BTCPay Server

This commit changes how the wallet transactions page reads its paging settings (skip/count). Instead of taking them directly from the URL, it routes them through a shared helper called ParseListQuery that also reads and saves user preferences in a cookie. The change is a code-quality fix to make paging behave consistently with other pages. There is no direct evidence in the commit that this fixes an active security vulnerability, but it removes a place where paging parameters were handled differently from the rest of the application.

This commit introduces more fine-grained permission checks for BTCPay Server's on-chain wallet API. Previously, many wallet operations required broad 'modify store settings' or 'view store settings' permissions. Now, operations are gated by dedicated wallet permissions such as viewing wallet data, managing wallet settings, creating/signing/broadcasting transactions, and managing wallet transactions. The change also fixes a Payjoin bug where the PSBT was finalized before the Payjoin request, which could break Payjoin flows. Overall, this is a hardening/security improvement rather than an introduced vulnerability.

This commit simply moves three Greenfield API wallet controller files from one folder to another inside the BTCPay Server codebase and updates their class constructors to use C# primary constructors. The code logic, authorization checks, route URLs, and security behavior appear unchanged. It is a refactoring/organizational change, not a security fix or feature change.

This commit is a large but straightforward code reorganization: it moves wallet-related view model classes from one namespace/folder (BTCPayServer.Models.WalletViewModels) into a new plugin-specific location (BTCPayServer.Plugins.Wallets.Views.ViewModels) and updates all references accordingly. There is no functional change to how the application behaves, no security fix, and no vulnerability introduced in the diff itself.

This commit fixes a permission leak in BTCPay Server's hot wallet handling. Previously, users who only had permission to sign transactions ('can sign') could also see the wallet's secret seed phrase, which should be restricted to store administrators. The change introduces a new 'HotwalletSafe' gatekeeper that separates 'can sign' from 'can see seed' and stops the seed from being passed through web forms or displayed to lower-privileged users.

This commit refactors authorization checks in two wallet-related controller actions. In one case, the 'clear' command previously required both server-admin role AND store-level wallet-settings permission; now it only requires a server-level policy. In another case, a new switch statement replaces nested if-checks but appears functionally equivalent. The change could be a security fix if the old combined check was overly restrictive, or a security weakening if the new single policy is less protective than the old two-factor check. Without vendor context, the security relevance is uncertain.

This commit is a routine code cleanup that converts three C# controller classes from traditional constructor syntax to a newer, shorter primary-constructor syntax. It does not change what the code does, what data it accepts, who can access it, or how it protects wallet operations. There is no visible security fix or behavior change.

This is a large refactoring commit that splits BTCPay Server's wallet functionality into a separate plugin and introduces finer-grained wallet permissions (view, create transactions, sign, broadcast, manage settings, etc.). It also adds new tests that verify users with only wallet permissions can access wallet pages and cannot perform actions outside their role. The change is primarily a security-hardening/permission-separation feature, not an obvious vulnerability fix, though it does include one small bug fix for pending-transaction broadcast matching.

This commit introduces a new, more narrowly-scoped permission called 'CanSendStoreEmail' and applies it to the store email-sending API. Previously, sending store emails required the broader 'CanModifyStoreSettings' permission, which also allows changing many other store settings. This change follows the security principle of least privilege: it lets administrators grant API keys or users the ability to send emails without giving them full power to change store configuration. It is a hardening improvement rather than a fix for an active exploit.

This commit only changes a single version number in a build file from 2.3.8 to 2.3.9. There is no code change, no bug fix, and no security-related content visible in the diff.

This commit only updates the changelog file to add release notes for version 2.3.9. It does not change any source code, configuration, or executable files. There is no security-relevant change in the diff itself.

This commit fixes a bug where BTCPay Server would not properly recover after a plugin crashed. The server tries to identify which plugin caused an exception by looking at the stack trace. The old code only checked the main assembly name and did not look inside nested/inner exceptions, so it sometimes failed to find the culprit plugin. The fix makes the search walk through inner exceptions and also maps all assemblies loaded by each plugin, not just the plugin's primary assembly. A second small fix prevents malformed plugin commands from crashing the command parser.

