BTCPay Server

This commit only updates user-facing help text in the Point of Sale plugin. It replaces outdated guidance about legacy API keys and Basic authentication with newer guidance about API tokens and the correct REST API endpoint. No code logic, authentication checks, or security behavior changed.

This is a one-line change to a test file. It adjusts an assertion so that the test now expects a database-migrated API key to have a null CreatedAt value instead of a non-null value. There is no production code change and no security relevance visible in the commit.

This commit refactors how BTCPay Server stores and handles API keys. Previously, the secret API key itself was used as the database primary key, meaning the full secret was stored in plaintext and appeared in URLs/revocation endpoints. Now the system creates a separate public 'key ID' (starting with 'akid_') derived from a hash of the secret, stores only a hash of the secret in the database, and uses the ID for management operations such as revocation. The change also removes the old BitPay 'Basic auth' legacy API key feature entirely. The commit is framed as a security hardening measure, but it is a large refactor rather than a single bug fix.

This commit changes how BTCPay Server stores and handles API keys. Previously, the secret API key itself was used as the database primary key and was stored in plaintext. After this change, the database stores a one-way hash of the secret, a short prefix for display, and a separate non-secret ID for management. The actual secret is only kept briefly in memory after creation and is then erased. The commit also removes an old BitPay-compatible 'legacy API key' feature that used Basic authentication with a plaintext key. These are defensive security improvements that reduce the damage if the database is stolen, but they do not by themselves fix an active vulnerability in running code.

This commit updates the HtmlSanitizer library to a newer patch version and reorganizes some account email-change tests. The library bump could fix a security bug in how user-supplied HTML is cleaned, but the commit itself does not say it fixes a security issue or describe any specific vulnerability. The test changes appear to be routine refactoring of how the application verifies email address changes.

This commit adds a security check so that when a user tries to change their email address on their account profile, they must enter their current password. Before this change, an attacker who had already hijacked a logged-in session could change the account email without proving they knew the password, making account takeover easier. The change is described by the project as low-impact.

This commit changes a single word in a build script's status message, from 'if it is possible' to 'whether it is possible'. There is no functional, security, or behavioral change to the software.

This commit changes how BTCPay Server's plugin manager asks the plugin directory for update information. Previously, the server fetched the full catalog of plugins and then filtered locally. Now it sends a list of the plugins actually installed or pending on the local server and asks only for updates to those. This reduces unnecessary data exposure of the server's plugin inventory to the directory and may avoid bugs where pending or disabled plugins were not considered when checking for updates. It is a hardening/fix change rather than a clear-cut security patch, and the commit message does not claim it fixes a vulnerability.

This commit adds one extra wait/check to an automated test that verifies email rules appear in a web page. It is purely a test-stability fix and does not change any production code, user-facing behavior, or security boundary.

This commit changes a CI test script so that GitHub Actions can write step summary reports to the correct file path inside a Docker container. It is a build/test infrastructure fix with no apparent security relevance.