BTCPay Server

This commit fixes a UI bug in BTCPay Server's wallet address list. Previously, when a user changed labels on a reserved Bitcoin address, the label filter on the page did not update to reflect the new labels, and an error in the label manager initialization could break the feature. The patch makes the address list listen for label-change events and refresh its internal label data so filtering works correctly after edits.

This commit is a routine code cleanup of the wallet address label picker in BTCPay Server. It rewrites how the page caches and refreshes the list of available labels, removes an old Vue.js event listener, and adds a guard so the script does nothing if the expected HTML element is missing. There is no clear security bug being fixed and no security relevance is stated by the project.

This commit adds new UI filters, a label system, and a reporting provider for payment requests. It also changes the search query to use a hand-written SQL statement. The change is described as a feature improvement, not a security fix. The SQL query uses Entity Framework's parameterized raw SQL, which generally protects against SQL injection, but the code mixes raw SQL with LINQ and introduces a new label-filtering path. There is no direct evidence in the commit of a vulnerability being fixed or introduced, but the raw SQL and label-filtering logic are worth reviewing carefully because mistakes in those areas can lead to security bugs.

This commit updates test-only Docker configuration files. It upgrades the PostgreSQL database image used in automated testing from version 13.13 to 18.1, fixes indentation, and adds a persistent data volume for the test database. These files are part of the project's internal test harness and are not used in production deployments. There is no direct security fix or vulnerability being patched here.

This commit updates the PostgreSQL database version used only in BTCPay Server's automated test environment from version 13.23 to 18.1. It also changes the data directory mount path inside the container. There is no indication this affects production systems or fixes a security vulnerability.

This commit updates the PostgreSQL database version used only in BTCPay Server's automated test environment from 13.13 to 13.23, and adds a persistent data volume for that test database. It does not change production code. The newer PostgreSQL patch release likely fixes bugs and security issues in the database software itself, but the commit does not address any vulnerability in BTCPay Server's own code.

This commit adds a simple shell script used by BTCPay Server maintainers to automate creating and pushing a Git version tag when publishing Docker images. It does not change application code, user-facing behavior, or any security-sensitive logic. There is nothing in the commit that introduces a vulnerability or fixes one.

This commit is a routine code refactor that lets webhook event providers run their lookup logic asynchronously. It changes a synchronous method to an async one and updates callers to await it. There is no security issue visible in the diff.

This commit fixes a flaky automated test for BTCPay Server's subscription/monetization feature. The code change removes a guard that previously prevented a subscriber's plan from being restarted if it had already started. The test change waits for a background activation event and reloads the page before checking the UI. On its own, the patch looks like a timing/test-stability fix rather than a clear security fix, but removing the 'already started' guard could, in theory, allow duplicate plan activations or repeated credits if the event handler runs more than once.

This commit introduces a new Greenfield (REST) Subscription API to BTCPay Server, allowing stores to manage subscription offerings, plans, subscribers, credits, and checkout sessions programmatically. It also refactors existing subscription internals, adds new permissions, and makes small related fixes such as handling empty URL paths and adding a null check for invoice IDs. There is no explicit security bug in the diff, but the large new attack surface and a few design choices warrant careful review.

This commit simply renames two permission strings from 'membership' to 'offerings' across the codebase. It is a non-functional refactor that updates labels, constants, authorization checks, and API documentation to match the new terminology. There is no security-relevant change.