BTCPay Server

This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation and contains no security fix.

This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authentication bypass when using Greenfield Basic authentication. The actual code fixes are not shown in this commit, so we can only see the vendor's description of the issues. The vendor rates these as 'not critical' but still recommends updating.

This commit only adds, removes, and reorders English text strings used for translations and user-interface labels in BTCPay Server. There are no code logic changes, no security settings being enabled or disabled, and no behavior changes. It is a routine localization/string update.

This commit updates several third-party software libraries and a test Docker image to newer versions. It also removes one library (AngleSharp) that was no longer needed. Dependency updates can fix security bugs in those external packages, but the commit message gives no details, and the diff itself does not show any direct vulnerability or attack path in BTCPay Server's own code.

This commit is a user-interface redesign, not a security fix. It wraps store settings pages in new visual 'section' containers, updates headings and spacing, and adjusts CSS styling. No code behavior, permissions, or data handling changed.

This commit adds a user-facing preference feature to BTCPay Server's wallet transactions table: a dropdown that lets users show, hide, and reorder columns. Preferences are saved in the browser's localStorage. The change is a routine UI enhancement and does not appear to be a security fix. There is no indication from the commit that the vendor considers it security-relevant.

This commit fixes a bookkeeping bug in BTCPay Server's multisig (multi-signature) transaction tracker. Previously, a pending transaction could silently collect enough signatures to be finalized, but the system would still label it as 'Pending' until something else happened. The change makes the service automatically mark such transactions as 'Signed' whenever they are read, and it adds tests to confirm the state is corrected. There is no direct evidence this was a security vulnerability or that it was exploited; it appears to be a state-consistency fix.

This commit is a minor code cleanup that simplifies how BTCPay Server writes log messages when a pending multi-signature transaction fails to finalize. It removes the list of failed input indexes from the log and merges two nearly identical log statements into one. There is no security-relevant change.

This commit only adds more detailed logging when a pending multi-signature Bitcoin transaction fails to finalize. It does not change how transactions are validated, authorized, or executed. There is no security vulnerability being fixed here; it is purely an observability improvement for operators.

This commit changes one word in the project's changelog, adding the word 'the' to a bullet point. It is a grammatical typo fix with no effect on software behavior, security, or user data.

This commit adds a direct package reference to AngleSharp version 1.5.2 in one of BTCPay Server's project files. AngleSharp is a library for parsing HTML and other markup. The change itself is a dependency bump/addition, but the commit message and diff do not explain why it was needed or whether it fixes a security issue. Without additional context, we cannot tell if this is a routine maintenance update or a response to a known vulnerability.

This commit updates the HtmlSanitizer software library from version 9.0.892 to 9.0.967. HtmlSanitizer is used to clean untrusted HTML and prevent malicious content from being displayed. Version bumps of this kind are often done to fix security bugs in the library, but the commit itself does not say what changed between these versions or whether any vulnerability affects BTCPay Server.

This commit updates the .NET runtime and several Microsoft packages from version 10.0.8/10.0.9 to 10.0.10, plus a couple of minor library updates. It is a routine dependency bump with no code changes. The commit message gives no security reason for the update, and no public references link it to any known vulnerability. Such updates often include undisclosed bug and security fixes in the underlying framework, so the change is security-relevant in a general maintenance sense, but there is no direct evidence this patch fixes a specific exploitable flaw in BTCPay Server.

This commit simply updates several third-party software libraries (dependencies) to newer patch versions. It does not change BTCPay Server's own code. Dependency bumps can fix hidden security bugs in those libraries, but the commit message gives no details, and no security advisory was supplied. On its own, this looks like routine maintenance rather than a confirmed security fix.

This commit only edits the project's Changelog.md file, adding two missing entries that describe fixes already made elsewhere. There are no code changes in this commit itself, so it cannot introduce or fix any security issue directly.

This commit is a minor cleanup: it changes how an 'empty transactions' message is created on a wallet page. Previously the message was stored as a chunk of HTML in translation files; now it is built safely in code with plain text. There is no security issue here—just a small improvement in how the page is assembled.

This commit only updates the list of translatable text strings in BTCPay Server. It adds, removes, and reorders phrases used by the application's user interface. There are no code logic changes, no security fixes, and no behavior changes.

This commit removes code that restricted cross-frame messaging to a specific trusted website origin. It now allows messages from any origin ('*') when sending, and only accepts messages from frames with an 'opaque' (null) origin when receiving. This appears to be a security cleanup that reduces the risk of malicious plugin frames tricking the host into trusting their origin, but the change is partial and the full context is unclear without more references.

This commit only changes a code style setting in the project's .editorconfig file. It tells developers to prefer shorter expression-bodied method syntax when it fits on one line. There is no functional code change, no bug fix, and no security relevance.

This commit reorganizes internal documentation for AI coding assistants. It moves existing developer guidance from one file into separate 'skill' files and adds new style guides for frontend naming and test writing. No application code, configuration, or user-facing behavior was changed.

This commit is mostly a code cleanup and test-helper refactor. It introduces a shared test helper for search filters, switches many HTML IDs to CSS classes for easier testing, fixes a duplicate date-range filter bug, and changes a Telegram footer link from t.me to telegram.me. There is no clear security vulnerability in the diff, and the changes appear to be routine maintenance.

This commit fixes a YAML syntax error in two test docker-compose files. Trailing commas after environment variable values were removed in one file, and a missing environment variable was added in the other. This is purely a build/test configuration fix with no security relevance.

This commit only changes test code. It fixes a flaky automated UI test by replacing two generic page-load waits with a helper that waits for a specific logged-in URL, and corrects the logic for deciding whether Playwright browser tests run in headless mode. There is no change to production code and no security relevance.

This is a one-line change in a test file that fixes a C# compiler/build error by switching from object-initializer syntax to a named parameter. It has no effect on the actual BTCPay Server application or its security.

This commit removes a single line of code that treated the 'comment' field as a special verbose metadata field in invoice reports. The change appears to be a cleanup: the comment field is already exported separately as 'InvoiceComment', so this branch was redundant. There is no indication this affects security.