BTCPay Server

This commit is a routine code cleanup of the wallet address label picker in BTCPay Server. It rewrites how the page caches and refreshes the list of available labels, removes an old Vue.js event listener, and adds a guard so the script does nothing if the expected HTML element is missing. There is no clear security bug being fixed and no security relevance is stated by the project.

This commit updates test-only Docker configuration files. It upgrades the PostgreSQL database image used in automated testing from version 13.13 to 18.1, fixes indentation, and adds a persistent data volume for the test database. These files are part of the project's internal test harness and are not used in production deployments. There is no direct security fix or vulnerability being patched here.

This commit updates the PostgreSQL database version used only in BTCPay Server's automated test environment from version 13.23 to 18.1. It also changes the data directory mount path inside the container. There is no indication this affects production systems or fixes a security vulnerability.

This commit updates the PostgreSQL database version used only in BTCPay Server's automated test environment from 13.13 to 13.23, and adds a persistent data volume for that test database. It does not change production code. The newer PostgreSQL patch release likely fixes bugs and security issues in the database software itself, but the commit does not address any vulnerability in BTCPay Server's own code.

This commit adds a simple shell script used by BTCPay Server maintainers to automate creating and pushing a Git version tag when publishing Docker images. It does not change application code, user-facing behavior, or any security-sensitive logic. There is nothing in the commit that introduces a vulnerability or fixes one.

This commit is a routine code refactor that lets webhook event providers run their lookup logic asynchronously. It changes a synchronous method to an async one and updates callers to await it. There is no security issue visible in the diff.

This commit fixes a flaky automated test for BTCPay Server's subscription/monetization feature. The code change removes a guard that previously prevented a subscriber's plan from being restarted if it had already started. The test change waits for a background activation event and reloads the page before checking the UI. On its own, the patch looks like a timing/test-stability fix rather than a clear security fix, but removing the 'already started' guard could, in theory, allow duplicate plan activations or repeated credits if the event handler runs more than once.

This commit is a user-interface localization cleanup, not a security fix. It stops the system from automatically translating any button or link with the ID 'page-primary'. Instead, developers must now explicitly mark each primary button/link with a 'text-translate' attribute if they want it translated. The commit adds that attribute to many existing buttons and links so translations continue to work as intended. There is no security vulnerability here.

This commit is a straightforward internal rename from the word 'Entitlement' to the word 'Feature' across the new subscriptions/monetization plugin code. It changes class names, database table names, property names, method names, UI labels, and test helpers, but does not alter any security logic, access checks, or data handling behavior. There is no indication this fixes or introduces a security issue.

This is a tiny one-line fix in a BTCPay Server web page that checks whether a user is allowed to set up certain types of cryptocurrency wallets. The old code referenced two properties that appear to have been renamed or replaced. The change simply swaps in the current property names so the page renders the wallet-setup section correctly. It is most likely a routine bug fix, but because it touches permission checks for wallet creation, it could have security-adjacent effects if the wrong users were shown (or hidden from) wallet options.

This commit fixes a simple but potentially important coding mistake: a constructor parameter named `loadAssembliesInDefaultLoadContext` was not being saved into its matching field. As a result, the plugin loader's intended setting about where to load assemblies was effectively ignored, and the code would fall back to the default value (false). This could change how plugins are isolated from the main application, potentially weakening the sandbox between plugins and the host.

This commit fixes a flaky automated test, not a security issue. The test previously checked the entire web page content for an email address, which could fail if the email appeared anywhere else on the page or if timing caused the page content to be incomplete. The change narrows the check to look specifically at the value of the email input field. There is no indication this affects real users or production code.

This commit is a routine test and code-quality improvement. It tightens a test helper that was incorrectly always setting IsAdmin to true, modernizes some C# syntax, removes unused imports, and adds test-id attributes to a web page so automated tests can locate elements more reliably. There is no security-relevant change to production behavior.

This commit removes an internal-only API client called LocalBTCPayClient. It was a convenience wrapper that let server code call BTCPay Server's own Greenfield API without making real HTTP requests. There is no indication this change fixes a security vulnerability; it appears to be a code cleanup or architectural simplification.

This is a one-line user-interface styling fix in the main navigation menu. It adds a missing layout attribute so a menu link is styled consistently with other navigation items. There is no security relevance.

This commit is a code reorganization: it moves BTCPay Server's email-sending code from a shared 'Services/Mails' folder into the existing 'Plugins/Emails' plugin directory. File paths and namespace references are updated across the project, but the actual logic for sending email, validating settings, and checking certificates is copied almost unchanged. There is no indication this change fixes or introduces a security vulnerability.

This commit adds CC and BCC fields to BTCPay Server's email rules and refactors how email addresses are parsed. It is a feature addition, not a clear security fix. The new parsing logic uses a placeholder-replacement trick that could mask malformed addresses, and the validation is only partial, so there is a small chance of misdirected or failed emails. There is no evidence in the commit or supplied references that the vendor is treating this as a security issue.

This commit refactors BTCPay Server's email handling into a new 'Server Email Rules' plugin. It moves server and store email settings into shared base controllers, adds server-wide email rules (for example password-reset emails), and changes how password-reset emails are generated. The changes are mostly architectural and feature-adding; there is no clear evidence in the diff of a security vulnerability being fixed or introduced. However, the new code does involve email templating, SQL queries, and authorization boundaries, so it warrants normal review rather than being dismissed as purely cosmetic.

This is a large feature commit adding a new Subscriptions system to BTCPay Server. It introduces new database tables, models, UI pages, API permissions, webhooks, and business logic for managing subscription plans, subscribers, customer identities, checkouts, and portal sessions. There is no explicit security fix or vulnerability disclosure in the commit message or diff. The change is a feature addition, not a documented security patch.

This commit fixes a user-interface bug where a confirmation modal dialog would not close properly. The change removes an outer wrapper div that had Bootstrap CSS classes making the modal appear statically and always visible, which prevented the normal modal close behavior. There is no direct evidence in the commit of a security vulnerability such as cross-site scripting or request forgery.

This commit changes a single translation string in BTCPay Server to include an error placeholder. It is a routine localization update with no security relevance visible in the diff.

This commit fixes a single-letter capitalization typo in the API documentation file. The property name 'feerate' was changed to 'feeRate' in a Swagger/OpenAPI JSON template so the documented field matches the actual API. There is no code behavior change and no security impact.

This commit is a purely cosmetic UI fix. It adjusts spacing around 'Date' column headers in several admin pages so the header text and a small date-format toggle button line up neatly. There is no security relevance.