BTCPay Server

This commit only adds, removes, and reorders English text strings used for translations and user-interface labels in BTCPay Server. There are no code logic changes, no security settings being enabled or disabled, and no behavior changes. It is a routine localization/string update.

This commit updates several third-party software libraries and a test Docker image to newer versions. It also removes one library (AngleSharp) that was no longer needed. Dependency updates can fix security bugs in those external packages, but the commit message gives no details, and the diff itself does not show any direct vulnerability or attack path in BTCPay Server's own code.

This change is a hardening measure, not a direct bug fix. BTCPay Server now turns off username/password Basic authentication for its Greenfield API by default once an account is more than five minutes old. Users can re-enable it manually, but the safer default is to require API keys instead. The vendor describes this as a defense-in-depth follow-up to reduce the impact of other authentication bugs.

This commit is a user-interface redesign, not a security fix. It wraps store settings pages in new visual 'section' containers, updates headings and spacing, and adjusts CSS styling. No code behavior, permissions, or data handling changed.

BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (the six-digit code from an authenticator app) could log into the Greenfield API using just their email and password, skipping the second factor entirely. The code previously blocked basic login only for users with FIDO2/hardware-key second factors, not for users with app-code (TOTP) second factors. The vendor says this was reported by Ben Carman and shipped as an emergency fix in version 2.4.2.

This commit adds a user-facing preference feature to BTCPay Server's wallet transactions table: a dropdown that lets users show, hide, and reorder columns. Preferences are saved in the browser's localStorage. The change is a routine UI enhancement and does not appear to be a security fix. There is no indication from the commit that the vendor considers it security-relevant.

This commit changes how BTCPay Server decides whether a Bitcoin transaction input is a SegWit (witness) type when building PSBTs (Partially Signed Bitcoin Transactions). Previously the code only recognized three specific SegWit formats: native SegWit pay-to-pubkey-hash, native SegWit pay-to-script-hash, and Taproot. The new code uses a broader check that covers any script type classified as a witness script, including possible future SegWit versions. It also adds calls to fill in the 'witness UTXO' field in two wallet controller flows that previously did not do so. The practical effect is to make PSBTs more complete and compatible with future Bitcoin upgrades, and to reduce the chance that a wallet or signer will fall back to less secure non-witness data handling.

This commit removes a single line that automatically added witness UTXO data to SegWit inputs when decoding a PSBT. The change is titled 'Preserve imported PSBTs,' suggesting the previous behavior was modifying user-supplied transaction data in an unwanted way. Without more context, it is unclear whether this is a security fix or a functional/data-integrity change. The removed operation could, in some PSBT workflows, alter the information a hardware wallet or signer sees, which can affect how transactions are validated or signed.

This commit fixes a bookkeeping bug in BTCPay Server's multisig (multi-signature) transaction tracker. Previously, a pending transaction could silently collect enough signatures to be finalized, but the system would still label it as 'Pending' until something else happened. The change makes the service automatically mark such transactions as 'Signed' whenever they are read, and it adds tests to confirm the state is corrected. There is no direct evidence this was a security vulnerability or that it was exploited; it appears to be a state-consistency fix.

This commit changes BTCPay Server so that when it builds or decodes Partially Signed Bitcoin Transactions (PSBTs), it explicitly adds a compact 'witness UTXO' record for any SegWit inputs. Previously, some SegWit PSBTs may only have carried the full previous transaction (non-witness UTXO). Adding the witness UTXO improves compatibility with hardware wallets and signers that require or prefer it, and can reduce the data those devices need to process. The change itself is a correctness/compatibility improvement rather than an obvious vulnerability fix, but the absence of witness UTXOs in SegWit PSBTs can cause signing failures or force fallback behaviour in some wallets.

This commit is a follow-up code review patch for BTCPay Server's pending Bitcoin transaction (multisig) signing feature. It tightens when the service logs a warning versus a debug message after a failed finalization attempt, and it removes an unused optional parameter from an internal helper method. The changes are defensive: they reduce false-warning noise and make the per-input signature tracking more accurate. There is no direct evidence in the commit of an exploitable vulnerability being fixed.

This commit is a minor code cleanup that simplifies how BTCPay Server writes log messages when a pending multi-signature transaction fails to finalize. It removes the list of failed input indexes from the log and merges two nearly identical log statements into one. There is no security-relevant change.

This change tightens how BTCPay Server stores signature attempts for multi-signature Bitcoin transactions. Previously, every submitted PSBT (a partially signed transaction file) was kept in history, even if it added no real progress. Now only PSBTs that actually advance signing or successfully finalize the transaction are retained. This prevents unbounded growth of stored signature history, which could waste storage and potentially be abused to clutter or inflate a pending transaction record.

This commit only adds more detailed logging when a pending multi-signature Bitcoin transaction fails to finalize. It does not change how transactions are validated, authorized, or executed. There is no security vulnerability being fixed here; it is purely an observability improvement for operators.

This commit fixes a bug in BTCPay Server's multisig transaction handling. Previously, the service could get stuck in a 'Pending' state even when enough valid signatures had been collected, because it discarded new signature submissions that didn't immediately improve progress and didn't retry finalizing the transaction. The fix keeps distinct-but-not-yet-helpful PSBTs (partially signed transactions), records them, and retries finalization each time a new PSBT arrives, allowing later valid signatures to complete the transaction.

This commit changes one word in the project's changelog, adding the word 'the' to a bullet point. It is a grammatical typo fix with no effect on software behavior, security, or user data.

This commit changes how BTCPay Server stores invoice comments and metadata. Previously, comments were saved in a separate field and could be updated with a method that was not safe when multiple requests happened at the same time. The patch moves comments into the invoice metadata and uses database-level JSON operations to update only the requested field, reducing the chance that simultaneous updates overwrite each other. It also removes the dedicated 'comment' field from the public API, so comments can only be updated through the UI or via metadata. The commit title explicitly calls this a race-condition safety fix.

This commit adds a direct package reference to AngleSharp version 1.5.2 in one of BTCPay Server's project files. AngleSharp is a library for parsing HTML and other markup. The change itself is a dependency bump/addition, but the commit message and diff do not explain why it was needed or whether it fixes a security issue. Without additional context, we cannot tell if this is a routine maintenance update or a response to a known vulnerability.

This commit updates the HtmlSanitizer software library from version 9.0.892 to 9.0.967. HtmlSanitizer is used to clean untrusted HTML and prevent malicious content from being displayed. Version bumps of this kind are often done to fix security bugs in the library, but the commit itself does not say what changed between these versions or whether any vulnerability affects BTCPay Server.

This commit updates the .NET runtime and several Microsoft packages from version 10.0.8/10.0.9 to 10.0.10, plus a couple of minor library updates. It is a routine dependency bump with no code changes. The commit message gives no security reason for the update, and no public references link it to any known vulnerability. Such updates often include undisclosed bug and security fixes in the underlying framework, so the change is security-relevant in a general maintenance sense, but there is no direct evidence this patch fixes a specific exploitable flaw in BTCPay Server.