BTCPay Server

This commit removes unused C# 'using' statements (imported namespaces) and one unused Razor view import across 372 files. It is a code-cleanup change with no functional modifications. The only non-cleanup hunk is a tiny refactor in GreenfieldInvoiceController.UpdateInvoice that reorders an existing null check and variable assignment without changing behavior.

This commit is a code-quality and null-safety refactor. It makes the helper that retrieves the current store from an HTTP request return null when no store is set, adds a separate throw-on-null variant, and updates many controllers to use the appropriate variant. It also switches invoice lookups to use a context item set by an authorization filter. The changes reduce the chance of accidental null-reference crashes and make authorization checks more centralized, but the commit itself does not describe a specific security bug being fixed.

This is a large internal code cleanup that replaces calls to ASP.NET Core's UserManager for getting the current user's ID with a new direct helper that reads the value from the user's identity claims. Most changes are mechanical refactors across many controllers and views. There are a few small behavior changes worth watching: the new helper returns an empty string instead of "???" for missing users, some places now treat a missing user ID as a validation failure rather than passing it through, and a couple of user-not-found cases now return NotFound instead of throwing an exception. The commit does not describe itself as a security fix and no external advisory is provided.

This commit fixes how BTCPay Server's navigation bar decides which store's permissions to use when showing or hiding menu items. Previously, the permission checks inside the navigation bar could accidentally use the store from the main page (for example, the server settings page) instead of the store selected in the navigation bar. This could cause menu items to be shown or hidden incorrectly. The change makes the navigation bar temporarily switch to the correct store context while it renders, and removes a caching shortcut that could reuse the wrong permission result. There is no direct evidence in the commit message or diff that this was exploited or reported as a security vulnerability.

This commit fixes a small bug where a special permission claim was being added to a user's identity every time it was transformed, instead of only once. Repeated claims are harmless in most cases, but could in theory cause the identity to grow unexpectedly or lead to subtle authorization behavior. The fix checks whether the permission claim already exists before adding it again.

This is a large refactoring commit that reworks how permissions are defined and enforced in BTCPay Server so that plugins can register their own permissions. It moves the permission hierarchy out of a hard-coded static class into a runtime service, changes how store context is tracked during requests, and updates authorization handlers. The change is architectural rather than a targeted security fix, but any mistake in the new permission logic could allow users to access stores or functions they should not.

This commit only changes test code. It fixes a minor indentation issue and adds a test category label so that an existing test called CanUsePairing is run as part of automated browser-based (Playwright) testing. There is no change to production code, no bug fix, and no security relevance.

This commit simply turns down the volume on log messages coming from BTCPayServer's security components. It changes the logging level from the default (likely Information/Debug) to Warning, so routine 'authentication scheme challenged' messages no longer fill the logs. There is no code behavior change, no bug fix, and no security vulnerability being patched.

This commit only changes a test file to make an automated test less flaky. It adds checks so the test waits for the correct payout event and allows empty hooks in one specific scenario. There is no change to production code and no security issue.

This commit strengthens BTCPay Server's defenses against cross-site request forgery (CSRF) attacks. Instead of manually adding CSRF protection to each web UI controller, the team added a single global filter that automatically checks CSRF tokens for all UI controllers. They also converted several API (Greenfield) controllers from the web-style Controller base class to the API-style ControllerBase so the global filter does not accidentally apply CSRF checks to API endpoints. A few endpoints that legitimately need to skip CSRF (such as the error page and invoice state changes) are explicitly marked to ignore it. The change is a security hardening patch, but the commit message and diff alone do not prove a specific exploitable vulnerability existed before.

This commit updates BTCPay Server's automated test environment to use Bitcoin Core version 30.2 instead of 29.1. It also adjusts a few test helper calls and one test assertion to match changed behavior in the newer Bitcoin Core version. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.

This commit is a large code refactor that moves BTCPay Server's Bitpay-compatible API from the core application into a separate plugin. It relocates controllers, authentication, models, views, and middleware into a new Plugins/Bitpay folder, updates tests and dependency injection, and replaces the old middleware-based Bitpay API detection with a new endpoint selector policy. The change itself is structural rather than a targeted security fix, but any large refactor of authentication and routing code carries a risk of accidentally changing access-control behavior.

This commit is a routine code reorganization: it moves BTCPay Server's translation/localization code from the core server project into a dedicated 'Translations' plugin. The same dictionary-management features, language-pack download, and localization services are preserved, just relocated. There is no indication of a security fix or vulnerability being addressed.

This commit fixes a JavaScript crash in the subscription portal. When a user had a lifetime subscription, the page did not show an auto-renewal checkbox, but the script still tried to attach an event listener to it. That caused a browser error that blocked the rest of the page's JavaScript, making it impossible to upgrade or downgrade the subscription. The fix simply checks whether the checkbox exists before attaching the listener. There is no direct security vulnerability here; it is a functional bug with a minor denial-of-service-like effect on the UI.

This commit only changes a test file. It adds one extra assertion and reorders two existing assertions. There is no change to production code, no security fix, and no vulnerability.

This commit only changes a single version number in a build file from 2.3.5 to 2.3.6. There is no code change, no bug fix, and no security-related content.

This commit cleans up leftover build configuration entries in two C# project files. It removes duplicate or stale entries that told the build system how to treat certain view files and folders. There is no indication this change fixes or introduces a security problem; it appears to be routine housekeeping.

This commit removes a feature called 'Razor runtime compilation' from the main BTCPay Server application. Previously, in debug/development builds, the server could recompile web page templates (Razor views) on the fly while running. The change makes the server always use pre-compiled views instead. Runtime compilation is useful for developers but can increase attack surface, so removing it from production-like builds is a hardening move. A special test-only flag is added so developers can still enable it for testing.

This commit upgrades BTCPay Server from .NET 8 to .NET 10 and bumps many third-party libraries. It also makes small code changes to adapt to new framework APIs. The update itself is a routine maintenance change, but it removes some older dependencies and includes a few minor hardening tweaks, such as adding a null check before processing payment requests and filtering swagger files by extension. There is no direct evidence in the commit that this fixes a known security vulnerability, and the commit message does not mention security.

This commit changes a single line of on-screen help text in BTCPay Server. It updates the instructions for Wasabi wallet users, telling them to search for 'wallet folder' instead of using an older menu path. There is no code behavior change, no security fix, and no vulnerability.

This commit updates a single test file so that a language-pack test reads the list of downloadable languages from a shared service class instead of parsing a Razor view file directly. It is a test maintenance/refactoring change with no visible security relevance.

This commit fixes a flaky automated UI test by making the test wait until a notifications component has finished rendering before checking its contents. The code change adds a 'rendered' CSS class once Blazor has finished pre-rendering and updates the test to look for that class. There is no security relevance.

This commit is a routine version bump from 2.3.4 to 2.3.5 and updates the changelog. It does not change any application code, configuration, or security settings. There is nothing in the diff that introduces, fixes, or alters a security-relevant behavior.

This commit is a small code cleanup in BTCPay Server's admin translation pages. It changes how a helper service is passed into the controller, switching from method-level injection to constructor-level injection. There is no visible change in behavior, no new security feature, and no bug fix apparent from the diff.

This commit adds a feature that lets BTCPay Server administrators download and update language translation packs from a GitHub repository. The code fetches JSON translation files over the internet, stores them in the server's database, and tracks whether a newer version is available. There is no clear security bug in the diff, but the design introduces a supply-chain and server-side request risk that should be reviewed carefully.