What the developer wrote
Authored by Nicolas Dorier
bump HtmlSanitizer
What changed, and why it matters
This commit updates the HtmlSanitizer software library from version 9.0.892 to 9.0.967. HtmlSanitizer is used to clean untrusted HTML and prevent malicious content from being displayed. Version bumps of this kind are often done to fix security bugs in the library, but the commit itself does not say what changed between these versions or whether any vulnerability affects BTCPay Server.
Treat as a routine dependency update with possible security benefit. Review the HtmlSanitizer 9.0.967 release notes and changelog for fixed CVEs. If any fixed vulnerability matches features BTCPay Server uses, prioritize deployment; otherwise follow normal patch cadence.
Security signals we found
Security-sensitive dependency updated (HtmlSanitizer)
No commit-level explanation of security relevance
No code-level changes or test cases shown
No CVE or advisory referenced in commit message
Evidence from the diff
The only change is a single package reference bump in BTCPayServer.Abstractions.csproj: HtmlSanitizer 9.0.892 → 9.0.967. No code changes, tests, or release notes are included. Without external references, we cannot confirm which HtmlSanitizer defects are addressed or whether BTCPay Server’s usage is exposed to them. HtmlSanitizer is a security-sensitive dependency, so the update is plausibly security-relevant, but the diff provides no direct evidence of an exploitable vulnerability in BTCPay Server.
Changed components
BTCPayServer.Abstractions/BTCPayServer.Abstractions.csprojHtmlSanitizer NuGet dependencyInspect captured patch +1 / −1
diff --git a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
index 413e8d0..920d183 100644
--- a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
+++ b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
@@ -31,7 +31,7 @@
<None Include="icon.png" Pack="true" PackagePath="\" />
</ItemGroup>
<ItemGroup>
- <PackageReference Include="HtmlSanitizer" Version="9.0.892" />
+ <PackageReference Include="HtmlSanitizer" Version="9.0.967" />
<PackageReference Include="Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson" Version="10.0.10" />
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
<PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.