What the developer wrote
Authored by Nicolas Dorier
Bump anglesharp (#7476)
What changed, and why it matters
This commit adds a direct package reference to AngleSharp version 1.5.2 in one of BTCPay Server's project files. AngleSharp is a library for parsing HTML and other markup. The change itself is a dependency bump/addition, but the commit message and diff do not explain why it was needed or whether it fixes a security issue. Without additional context, we cannot tell if this is a routine maintenance update or a response to a known vulnerability.
Treat this as a routine dependency update unless additional information (such as a CVE, security advisory, or vendor release note) confirms a security fix. Review the AngleSharp 1.5.2 release notes and any transitive dependency chain involving HtmlSanitizer to determine if the version addresses a known vulnerability. If this is a security patch, ensure it is backported to supported release branches.
Security signals we found
Dependency version change for AngleSharp
No security explanation in commit message
No CVE or advisory referenced in commit or supplied materials
Change is a single package reference addition in a .csproj file
Evidence from the diff
The diff adds <PackageReference Include="AngleSharp" Version="1.5.2" /> to BTCPayServer.Abstractions.csproj. AngleSharp is a .NET HTML parser often used as a transitive dependency of HtmlSanitizer. The commit title says “Bump anglesharp” but the change is actually adding a direct reference rather than updating an existing one. There is no CVE, advisory link, or security explanation in the commit or supplied references. The security relevance is therefore speculative.
Changed components
BTCPayServer.Abstractions/BTCPayServer.Abstractions.csprojAngleSharp NuGet package (version 1.5.2)Inspect captured patch +1 / −0
diff --git a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
index 920d183..f4b5fdc 100644
--- a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
+++ b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
@@ -31,6 +31,7 @@
<None Include="icon.png" Pack="true" PackagePath="\" />
</ItemGroup>
<ItemGroup>
+ <PackageReference Include="AngleSharp" Version="1.5.2" />
<PackageReference Include="HtmlSanitizer" Version="9.0.967" />
<PackageReference Include="Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson" Version="10.0.10" />
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.