BTCPay Server

This commit adds a new store setting that lets merchants type a short custom message shown on the checkout page. The text is limited to 500 characters, stored as plain text, and displayed using a safe Vue.js directive that escapes HTML. There is no obvious security bug in the change itself, but it is a new user-controlled text field rendered on a payment page, so it needs careful handling to avoid future misuse (for example, if someone later changes how the text is displayed).

This commit lets BTCPay Server start without any Bitcoin-like blockchain payment method enabled. It adds a new --nodefaultchain option and updates many parts of the code so the app no longer assumes Bitcoin is always available. Most changes are defensive null checks and UI message adjustments, but the broad scope means there is a risk of missed edge cases where the code still expects a default network and could crash or behave unexpectedly.

This commit changes the WebAuthn/FIDO login JavaScript so that it now sends an extra piece of information, called the userHandle, to the server when a user logs in with a security key or passkey. The userHandle helps the server identify which account the credential belongs to. Without it, the server may have to guess the account from the credential ID alone, which can cause login failures or, in some FIDO implementations, allow a credential to be associated with the wrong account. The change is small and looks like a correctness fix rather than a full security patch.

This change adds speed bumps (rate limiting) to API logins that use username-and-password Basic authentication. It is a hardening fix: before, attackers could make unlimited rapid login attempts through the API; now those attempts are throttled after the account is more than five minutes old. The patch also improves error messages so the server can tell callers exactly why authentication failed, including when they are rate-limited.

This commit simply updates a third-party HTML-cleaning library (HtmlSanitizer) from version 8.0.838 to 9.0.892 in the BTCPay Server project. The change is a one-line version bump in a project file. It is likely intended to pick up bug fixes or security fixes in the dependency, but the commit message does not say what those fixes are, and no security advisory or changelog was provided. On its own, this diff does not show any vulnerability in BTCPay Server's code, only that a dependency was refreshed.

This commit is a routine feature update for the BTCPay Server dashboard. It adds the ability to display wallet balance widgets for multiple cryptocurrencies at once, fixes a potential crash when looking up a cryptocurrency handler, and adjusts the dashboard layout. There is no indication of a security fix or vulnerability being addressed.

This commit is a routine internationalization (i18n) refactor. It marks more user-interface text strings in BTCPay Server's web pages as translatable and updates the default translation dictionary. There is no security-relevant change to application logic, access control, cryptography, or data handling.

This commit adds a public PGP key file and updates a CI script to import it when verifying that commits are cryptographically signed. It is a hardening/operational improvement to the project's build verification process, not a fix for a software vulnerability in BTCPay Server itself.

This commit only updates a user-facing help message in the email rules page. It adds a second example placeholder ({Subscriber.Metadata.accessKey}) alongside the existing one ({Invoice.Metadata.itemCode}) to make the documentation clearer. There is no code behavior change and no security relevance.

This commit is a routine cleanup. It removes two unused namespace imports from a webhook trigger provider file and adds null checks and a page-load wait to automated UI tests. There is no change to production logic, no security fix, and no disclosed vulnerability.

This commit changes two lines in a single test file to make a flaky test more reliable. It replaces a broad check that the page contains the text 'Pay123' with a more precise check that a specific element with the expected ID shows the text 'Pay123'. This is a test-quality improvement, not a security fix.

This commit fixes a bug in BTCPay Server's subscription email feature where metadata placeholders for offerings and customers didn't work, and adds a new placeholder for subscriber metadata. The metadata strings are now parsed as JSON objects so email templates can correctly read individual metadata fields. There is no clear security vulnerability here; it is a functional bug fix with a minor side effect that malformed metadata could now cause a parsing error when an email is generated.

This commit only changes an automated UI test file. It adds a helper that checks whether a Bitcoin payment address was correctly filled in after clicking a parse button, and inserts that check plus a screenshot step at three points in the test. There is no change to production code, no user-facing behavior change, and no security fix.

This commit tightens a CI script that checks whether Git commits are cryptographically signed. Previously, the script only rejected commits with status 'N' (no signature). Now it accepts only 'G' (valid trusted signature) or 'U' (valid but untrusted signature) and rejects everything else. This is a hardening improvement, not a fix for an active security flaw.

This commit restores a test that checks whether the project's default translation file is up to date before a release. It does not change production code, fix a bug, or alter security behavior. It is purely a quality-assurance test for translation data.

This commit only adds new translation strings (empty placeholder entries for future localization) to a single C# file. There are no code logic changes, no security fixes, and no functional behavior changes.

This commit is a routine version bump and changelog update for BTCPay Server 2.3.4. It does not change any application code, only records what changed in the release. There is nothing in the diff that introduces or fixes a security issue by itself.

This commit adds a new 'deliveryTime' field to BTCPay Server's webhook API responses and updates the related documentation and invoice UI wording. It exposes when a webhook was actually sent, separate from when it was scheduled. There is no indication this change fixes or introduces a security vulnerability; it appears to be a transparency/usability improvement.

This commit only changes test code. It replaces a few brittle checks in automated UI tests with more robust Playwright-style assertions and adds a page-load wait. There is no change to production code, no user-facing behavior change, and no security relevance.

This change hides a dashboard widget called 'Lightning Services' from users who do not have permission to change server settings. Previously, the widget may have been visible to users who lacked those rights, potentially exposing links or information about server-level Lightning services. The fix adds a permission check directly to the widget's HTML wrapper so it only renders for authorized users.

This commit fixes a permission inconsistency in BTCPay Server. Previously, a user who had permission to create Lightning invoices for a store might not have had explicit permission to view those same Lightning invoices. The change makes 'view Lightning invoice' a child permission of 'create Lightning invoice', so anyone who can create them can also see them. This is described as a fix, not a new security vulnerability disclosure, and the diff alone does not show an active exploit or a disclosed incident.

This commit mainly adds the LUNO exchange as the default source for South African Rand (ZAR) exchange rates in BTCPay Server. It also includes a small hardening fix in another rate provider so that missing bid/ask values don't crash the app, plus a batch of unrelated test reliability improvements. There is no clear security vulnerability being patched.

This commit removes the old Selenium browser-automation test suite and its supporting infrastructure from the BTCPay Server project. It deletes test files, package references, Docker services, and CI job definitions, and updates two comments in production view files that previously mentioned Selenium. There is no change to the actual application code that users interact with, and no security fix or vulnerability is introduced.

This commit is purely a test-code reorganization. It moves several Playwright UI tests from one test file to another and creates a new dedicated WalletTests.cs file. No production application code was changed, so it cannot introduce a security vulnerability in the software users run.

This commit is a test-code refactoring: it moves existing webhook-related tests from several scattered test files into a single new file called WebhooksTests.cs. No production code is changed, and the commit message explicitly says it is just moving tests. There is no security fix or vulnerability here.