BTCPay Server

This commit is a routine feature update for the BTCPay Server dashboard. It adds the ability to display wallet balance widgets for multiple cryptocurrencies at once, fixes a potential crash when looking up a cryptocurrency handler, and adjusts the dashboard layout. There is no indication of a security fix or vulnerability being addressed.

This commit adds a public PGP key file and updates a CI script to import it when verifying that commits are cryptographically signed. It is a hardening/operational improvement to the project's build verification process, not a fix for a software vulnerability in BTCPay Server itself.

This commit only updates a user-facing help message in the email rules page. It adds a second example placeholder ({Subscriber.Metadata.accessKey}) alongside the existing one ({Invoice.Metadata.itemCode}) to make the documentation clearer. There is no code behavior change and no security relevance.

This commit is a routine cleanup. It removes two unused namespace imports from a webhook trigger provider file and adds null checks and a page-load wait to automated UI tests. There is no change to production logic, no security fix, and no disclosed vulnerability.

This commit changes two lines in a single test file to make a flaky test more reliable. It replaces a broad check that the page contains the text 'Pay123' with a more precise check that a specific element with the expected ID shows the text 'Pay123'. This is a test-quality improvement, not a security fix.

This commit fixes a bug in BTCPay Server's subscription email feature where metadata placeholders for offerings and customers didn't work, and adds a new placeholder for subscriber metadata. The metadata strings are now parsed as JSON objects so email templates can correctly read individual metadata fields. There is no clear security vulnerability here; it is a functional bug fix with a minor side effect that malformed metadata could now cause a parsing error when an email is generated.

This commit only changes an automated UI test file. It adds a helper that checks whether a Bitcoin payment address was correctly filled in after clicking a parse button, and inserts that check plus a screenshot step at three points in the test. There is no change to production code, no user-facing behavior change, and no security fix.

This commit tightens a CI script that checks whether Git commits are cryptographically signed. Previously, the script only rejected commits with status 'N' (no signature). Now it accepts only 'G' (valid trusted signature) or 'U' (valid but untrusted signature) and rejects everything else. This is a hardening improvement, not a fix for an active security flaw.

This commit restores a test that checks whether the project's default translation file is up to date before a release. It does not change production code, fix a bug, or alter security behavior. It is purely a quality-assurance test for translation data.

This commit only adds new translation strings (empty placeholder entries for future localization) to a single C# file. There are no code logic changes, no security fixes, and no functional behavior changes.

This commit is a routine version bump and changelog update for BTCPay Server 2.3.4. It does not change any application code, only records what changed in the release. There is nothing in the diff that introduces or fixes a security issue by itself.

This commit adds a new 'deliveryTime' field to BTCPay Server's webhook API responses and updates the related documentation and invoice UI wording. It exposes when a webhook was actually sent, separate from when it was scheduled. There is no indication this change fixes or introduces a security vulnerability; it appears to be a transparency/usability improvement.

This commit only changes test code. It replaces a few brittle checks in automated UI tests with more robust Playwright-style assertions and adds a page-load wait. There is no change to production code, no user-facing behavior change, and no security relevance.

This commit removes the old Selenium browser-automation test suite and its supporting infrastructure from the BTCPay Server project. It deletes test files, package references, Docker services, and CI job definitions, and updates two comments in production view files that previously mentioned Selenium. There is no change to the actual application code that users interact with, and no security fix or vulnerability is introduced.

This commit is purely a test-code reorganization. It moves several Playwright UI tests from one test file to another and creates a new dedicated WalletTests.cs file. No production application code was changed, so it cannot introduce a security vulnerability in the software users run.

This commit is a test-code refactoring: it moves existing webhook-related tests from several scattered test files into a single new file called WebhooksTests.cs. No production code is changed, and the commit message explicitly says it is just moving tests. There is no security fix or vulnerability here.

This commit only changes test code in BTCPay Server's PlaywrightTests.cs. It refactors how browser tabs are switched during automated UI tests and replaces some polling-style assertions with more direct Playwright expectations. There is no change to production code, no security fix, and no user-facing behavior change.

This commit fixes a potential server crash in BTCPay Server's error-handling page. Previously, if a visitor requested a non-HTML error page without specifying a status code, the code could try to use a missing value and throw a NullReferenceException. The change supplies a fallback 500 status code and renames a loop variable to avoid shadowing. It is a small defensive fix rather than a clear-cut exploitable vulnerability.

This commit changes a single character in a test file, flipping a comparison operator from '==' to '!='. It is a test-only fix that corrects the logic of an assertion checking whether a UI alert appears. There is no change to production code and no security relevance.

This commit is a purely cosmetic fix for a QR-code scan button icon in the wallet send page. It adjusts CSS margins and adds flexbox centering so the icon lines up correctly. There is no security relevance.

This commit is purely a test-code refactor. It moves existing pull-payment and coin-selection tests into a new dedicated test file, removes duplicate copies from other test files, adds a couple of shared assertion helpers, and fixes compiler/style warnings. No production application code is changed, so it cannot affect the security of a running BTCPay Server instance.

This commit reorganizes automated browser tests by splitting some Playwright tests into a second CI job. It does not change any production code, user-facing behavior, or security-sensitive logic. The only non-test code change is a small tolerance adjustment in a refund amount assertion, which is still a test-only change.

This commit is a routine test modernization: it rewrites one existing automated UI test to use the Playwright testing framework instead of Selenium, and adds a single HTML data-testid attribute to the signed-out page header so the test can reliably locate it. There is no change to production logic, no security fix, and no vulnerability introduced.

This commit only changes the order of steps in an automated test script for the BTCPay Server project. It moves a 'Description Edit' step earlier in the test flow to try to fix a flaky (unreliable) test. There is no change to production code, no user-facing behavior change, and no security relevance.

This commit only changes a test file and adds a test marker to a UI message. It makes an automated browser test more reliable by waiting for elements to appear and checking their text in a more stable way. There is no security relevance.