BTCPay Server

This commit simply renames the search feature's 'Keywords' field to 'Aliases' across the BTCPay Server codebase. It is a non-functional refactoring that does not change any security behavior, access controls, or data handling. Backward compatibility is preserved with an obsolete property that maps to the new name.

This commit adds a missing safety check in the API key authorization flow. Previously, if a user clicked a 'confirm' action for an API key that no longer existed, the code would try to use a null (non-existent) key object, which could cause a server crash or unexpected behavior. Now the code checks whether the key exists first and shows an error message if it doesn't.

This commit simply updates four external software library (NuGet package) versions to newer patch releases. There are no code changes shown, and the commit message gives no indication that any security issue is being fixed. It looks like a routine dependency refresh.

This commit changes how BTCPay Server handles a missing user when an administrator tries to resend a verification email. Previously, the code threw a generic internal error (ApplicationException), which could expose internal details or produce an unhandled error page. Now it returns a clean 'Not Found' response. This is a hardening fix: it improves error handling and reduces information leakage, but it does not by itself grant an attacker new capabilities.

This commit adds a simple build-and-publish helper script for the project's NuGet package. It packages the BTCPayServer.Client library, pushes it to the public NuGet registry using an API key from an environment variable, and creates a matching Git tag. There is no indication this change fixes or introduces a security issue; it is a routine developer tooling addition.

This commit fixes a potential cross-site scripting (XSS) issue in BTCPay Server's wallet status messages. When a payjoin transaction fails, the server shows a warning message that includes an error string. Previously, that error string was inserted directly into the HTML of the status message, so if an attacker could influence the error text to contain malicious code (for example, through a script tag), it could run in the administrator's browser. The change now encodes the error text so that any HTML-like characters are displayed as plain text instead of being interpreted as code.

This commit fixes a bug in BTCPay Server's LNURL feature for pull payments. Previously, if someone requested a LNURL for a pull payment that didn't exist, the code would try to use a null (empty) pull payment object, which could cause the server to crash or behave unpredictably instead of returning a simple 'not found' error. The fix adds a check to return 'not found' if the pull payment is missing.

This is a one-line change to a test file. It adjusts an assertion so that the test now expects a database-migrated API key to have a null CreatedAt value instead of a non-null value. There is no production code change and no security relevance visible in the commit.

This commit updates the HtmlSanitizer library to a newer patch version and reorganizes some account email-change tests. The library bump could fix a security bug in how user-supplied HTML is cleaned, but the commit itself does not say it fixes a security issue or describe any specific vulnerability. The test changes appear to be routine refactoring of how the application verifies email address changes.

This commit adds a security check so that when a user tries to change their email address on their account profile, they must enter their current password. Before this change, an attacker who had already hijacked a logged-in session could change the account email without proving they knew the password, making account takeover easier. The change is described by the project as low-impact.

This commit changes a single word in a build script's status message, from 'if it is possible' to 'whether it is possible'. There is no functional, security, or behavioral change to the software.

This commit adds one extra wait/check to an automated test that verifies email rules appear in a web page. It is purely a test-stability fix and does not change any production code, user-facing behavior, or security boundary.

This commit changes a CI test script so that GitHub Actions can write step summary reports to the correct file path inside a Docker container. It is a build/test infrastructure fix with no apparent security relevance.

This commit fixes a stored cross-site scripting (XSS) risk in BTCPay Server's store settings. Merchants can set a 'Support URL' that is shown to customers during checkout. Before this fix, an attacker with access to store settings could enter a URL using the 'javascript:' scheme, such as 'javascript:document.body.dataset.pwned=1'. When a customer later clicked the support link, the browser would run the attacker's JavaScript in the checkout page. The patch now rejects any support URL whose scheme is not http, https, or mailto, both in the web UI and in the Greenfield API.

This commit adds a new 'store invitations' feature to BTCPay Server. Store owners can now invite users by email with a time-limited link instead of adding them immediately. The change introduces new database tables, API endpoints, web pages, email notifications, and security checks. It also tightens some existing rules: only server admins can skip the invitation flow, and the last store owner cannot have their role changed or be removed. The code appears to be a deliberate security-hardening feature rather than a fix for an active vulnerability, but it changes who can gain store access and how.

This commit removes the built-in SSH client from BTCPay Server and replaces it with a local helper program called 'btcpay-host'. Instead of the application opening SSH connections to the server host, it now runs a configurable local executable to perform maintenance tasks such as updating, restarting, changing the domain, and managing authorized SSH keys. This is a significant architectural change that reduces the application's direct network attack surface, but it also introduces a new local command-execution path that must be trusted and properly secured.

This small change marks an internal base class called VaultController with [NonController] so ASP.NET MVC does not accidentally expose it as a public web route. Without this attribute, MVC's route discovery could have treated derived vault controllers as reachable HTTP endpoints, potentially exposing internal hardware-wallet/vault operations over the web.

This commit simply updates several third-party software libraries (dependencies) to newer patch or minor versions. There are no code changes in BTCPay Server itself, and the commit message gives no indication that any of the updates fix a security problem. Without external references linking these specific library versions to known vulnerabilities, this looks like a routine maintenance update.

This commit changes what text BTCPay Server's API returns as the 'Label' for an on-chain wallet. Previously, if no custom label was set, the API would leak the wallet's technical derivation scheme (a string describing how keys are generated) as the label. Now it returns an empty string instead. This is primarily an information-disclosure cleanup, not a direct exploit.

This commit is a routine infrastructure change: BTCPay Server is switching its automated testing and release system from CircleCI to GitHub Actions. It copies the same test scripts, signing checks, and Docker publishing steps into GitHub Actions workflows. There is no change to the actual BTCPay Server application code that users interact with, and nothing in the commit suggests a security vulnerability was fixed or introduced.

This commit changes how BTCPay Server validates payment method settings so that the store object is passed into the validation process. The change itself only adds a new piece of information (the store) to validation contexts; it does not by itself fix a visible bug or block an attack. Without the rest of the related code, it is unclear whether this prevents a security issue or is just a refactoring/cleanup step.

This commit removes two contradictory sentences from an internal documentation file that tells contributors how to write pull request descriptions. One sentence had told them not to write about testing strategy, while another told them to add a testing note. The change only affects contributor guidance, not the BTCPay Server software that users or merchants interact with.

This is a tiny one-line change to a unit test helper that fetches cryptocurrency exchange rates from BTCTurk. It adds an extra sanity check: it ignores any exchange rate where the bid price (what buyers are offering) is higher than the ask price (what sellers are asking), because that is an impossible/inverted market state. The commit message says it is fixing a flaky test, not a security bug.

This commit rewrites how BTCPay Server performs host-level maintenance. Instead of the web application opening SSH connections directly to the host, it now runs a local helper program called 'btcpay-host'. The Docker image includes a wrapper that can still forward those calls over SSH, but the core application no longer needs SSH credentials or the SSH.NET library. The change removes a large amount of SSH-related code and adds a new plugin for maintenance actions. It is primarily an architectural/security-hardening change rather than a clear-cut fix for a single vulnerability.

This is a one-line change to a test file. It updates a test case that checks for a duplicate email error so that it also provides a current password. The change does not modify any production code and has no direct security impact on the BTCPay Server application itself.