displayed using a safe Vue.js directive that escapes HTML. There is no obvious security bug in the change itself, but it is a new user-controlled text field rendered on a payment page, so it needs careful handling to avoid future misuse (for example, if someone later changes how the text is displayed).

AI review queuedAllow BTCPay Server to start without any on-chain payment methodby Nicolas Dorier · ab0a4910 · Feb 15, 2026 · 25 filesMessage 81 · StrongLow 28Details
Commit message · Nicolas Dorier

Allow BTCPay Server to start without any on-chain payment method

The default value of `--chains` (or `BTC_CHAINS`) is `BTC`, so it wasn't possible
to start BTCPay Server without at least BTC (or other Bitcoin fork) support.

This PR add a new configuration `--nodefaultchain` (or `BTCPAY_NODEFAULTCHAIN`).
When specified, an empty `--chains` will start BTCPay Server without any Bitcoin like chain support.

Partially fix #7175.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Low 28/100

This commit lets BTCPay Server start without any Bitcoin-like blockchain payment method enabled. It adds a new --nodefaultchain option and updates many parts of the code so the app no longer assumes Bitcoin is always available. Most changes are defensive null checks and UI message adjustments, but the broad scope means there is a risk of missed edge cases where the code still expects a default network and could crash or behave unexpectedly.

Security candidatePass userHandle to FIDO authby Nicolas Dorier · 69c99a1c · Feb 12, 2026 · 1 fileMessage 50 · ThinLow 33Details
Commit message · Nicolas Dorier

Pass userHandle to FIDO auth

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 33/100

This commit changes the WebAuthn/FIDO login JavaScript so that it now sends an extra piece of information, called the userHandle, to the server when a user logs in with a security key or passkey. The userHandle helps the server identify which account the credential belongs to. Without it, the server may have to guess the account from the credential ID alone, which can cause login failures or, in some FIDO implementations, allow a credential to be associated with the wrong account. The change is small and looks like a correctness fix rather than a full security patch.

Lower-priorityMigrate FIDO library to 4.0 (#7179)by Nicolas Dorier · aee4cf4e · Feb 12, 2026 · 7 filesMessage 53 · ThinTriage 0Details
Commit message · Nicolas Dorier

Migrate FIDO library to 4.0 (#7179)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Security candidateThrottle API calls with Basic auth (#7177)by Nicolas Dorier · a75b9517 · Feb 12, 2026 · 8 filesMessage 58 · ThinModerate 66Details
Commit message · Nicolas Dorier

Throttle API calls with Basic auth (#7177)

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Moderate 66/100

This change adds speed bumps (rate limiting) to API logins that use username-and-password Basic authentication. It is a hardening fix: before, attackers could make unlimited rapid login attempts through the API; now those attempts are throttled after the account is more than five minutes old. The patch also improves error messages so the server can tell callers exactly why authentication failed, including when they are rate-limited.

AI review queuedBump HtmlSanitizerby Nicolas Dorier · cb13a2a3 · Feb 11, 2026 · 1 fileMessage 18 · OpaqueLow 46Details
Commit message · Nicolas Dorier

Bump HtmlSanitizer

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
defensive validationsecond-pass: opaque commit message
AI analysis · Low 46/100

This commit simply updates a third-party HTML-cleaning library (HtmlSanitizer) from version 8.0.838 to 9.0.892 in the BTCPay Server project. The change is a one-line version bump in a project file. It is likely intended to pick up bug fixes or security fixes in the dependency, but the commit message does not say what those fixes are, and no security advisory or changelog was provided. On its own, this diff does not show any vulnerability in BTCPay Server's code, only that a dependency was refreshed.

