What the developer wrote
Authored by Nicolas Dorier
Bump dotnet
What changed, and why it matters
This commit updates the .NET runtime and SDK versions used to build and run BTCPay Server. It is a routine dependency bump, likely to pick up bug fixes and security patches released by Microsoft. The commit itself does not describe any specific vulnerability or attack, but running older .NET versions can expose software to known security flaws.
Verify the .NET 10.0.301 SDK and 10.0.9 runtime release notes for any security advisories, then deploy updated container images after normal regression testing. Treat this as standard patch maintenance.
Security signals we found
Dependency patch update for .NET SDK and ASP.NET runtime
Potential inclusion of undisclosed .NET security fixes
No explicit security context or CVE provided in commit
Evidence from the diff
The commit bumps the Docker base images from .NET SDK 10.0.202 to 10.0.301 and the ASP.NET runtime from 10.0.6 to 10.0.9. These are patch-level updates within the .NET 10 preview/RC line. Such updates typically include reliability, compatibility, and security fixes. Without a vendor advisory or CVE reference, we cannot confirm which specific vulnerabilities are addressed, but staying on older patch versions generally carries residual risk.
Changed components
BTCPayServer.Tests/DockerfileDockerfile.NET SDK base imageASP.NET runtime base imageInspect captured patch +3 / −3
diff --git a/BTCPayServer.Tests/Dockerfile b/BTCPayServer.Tests/Dockerfile
index b402f83..eb0c231 100644
--- a/BTCPayServer.Tests/Dockerfile
+++ b/BTCPayServer.Tests/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:10.0.202-noble AS builder
+FROM mcr.microsoft.com/dotnet/sdk:10.0.301-noble AS builder
WORKDIR /source
COPY nuget.config nuget.config
diff --git a/Dockerfile b/Dockerfile
index ce02e80..7d4c7b5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0.202-noble AS builder
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0.301-noble AS builder
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
WORKDIR /source
COPY nuget.config nuget.config
@@ -21,7 +21,7 @@ ARG CONFIGURATION_NAME=Release
ARG GIT_COMMIT
RUN cd BTCPayServer && dotnet publish -p:GitCommit=${GIT_COMMIT} --output /app/ --configuration ${CONFIGURATION_NAME}
-FROM mcr.microsoft.com/dotnet/aspnet:10.0.6-noble
+FROM mcr.microsoft.com/dotnet/aspnet:10.0.9-noble
RUN apt-get update && apt-get install -y --no-install-recommends iproute2 openssh-client ca-certificates \
&& rm -rf /var/lib/apt/lists/*
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.