BTCPay Server

This commit fixes a JavaScript crash in the subscription portal. When a user had a lifetime subscription, the page did not show an auto-renewal checkbox, but the script still tried to attach an event listener to it. That caused a browser error that blocked the rest of the page's JavaScript, making it impossible to upgrade or downgrade the subscription. The fix simply checks whether the checkbox exists before attaching the listener. There is no direct security vulnerability here; it is a functional bug with a minor denial-of-service-like effect on the UI.

This commit adds a feature that lets BTCPay Server administrators download and update language translation packs from a GitHub repository. The code fetches JSON translation files over the internet, stores them in the server's database, and tracks whether a newer version is available. There is no clear security bug in the diff, but the design introduces a supply-chain and server-side request risk that should be reviewed carefully.

This commit adds a new store setting that lets merchants type a short custom message shown on the checkout page. The text is limited to 500 characters, stored as plain text, and displayed using a safe Vue.js directive that escapes HTML. There is no obvious security bug in the change itself, but it is a new user-controlled text field rendered on a payment page, so it needs careful handling to avoid future misuse (for example, if someone later changes how the text is displayed).

This commit changes the WebAuthn/FIDO login JavaScript so that it now sends an extra piece of information, called the userHandle, to the server when a user logs in with a security key or passkey. The userHandle helps the server identify which account the credential belongs to. Without it, the server may have to guess the account from the credential ID alone, which can cause login failures or, in some FIDO implementations, allow a credential to be associated with the wrong account. The change is small and looks like a correctness fix rather than a full security patch.

This change adds speed bumps (rate limiting) to API logins that use username-and-password Basic authentication. It is a hardening fix: before, attackers could make unlimited rapid login attempts through the API; now those attempts are throttled after the account is more than five minutes old. The patch also improves error messages so the server can tell callers exactly why authentication failed, including when they are rate-limited.

This commit is a routine internationalization (i18n) refactor. It marks more user-interface text strings in BTCPay Server's web pages as translatable and updates the default translation dictionary. There is no security-relevant change to application logic, access control, cryptography, or data handling.

This change hides a dashboard widget called 'Lightning Services' from users who do not have permission to change server settings. Previously, the widget may have been visible to users who lacked those rights, potentially exposing links or information about server-level Lightning services. The fix adds a permission check directly to the widget's HTML wrapper so it only renders for authorized users.

This commit fixes a permission inconsistency in BTCPay Server. Previously, a user who had permission to create Lightning invoices for a store might not have had explicit permission to view those same Lightning invoices. The change makes 'view Lightning invoice' a child permission of 'create Lightning invoice', so anyone who can create them can also see them. This is described as a fix, not a new security vulnerability disclosure, and the diff alone does not show an active exploit or a disclosed incident.

This commit mainly adds the LUNO exchange as the default source for South African Rand (ZAR) exchange rates in BTCPay Server. It also includes a small hardening fix in another rate provider so that missing bid/ask values don't crash the app, plus a batch of unrelated test reliability improvements. There is no clear security vulnerability being patched.

This commit fixes a flaky automated test for the crowdfunding feature. The test previously cleared a date field by directly manipulating the webpage's internal value, which was unreliable. The change makes the test click a visible 'Clear' button instead, and adds an ID to that button so the test can find it. There is no security issue here.

This commit is a straightforward code reorganization: it moves the Point of Sale (PoS) user-interface files from a shared views folder into the dedicated Point of Sale plugin folder, and updates the corresponding file paths in the controller and plugin registration. There is no functional change to how the application behaves, and no security fix or vulnerability is introduced.

This commit refactors how BTCPay Server stores labels for payment requests, moving them from a wallet-based graph system into new store-scoped database tables. It also adds a new API endpoint for updating store-scoped labels. The changes are primarily a feature/refactoring effort, but they include security-relevant hardening such as CSRF token validation on the new update endpoint, a check that the target store exists and matches the route, and restrictions preventing deletion or renaming of reserved system label types. A migration copies existing payment-request labels into the new tables and removes the old wallet-graph entries.

This commit is a code reorganization: it moves the Crowdfund feature's files into a dedicated plugin folder and updates the controller to use newer ASP.NET Core patterns (primary constructor, area routing). It also makes a small change so that looking up a store for an app throws an exception if the store is missing, instead of returning null. There is no clear security fix or vulnerability being patched here.

