What the developer wrote
Authored by Nicolas Dorier
Bump HtmlSanitizer
What changed, and why it matters
This commit simply updates a third-party HTML-cleaning library (HtmlSanitizer) from version 8.0.838 to 9.0.892 in the BTCPay Server project. The change is a one-line version bump in a project file. It is likely intended to pick up bug fixes or security fixes in the dependency, but the commit message does not say what those fixes are, and no security advisory or changelog was provided. On its own, this diff does not show any vulnerability in BTCPay Server's code, only that a dependency was refreshed.
Review the HtmlSanitizer 9.0.892 release notes and any related security advisories to confirm what issues are fixed. Run the existing HTML-sanitization test suite and add regression tests for any relevant CVEs. Verify that the major-version upgrade does not break existing sanitization behavior or public APIs used by BTCPay Server. If the update addresses a known vulnerability, consider expediting deployment and publishing a short note to users.
Security signals we found
Dependency version bump for an HTML-sanitization library, which is a security-sensitive component
Major-version dependency update with no visible code adaptation
No commit-level explanation of the security or functional reason for the bump
Evidence from the diff
The diff modifies BTCPayServer.Abstractions.csproj, changing the HtmlSanitizer NuGet package reference from 8.0.838 to 9.0.892. No code changes, API adjustments, or configuration changes are visible. HtmlSanitizer is used to sanitize untrusted HTML input; updating it is a routine dependency-maintenance action. Without the upstream release notes or a CVE, we cannot confirm which bugs or security issues are being addressed. The major-version bump (8.x to 9.x) may include breaking changes, but the commit does not show any corresponding source changes, so the project either already uses a compatible API surface or the update may be incomplete.
Changed components
BTCPayServer.Abstractions/BTCPayServer.Abstractions.csprojHtmlSanitizer NuGet dependencyInspect captured patch +1 / −1
diff --git a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
index 4e804e9..2412e14 100644
--- a/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
+++ b/BTCPayServer.Abstractions/BTCPayServer.Abstractions.csproj
@@ -31,7 +31,7 @@
<None Include="icon.png" Pack="true" PackagePath="\" />
</ItemGroup>
<ItemGroup>
- <PackageReference Include="HtmlSanitizer" Version="8.0.838" />
+ <PackageReference Include="HtmlSanitizer" Version="9.0.892" />
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.11" />
<PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.11" />
</ItemGroup>
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.