BTCPay Server

This commit only changes test code in BTCPay Server's PlaywrightTests.cs. It refactors how browser tabs are switched during automated UI tests and replaces some polling-style assertions with more direct Playwright expectations. There is no change to production code, no security fix, and no user-facing behavior change.

This commit fixes a flaky automated test for the crowdfunding feature. The test previously cleared a date field by directly manipulating the webpage's internal value, which was unreliable. The change makes the test click a visible 'Clear' button instead, and adds an ID to that button so the test can find it. There is no security issue here.

This commit fixes a potential server crash in BTCPay Server's error-handling page. Previously, if a visitor requested a non-HTML error page without specifying a status code, the code could try to use a missing value and throw a NullReferenceException. The change supplies a fallback 500 status code and renames a loop variable to avoid shadowing. It is a small defensive fix rather than a clear-cut exploitable vulnerability.

This commit is a straightforward code reorganization: it moves the Point of Sale (PoS) user-interface files from a shared views folder into the dedicated Point of Sale plugin folder, and updates the corresponding file paths in the controller and plugin registration. There is no functional change to how the application behaves, and no security fix or vulnerability is introduced.

This commit changes a single character in a test file, flipping a comparison operator from '==' to '!='. It is a test-only fix that corrects the logic of an assertion checking whether a UI alert appears. There is no change to production code and no security relevance.

This commit refactors how BTCPay Server stores labels for payment requests, moving them from a wallet-based graph system into new store-scoped database tables. It also adds a new API endpoint for updating store-scoped labels. The changes are primarily a feature/refactoring effort, but they include security-relevant hardening such as CSRF token validation on the new update endpoint, a check that the target store exists and matches the route, and restrictions preventing deletion or renaming of reserved system label types. A migration copies existing payment-request labels into the new tables and removes the old wallet-graph entries.

This commit is a purely cosmetic fix for a QR-code scan button icon in the wallet send page. It adjusts CSS margins and adds flexbox centering so the icon lines up correctly. There is no security relevance.

This commit is a code reorganization: it moves the Crowdfund feature's files into a dedicated plugin folder and updates the controller to use newer ASP.NET Core patterns (primary constructor, area routing). It also makes a small change so that looking up a store for an app throws an exception if the store is missing, instead of returning null. There is no clear security fix or vulnerability being patched here.

This commit is purely a test-code refactor. It moves existing pull-payment and coin-selection tests into a new dedicated test file, removes duplicate copies from other test files, adds a couple of shared assertion helpers, and fixes compiler/style warnings. No production application code is changed, so it cannot affect the security of a running BTCPay Server instance.

This commit reorganizes automated browser tests by splitting some Playwright tests into a second CI job. It does not change any production code, user-facing behavior, or security-sensitive logic. The only non-test code change is a small tolerance adjustment in a refund amount assertion, which is still a test-only change.

This commit is a routine test modernization: it rewrites one existing automated UI test to use the Playwright testing framework instead of Selenium, and adds a single HTML data-testid attribute to the signed-out page header so the test can reliably locate it. There is no change to production logic, no security fix, and no vulnerability introduced.

This commit only changes the order of steps in an automated test script for the BTCPay Server project. It moves a 'Description Edit' step earlier in the test flow to try to fix a flaky (unreliable) test. There is no change to production code, no user-facing behavior change, and no security relevance.

This commit only changes a test file and adds a test marker to a UI message. It makes an automated browser test more reliable by waiting for elements to appear and checking their text in a more stable way. There is no security relevance.

This commit removes one blank line from a database migration file. It is a cosmetic formatting change with no functional or security effect.

This commit is a routine version bump from 2.3.2 to 2.3.3 for the BTCPay Server project. It updates the version number, adds a changelog entry describing new features and bug fixes, and adds a single debug log line to a test. The commit itself does not contain any application code changes that would fix or introduce a security vulnerability. The changelog mentions several bug fixes, but none are described by the vendor as security issues, and no independent security references are provided.

This commit is a routine version bump to 2.3.3 for the BTCPay Server project. It updates the version number, adds a changelog entry, and adds a single debug log line in a test file. The changelog describes several bug fixes and one notable change: CoinGecko rate sources are removed because CoinGecko now requires an API key. None of the changes in the diff itself are security fixes or introduce security-relevant code.

This commit only updates the default translation strings file in BTCPay Server. It adds, removes, and rewords user-facing text labels (for example, new labels for monetization features, language packs, and payment request labels). There are no code logic changes, no security fixes, and no changes to how the application behaves.

This commit fixes a bug where choosing certain cryptocurrency exchange rate sources would crash the BTCPay Server 'Stores/Rates' settings page. The root cause was that some rate source IDs contained characters like dashes or dots that are not valid in C# identifiers, which caused the rate-rule parser to throw an exception and crash the page. The fix adds validation when creating rate-source IDs, changes one provider's ID to remove a hyphen, sanitizes several IDs in a large exchange list, and makes the controller gracefully fall back when a preferred source cannot be found or parsed.

This commit adds new API features to BTCPay Server so users can create unsigned Bitcoin transactions (PSBTs) and broadcast already-signed transactions through the Greenfield API. It is a feature addition, not a bug fix. The code does not appear to introduce an obvious vulnerability, but it changes how wallet transactions are authorized and signed, which is security-sensitive. There is no vendor statement or external report saying this commit fixes a security issue.

This is a small user-interface bug fix. When a user scanned a QR code with their camera to provide a PSBT (a partially signed Bitcoin transaction), the on-screen modal dialog failed to close for multisig transactions because the JavaScript was clicking the wrong button. The patch makes the code click the correct button so the modal closes as expected. There is no security vulnerability here.

This commit simply adds 'Norwegian' as a new language option in a dropdown list inside an administrative view. There is no security relevance: no code logic, permissions, data handling, or user input processing changed.

This commit adds a CI safety check that refuses to build Docker images unless the current Git commit has a valid GPG signature. It is a hardening improvement, not a fix for an active vulnerability. There is no indication in the commit or title that it responds to a known security incident.

This commit is a simple user-interface fix: it moves a checkbox setting ('Disable zero amount invoices') so it appears in the correct section of the Point of Sale settings page. The setting was previously only shown under the 'Keypad' section, but it should be visible for all Point of Sale types. There is no security issue here.

This commit is a routine version bump and changelog update for BTCPay Server 2.3.2. It does not change any application code, only the version number and release notes. The changelog describes bug fixes and a new feature, but those actual code changes are not present in this diff.

This commit adds a new optional setting for BTCPay Server's Point of Sale (PoS) app that lets store owners block invoices with a zero total amount. Previously, a customer could complete a checkout flow that created an invoice worth nothing, which could be used to generate fake or confusing payment records, test transactions, or possibly abuse downstream systems that expect only paid invoices. The change is a defensive feature, not a fix for a known active attack, and it is disabled by default.