This commit changes several BTCPay Server API endpoints so that callers no longer need to supply a store ID when working with existing invoices, payment requests, and pull payments. The server now looks up the store automatically from the invoice/payment-request/pull-payment record. The old store-scoped routes are kept alongside the new shorter routes. The change is described as a convenience/cleanup fix, not as a security patch, and the diff does not show any new authorization checks being added.

This commit only changes test configuration files for the BTCPay Server project. It adds the Bitcoin setting `unsafesqlitesync=1` to the docker-compose files used during automated testing. This setting makes test execution faster by relaxing how safely Bitcoin Core writes its SQLite wallet data to disk. It does not affect production BTCPay Server code or live deployments, and there is no indication it fixes or introduces a security vulnerability.

This commit fixes a typo in a package version number. The version string for the NBXplorer.Client package had an extra stray backtick character (`), which would break the build. Removing the backtick restores the intended version 5.0.6 and allows the project to compile normally. There is no security issue here.

This commit is a routine translation and localization update. It adds, removes, and updates user-visible text strings in BTCPay Server. There is no code logic change, no security fix, and no vulnerability introduced in the diff itself.

This commit simply updates a software dependency (NBXplorer.Client) from version 5.0.5 to 5.0.6. There is no information in the commit itself about what changed in the new version or whether it fixes any security issue. Based only on this diff, no security problem can be identified.

This commit updates several third-party software libraries and Docker base images to newer patch versions. It does not change BTCPay Server's own code. Such updates are routine maintenance and often include bug fixes or security fixes from upstream vendors, but the commit message gives no specific security reason and no vulnerability details are visible in the diff.

This commit is a routine version bump from 2.3.7 to 2.3.8. It only updates the version number and the changelog. There are no code changes that fix or introduce any security issue in this commit itself.

This commit refactors an existing "login code" feature into a new optional plugin called Impersonation. The feature lets an already-logged-in user generate a short-lived QR code/login code that can be used on another device to sign in as the same user. The commit adds a new permission, btcpay.impersonation.canimpersonate, and rules that try to limit impersonation: a user can impersonate themselves, and server admins can impersonate non-admin users but not other admins. The code is a refactor rather than a reported vulnerability fix, but it moves a sensitive authentication capability behind a plugin and a permission check, which is a security-relevant design change.

This commit updates several software libraries and changes how BTCPay Server reads Bitcoin wallet descriptors (the strings that define which addresses belong to a wallet). The title says it fixes a bug where Phoenixd lightning payments were wrongly marked as partial, but the actual code changes mostly replace an older output-descriptor parser with a simpler one and update documentation examples. The security relevance is unclear from the diff alone: it could be a routine bug fix, or the library updates could include security patches. There is no direct evidence in the commit of an exploit or a disclosed vulnerability.

This commit is a routine software-engineering change: it marks several internal service methods and fields as virtual or protected so that third-party plugins can extend them more easily. There is no security bug being fixed and no new vulnerability being introduced in the diff itself.

This commit fixes a bug where BTCPay Server's 'reserved addresses' list could show addresses from a previously replaced wallet. After a user swaps one wallet for another, the old reserved addresses are now filtered out by checking which addresses actually belong to the current wallet's derivation scheme in the NBXplorer database. The commit also adds a Playwright test that verifies old addresses disappear after wallet replacement and reappear if the original wallet is restored.

This commit adds two new read-only reports to the Subscriptions plugin in BTCPay Server: one listing subscribers and another showing credit history. It is a straightforward feature addition with no visible security changes, no permission changes, and no fixes to existing behavior. The included test simply verifies the reports load without crashing.

This commit removes a feature that let BTCPay Server import wallet addresses and private keys into the Bitcoin node's own wallet ("Import keys to RPC"). The change deletes the user-facing option, the API field, the server policy setting, and all related permission checks. It is a hardening/removal change rather than a fix for an active bug, and the commit message does not describe it as a security vulnerability.