What changed, and why it matters
This commit simply updates several third-party software libraries (dependencies) to newer patch or minor versions. There are no code changes in BTCPay Server itself, and the commit message gives no indication that any of the updates fix a security problem. Without external references linking these specific library versions to known vulnerabilities, this looks like a routine maintenance update.
No immediate security action is required. As a routine hygiene step, verify the release notes of the updated packages (especially NBitcoin, BTCPayServer.Lightning.All, QRCoder, and Serilog) for any security fixes, and run the project's test suite to ensure compatibility after the version bumps.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps NuGet package references across four .csproj files: NBitcoin 10.0.9→10.0.10, BTCPayServer.Lightning.All 1.7.7→1.7.8, QRCoder 1.7.0→1.8.0, Serilog 4.3.0→4.4.0, Microsoft.NET.Test.Sdk 18.8.1→18.9.0, Microsoft.Playwright 1.61.0→1.62.0, xunit.v3 3.2.2→4.0.0, and xunit.runner.visualstudio 3.1.5→4.0.0. No source-code changes are present in the diff. The commit title/message is only ‘bump libs’. No advisory, CVE, or security rationale is provided in the commit or supplied references.
Changed components
BTCPayServer.Client/BTCPayServer.Client.csprojBTCPayServer.Rating/BTCPayServer.Rating.csprojBTCPayServer.Tests/BTCPayServer.Tests.csprojBTCPayServer/BTCPayServer.csprojInspect captured patch +10 / −10
### BTCPayServer.Client/BTCPayServer.Client.csproj
@@ -31,7 +31,7 @@
</ItemGroup>
<ItemGroup>
<PackageReference Include="BTCPayServer.Lightning.Common" Version="1.7.2" />
- <PackageReference Include="NBitcoin" Version="10.0.9" />
+ <PackageReference Include="NBitcoin" Version="10.0.10" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
</ItemGroup>
<ItemGroup>
### BTCPayServer.Rating/BTCPayServer.Rating.csproj
@@ -6,7 +6,7 @@
<FrameworkReference Include="Microsoft.AspNetCore.App" />
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
<PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
- <PackageReference Include="NBitcoin" Version="10.0.9" />
+ <PackageReference Include="NBitcoin" Version="10.0.10" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
<PackageReference Include="DigitalRuby.ExchangeSharp" Version="1.2.1" />
</ItemGroup>
### BTCPayServer.Tests/BTCPayServer.Tests.csproj
@@ -40,12 +40,12 @@
</ItemGroup>
<ItemGroup>
- <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
- <PackageReference Include="Microsoft.Playwright" Version="1.61.0" />
+ <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+ <PackageReference Include="Microsoft.Playwright" Version="1.62.0" />
<PackageReference Include="Newtonsoft.Json.Schema" Version="4.0.1" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.11" />
- <PackageReference Include="xunit.v3" Version="3.2.2" />
- <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
+ <PackageReference Include="xunit.v3" Version="4.0.0" />
+ <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
### BTCPayServer/BTCPayServer.csproj
@@ -34,23 +34,23 @@
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
- <PackageReference Include="NBitcoin" Version="10.0.9" />
+ <PackageReference Include="NBitcoin" Version="10.0.10" />
<PackageReference Include="YamlDotNet" Version="16.3.0" />
<PackageReference Include="BIP78.Sender" Version="0.2.5" />
<PackageReference Include="BTCPayServer.Hwi" Version="2.0.6" />
- <PackageReference Include="BTCPayServer.Lightning.All" Version="1.7.7" />
+ <PackageReference Include="BTCPayServer.Lightning.All" Version="1.7.8" />
<PackageReference Include="CsvHelper" Version="33.1.0" />
<PackageReference Include="Fido2" Version="4.0.1" />
<PackageReference Include="Fido2.AspNet" Version="4.0.1" />
<PackageReference Include="LNURL" Version="0.0.36" />
<PackageReference Include="MailKit" Version="4.17.0" />
- <PackageReference Include="QRCoder" Version="1.7.0" />
+ <PackageReference Include="QRCoder" Version="1.8.0" />
<PackageReference Include="NBitpayClient" Version="1.0.0.39" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
<PackageReference Include="NicolasDorier.CommandLine" Version="2.0.0" />
<PackageReference Include="NicolasDorier.CommandLine.Configuration" Version="2.0.0" />
<PackageReference Include="NicolasDorier.RateLimits" Version="1.2.3" />
- <PackageReference Include="Serilog" Version="4.3.0" />
+ <PackageReference Include="Serilog" Version="4.4.0" />
<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
<PackageReference Include="SSH.NET" Version="2026.0.0" />Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.