Lower-priorityfeat: add CoinDCX rate provider for BTC/INR rates (#7173)by Abhijay Jain · fb0caa7b · Feb 11, 2026 · 2 filesMessage 85 · StrongTriage 0Details
Commit message · Abhijay Jain

feat: add CoinDCX rate provider for BTC/INR rates (#7173)

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Lower-priorityFix: Payments getting undetected on LND when the node restarted (#7176)by Nicolas Dorier · a8e0303a · Feb 11, 2026 · 2 filesMessage 70 · AdequateTriage 0Details
Commit message · Nicolas Dorier

Fix: Payments getting undetected on LND when the node restarted (#7176)

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityAvoid concatenations in copy-to-clipboardby Nicolas Dorier · c6612d7f · Feb 10, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Nicolas Dorier

Avoid concatenations in copy-to-clipboard

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityfeat: add Desiboard rate provider for BTC/USD and BTC/INR rates (#7169)by Abhijay Jain · 1a1a8189 · Feb 10, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · Abhijay Jain

feat: add Desiboard rate provider for BTC/USD and BTC/INR rates (#7169)

* feat: add Desiboard rate provider for BTC/USD and BTC/INR rates

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: Replace new HttpClient fallback with throw new ArgumentNullException

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: add desiboard to RegisterExchangeRecommendations for INR

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

---------

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedfeat(dashboard): support multi-crypto wallet balance widgets (#7110)by Sup3rlativ3 · 94a34596 · Feb 10, 2026 · 6 filesMessage 93 · StrongInformational 15Details
Commit message · Sup3rlativ3

feat(dashboard): support multi-crypto wallet balance widgets (#7110)

* feat(dashboard): support multi-crypto wallet balance widgets

* fix(wallet-balance): avoid handler lookup exceptions

* fix: keep store numbers aligned with setup guide

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine feature update for the BTCPay Server dashboard. It adds the ability to display wallet balance widgets for multiple cryptocurrencies at once, fixes a potential crash when looking up a cryptocurrency handler, and adjusts the dashboard layout. There is no indication of a security fix or vulnerability being addressed.

Security candidateRefactor : Added missing translations strings for various files (#6897)by Abhijay Jain · bcdd6dc8 · Feb 9, 2026 · 26 filesMessage 81 · StrongInformational 15Details
Commit message · Abhijay Jain

Refactor : Added missing translations strings for various files (#6897)

* refactor : Added missing translation strings to Wallet Management

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor : Added missing translation strings to Store Management

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings to Server Administration

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings to User Account

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings shared components

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings Invoice and Payment

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings other files

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor : Added missing translation strings other missed files

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: fixed some problematic strings

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Refactor: removed dynamic strings

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: addressed requested changes

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor : removed public facing page

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: updated branch and addressed coderabit comments

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* Update default translations and resolve merge conflicts

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

* refactor: removed duplicate attributes

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

---------

Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
seed or entropy pathsigning or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a routine internationalization (i18n) refactor. It marks more user-interface text strings in BTCPay Server's web pages as translatable and updates the default translation dictionary. There is no security-relevant change to application logic, access control, cryptography, or data handling.

Lower-priorityInclude BTCPay Server version in startup logsby Nicolas Dorier · 8be843fa · Feb 5, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Nicolas Dorier

Include BTCPay Server version in startup logs

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityFix: Do not show claim button in pull payments if it is archivedby Nicolas Dorier · d585d6d2 · Feb 4, 2026 · 1 fileMessage 70 · AdequateTriage 0Details
Commit message · Nicolas Dorier

Fix: Do not show claim button in pull payments if it is archived

Fix #7154

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityFix: Avoid uncaught exception caused by RateRules.GetRuleFor()by Nicolas Dorier · d50b441e · Feb 4, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · Nicolas Dorier

Fix: Avoid uncaught exception caused by RateRules.GetRuleFor()

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityTests: Move lightning tests to LightningTests.csby Nicolas Dorier · ec17ff50 · Feb 3, 2026 · 5 filesMessage 55 · ThinTriage 0Details
Commit message · Nicolas Dorier

Tests: Move lightning tests to LightningTests.cs

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityTests: Move roles tests into RolesTests.csby Nicolas Dorier · bc9f5ab2 · Feb 3, 2026 · 4 filesMessage 55 · ThinTriage 0Details
Commit message · Nicolas Dorier

Tests: Move roles tests into RolesTests.cs

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityFix CanUseRoleManager testby rockstardev · 38fd9bf0 · Feb 3, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · rockstardev

Fix CanUseRoleManager test

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityUpdating tests based on Nicolas feedbackby rockstardev · 8ec13ec3 · Feb 3, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · rockstardev

Updating tests based on Nicolas feedback

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityEnsure that server roles can be properly editedby rockstardev · 6df08286 · Feb 2, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · rockstardev

Ensure that server roles can be properly edited

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body