This commit adds new API features to BTCPay Server so users can create unsigned Bitcoin transactions (PSBTs) and broadcast already-signed transactions through the Greenfield API. It is a feature addition, not a bug fix. The code does not appear to introduce an obvious vulnerability, but it changes how wallet transactions are authorized and signed, which is security-sensitive. There is no vendor statement or external report saying this commit fixes a security issue.

This is a small user-interface bug fix. When a user scanned a QR code with their camera to provide a PSBT (a partially signed Bitcoin transaction), the on-screen modal dialog failed to close for multisig transactions because the JavaScript was clicking the wrong button. The patch makes the code click the correct button so the modal closes as expected. There is no security vulnerability here.

This commit adds a CI safety check that refuses to build Docker images unless the current Git commit has a valid GPG signature. It is a hardening improvement, not a fix for an active vulnerability. There is no indication in the commit or title that it responds to a known security incident.

This commit is a simple user-interface fix: it moves a checkbox setting ('Disable zero amount invoices') so it appears in the correct section of the Point of Sale settings page. The setting was previously only shown under the 'Keypad' section, but it should be visible for all Point of Sale types. There is no security issue here.

This commit adds a new optional setting for BTCPay Server's Point of Sale (PoS) app that lets store owners block invoices with a zero total amount. Previously, a customer could complete a checkout flow that created an invoice worth nothing, which could be used to generate fake or confusing payment records, test transactions, or possibly abuse downstream systems that expect only paid invoices. The change is a defensive feature, not a fix for a known active attack, and it is disabled by default.

This commit introduces a new Greenfield (REST) Subscription API to BTCPay Server, allowing stores to manage subscription offerings, plans, subscribers, credits, and checkout sessions programmatically. It also refactors existing subscription internals, adds new permissions, and makes small related fixes such as handling empty URL paths and adding a null check for invoice IDs. There is no explicit security bug in the diff, but the large new attack surface and a few design choices warrant careful review.

This commit simply renames two permission strings from 'membership' to 'offerings' across the codebase. It is a non-functional refactor that updates labels, constants, authorization checks, and API documentation to match the new terminology. There is no security-relevant change.

This is a large feature commit titled 'Monetization' that adds subscription and paid-access functionality to BTCPay Server. It introduces new plugins for monetization and subscriptions, changes how user login restrictions are enforced, adds a 'limited login' authentication scheme, and refactors user registration/invitation email flows. The changes touch authentication, authorization, billing, and user lifecycle logic. While the commit is framed as a feature, several areas have security implications: a new limited-login path that signs users in under a separate scheme when normal login is blocked, changes to password-reset and invitation-token handling, and new database entities for plans/subscribers/portal sessions. No explicit security bug is visible in the diff, but the breadth and sensitivity of the modified code means defects could have significant consequences.

This commit fixes a UI bug where BTCPay Server was showing a 'Create a new wallet' button to users who did not have permission to create wallets. The button itself was just a link; the actual wallet creation endpoint still enforced permissions separately. So the fix is about hiding an option that shouldn't appear, not about blocking an unauthorized action. It is a defense-in-depth or user-experience security improvement rather than a critical vulnerability.

This commit refactors how BTCPay Server decides whether a user is allowed to log in. It replaces a simple built-in check with a new extensible system where plugins can add their own login-blocking rules. The change touches password logins, two-factor/FIDO2/LNURL logins, API key authentication, and basic HTTP authentication. It also fixes a small bug in basic authentication where the password was checked before the user was validated. There is no claim in the commit that this fixes a known security vulnerability, and no CVE or advisory is referenced.

This is a large internal refactoring of how BTCPay Server's web UI tracks which navigation menu item is active. It replaces scattered, string-based helpers with a single LayoutModel and a new Razor tag helper. There is no obvious security vulnerability in the change; it is primarily code cleanup and test updates to match the new HTML IDs.

This commit standardizes the wording and behavior of delete-confirmation dialogs across the BTCPay Server web interface. Previously, different screens asked users to type different words such as "DELETE" or "REMOVE" to confirm deletion. Now every confirmation prompt uses the same word, "Delete," and the check is case-insensitive. This is a user-experience and consistency improvement, not a fix for a security vulnerability.