BTCPay Server

This commit only updates translation strings in a single C# resource file. It adds, removes, and rewords user-facing text labels (for example, changing '2FA' wording to 'Authenticator', adding labels for new passkey and multisig wallet features, and removing unused strings). There are no code logic changes, no security fixes, and no behavior changes.

This commit adds a single line to a test file to wait for the web page to finish loading before checking its content. It is a test reliability fix, not a security fix, and does not change any production code.

This is a one-line change in a test file that updates the name of a database migration being tested. It fixes a broken build caused by a renamed migration and has no security relevance.

This commit adds a new multisignature wallet setup feature to BTCPay Server. It introduces new database tables, UI flows, controllers, services, and tests for creating and managing multisig wallets. The changes are a feature implementation, not a security fix or vulnerability patch. There is no indication in the commit or supplied references that this addresses a security issue.

This commit swaps a regular dictionary for a thread-safe concurrent dictionary when caching store data attached to a web request. The stated goal is to prevent rare, random server crashes caused by multiple threads accessing the cache at the same time. It is a hardening fix rather than a clear-cut exploitable vulnerability, and the commit message does not frame it as a security issue.

This change is purely a user-experience improvement: when a BTCPay Server user is denied access to a page, the 403 error page now tells them which specific permission they are missing. It does not alter who can access what, nor does it fix or introduce any security vulnerability. It simply makes the denial message more informative.

This commit adds a new optional 'tax on tips' feature to BTCPay Server's Point of Sale app. Merchants can now configure a separate tax rate that applies to customer tips, and the receipt/cart display breaks out the tip tax separately from regular item tax. There is no indication this is a security fix; it is a normal business-logic feature addition.

This commit removes the 2FA recovery-code feature from BTCPay Server. Recovery codes are normally printed when you enable two-factor authentication and used as a backup way to log in if you lose your phone. After this change, users can no longer create or use those codes. The commit does not add a replacement backup login path, so anyone who loses access to their authenticator app may be permanently locked out of their account unless they have another login method configured. The change is presented as a feature removal, not as a fix for a specific security bug.

This commit adds passkey (passwordless) and login-code login support to BTCPay Server and rewrites much of the existing two-factor/FIDO2/LNURL-auth login flow. It is a large feature patch, not a documented security fix. The changes introduce several security-relevant design choices: passkeys can bypass the password entirely, session state now carries the login method and return URL, and the migration forces TwoFactorEnabled=true for all users while adding a separate AuthenticatorEnabled flag. Because the patch is broad and partially refactored, there is a non-trivial risk of authentication bugs (e.g., bypasses, session confusion, or incorrect 2FA enforcement), but the supplied diff does not show an obvious exploitable vulnerability.

This commit updates the project's test framework from xUnit version 2 to xUnit version 3. It only changes test code, package references, and compiler warning suppressions. There is no change to the production application that users interact with, and no security issue is introduced or fixed.

This commit adds new search and filter features to the wallet transaction list in BTCPay Server. Users can now filter transactions by text, direction (incoming/outgoing), labels, and date ranges, and export results matching those filters. The change is a feature addition with a large amount of new code, but the diff itself does not show an obvious security vulnerability. There are a few minor hardening touches, such as adding a missing null check for an unknown cryptocurrency code and removing a redundant anti-forgery attribute.

This commit only updates the API documentation file (a Swagger/OpenAPI template) to add a description for a newly documented setting called 'storeQuota'. It does not change any server code, permissions, or behavior. There is no security issue in this change.

This commit adds a new feature that lets server administrators set a maximum number of stores each non-admin user can create, both globally and per-user. It is a new restriction/control feature, not a fix for an existing vulnerability. There is no evidence in the commit or supplied references that this change addresses a security incident or was disclosed as security-relevant.

This commit restructures several user-interface pages so that payment requests, pull payments, invoices and apps no longer live under a '/stores/{storeId}/...' URL path. Instead they use flatter routes such as '/payment-requests/{id}/edit'. The change also updates the authorization layer so that when a store-scoped route is missing but an object ID is present, the system can fail the request with a 403 rather than letting the action itself silently return a 404. Several tests were updated to expect 403 instead of 404 for missing objects, and some permission-guard tests were removed or changed. The commit is described by the author as a UI route cleanup, not as a security fix, but it does touch access-control code.