BTCPay Server

This commit simply updates a single software library dependency from version 1.7.3 to 1.7.4. There is no information in the commit itself about what changed in that library or whether it fixes any security issue. Without knowing the contents of the library update, no security conclusion can be drawn from this diff alone.

This commit is a routine UI/UX refactor of the BTCPay Server reports page. It replaces a custom date-picker and JavaScript-driven report fetching with a shared date-range selector component and standard GET form submission. There is no indication of a security fix or vulnerability being addressed.

This commit fixes how a custom date range is displayed and submitted in BTCPay Server's web interface. It changes the way the browser's timezone is sent back to the server and how date/time inputs are pre-filled. There is no clear security bug being fixed; it appears to be a user-experience and correctness improvement for date filtering.

This commit is a straightforward user-interface convenience change: it adds a 'Manage Labels' link inside the label dropdown on wallet transaction and payment request pages. There is no security-relevant behavior change in the diff itself.

This is a large UI refactoring commit that improves date range filtering, search components, and label selectors across BTCPay Server's admin pages. It replaces timezone-offset handling with named timezone handling, restructures how search filters are parsed and stored, and adds shared view components. There is no clear security fix or vulnerability being patched; it appears to be a feature/refactoring change.

This commit fixes a localization bug in BTCPay Server's Blazor user interface components. Some text strings were not being translated into the user's chosen language because they relied on a translation mechanism that only works in older Razor view files, not in newer Blazor components. The change switches those strings to use Blazor-compatible localization and registers the new translatable phrases in the default translation file. There is no security impact.

This commit fixes a bug in BTCPay Server's plugin system where a safety check that prevents directory traversal attacks was accidentally rejecting valid plugin names on Windows. The original code always appended a '/' slash, but Windows uses '\' as its path separator, so the safety check compared paths with mismatched slashes and falsely flagged them as attacks, causing a crash. The fix makes the trailing slash match the operating system's separator. There is no direct evidence in the commit that an actual security vulnerability was exploited; it appears to be a bug fix for a false-positive crash.

This commit removes Bootstrap tooltip attributes from a few disabled buttons and archive links in the invoice view. It is a test-flakiness fix with no apparent security relevance.

This commit only adds a link to a blog post announcement in the changelog. It contains no code changes, no security fixes, and no functional modifications.

This commit reverts a planned removal of LNDHub support by updating a single Lightning library version and editing the changelog. It is a feature restoration, not a security fix. There is no evidence in the commit of any vulnerability, exploit, or security-relevant change.

This commit fixes a flaky automated test for the global search feature. The JavaScript change makes the search run automatically if a query is already present when the search UI opens, and the test code is simplified to remove a special screenshot-on-failure workaround. There is no security issue here.

This commit is a routine maintenance update for BTCPay Server. It removes support for three older/deprecated Lightning payment backends (Lightning Charge, LNDHub, and LNBank), updates the phoenixd integration, bumps a couple of library versions, and adjusts tests accordingly. There is no indication in the commit that this fixes an active security vulnerability or introduces new attack paths.

This commit fixes a performance problem on the BTCPay Server 'Policies' settings page. Previously, the page tried to load a dropdown list of every app on the server, which could time out or crash when there were many apps. The fix replaces the dropdown with a simple text box where the administrator types an app ID directly. It also adds validation to reject invalid app IDs instead of crashing. The change is primarily a reliability/performance fix, but it slightly changes how app IDs are entered and validated.

This commit simply adds missing translated text labels for a global search feature. It changes hardcoded English hint text into references to the project's translation system so the hints can appear in other languages. There is no security relevance.

This commit changes a single user-visible label from a plain English string to a translatable string. It is a routine localization fix with no security relevance.

This commit only adds one line to the project's changelog, documenting that a bug where Lightning invoices were silently dropped on reconnection has been fixed. The actual code change happened elsewhere, so this commit itself does not modify any program logic or fix any vulnerability directly.

This commit only adds new text strings for a 'bulk archive pull payments' feature and records it in the changelog. There is no code logic change, no security fix, and no behavior that could be exploited. It is a routine localization/changelog update.

This commit adds a single new translation string to the application's default translation file. It is a localization-only change with no security relevance.

This commit removes database-provider checks from two old database migration files and adds developer instructions for creating future migrations. It does not change application behavior for users, fix a vulnerability, or introduce new functionality. The SQL inside the migrations is unchanged; it now simply runs unconditionally rather than only when PostgreSQL is detected.

This commit only adds a single line to the project's changelog, documenting that a missing 'Uninstall' button for language packs was fixed. It changes no program code, configuration, or executable files, so it cannot by itself introduce or fix any security issue.

This commit adds a new third-party plugin called 'cashu-plugin' to BTCPay Server's automated compatibility-check script. The script clones the plugin's repository, initializes its submodule, wires it against the current BTCPay Server code, and builds it in CI. There is no code change to BTCPay Server itself, no bug fix, and no security-related content in the commit message or diff.

This commit simplifies a CircleCI script that checks whether third-party BTCPay plugins still compile against the current BTCPay Server code. It removes a comparison against an older baseline version and instead just builds plugins against the checked-out code. There is no indication this change affects the security of the BTCPay Server software itself or its users.

This commit only changes the project's CI/CD configuration file on CircleCI. It adds a missing 'plugin_compatibility' job definition and includes that job in the release workflow. There is no change to application code, no bug fix in the software users run, and no security-related content in the commit message or diff.

This commit only changes a test helper file used in automated UI testing. It replaces a manual sequence of keyboard shortcuts with calls to existing helper methods that do the same thing, in order to make a flaky test more reliable. There is no change to production code and no security relevance.

This commit only adds a single line to the project's changelog describing a prior user-interface bug fix: a date-picker dropdown in the invoice filter showed white text on a white background when Dark Mode was enabled. There is no code change, no security fix, and no functional behavior change in this commit.