What the developer wrote
Authored by Nicolas Dorier
bump dotnet image
What changed, and why it matters
This commit updates the .NET runtime and SDK Docker images used to build and run BTCPay Server from version 10.0.200/10.0.4 to 10.0.201/10.0.5. These are patch-level updates to the underlying Microsoft .NET platform. Such updates typically include bug fixes and security fixes, but the commit message does not say this is a security update and no specific vulnerability is referenced. The change is routine maintenance rather than a fix for a known, actively exploited flaw in BTCPay Server itself.
Treat this as a standard dependency-maintenance update. Verify the .NET 10.0.201 SDK and 10.0.5 runtime release notes for any CVEs, apply the update in build and deployment pipelines, and continue to monitor Microsoft security advisories for .NET.
Security signals we found
Patch-level update to .NET SDK and ASP.NET runtime base images
Potential inclusion of undisclosed .NET security fixes typical of servicing releases
No CVE, advisory, or security rationale provided in commit or references
Evidence from the diff
The diff bumps two Microsoft .NET container image tags: the SDK image moves from 10.0.200-noble to 10.0.201-noble, and the ASP.NET runtime image moves from 10.0.4-noble to 10.0.5-noble. These are servicing releases of .NET 10. Microsoft generally ships security and reliability fixes in such patch releases, but the commit provides no CVE, advisory link, or description of any vulnerability. Without a disclosed CVE or release-note reference, we cannot confirm that this bump addresses a specific security issue affecting BTCPay Server.
Changed components
BTCPayServer.Tests/DockerfileDockerfileMicrosoft .NET SDK 10.0.201 container imageMicrosoft ASP.NET Core Runtime 10.0.5 container imageInspect captured patch +3 / −3
diff --git a/BTCPayServer.Tests/Dockerfile b/BTCPayServer.Tests/Dockerfile
index 5f9be20..b429425 100644
--- a/BTCPayServer.Tests/Dockerfile
+++ b/BTCPayServer.Tests/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:10.0.200-noble AS builder
+FROM mcr.microsoft.com/dotnet/sdk:10.0.201-noble AS builder
RUN apt-get update && apt-get install -y --no-install-recommends chromium-driver \
&& rm -rf /var/lib/apt/lists/*
diff --git a/Dockerfile b/Dockerfile
index 45e790d..dc55065 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0.200-noble AS builder
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0.201-noble AS builder
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
WORKDIR /source
COPY nuget.config nuget.config
@@ -21,7 +21,7 @@ ARG CONFIGURATION_NAME=Release
ARG GIT_COMMIT
RUN cd BTCPayServer && dotnet publish -p:GitCommit=${GIT_COMMIT} --output /app/ --configuration ${CONFIGURATION_NAME}
-FROM mcr.microsoft.com/dotnet/aspnet:10.0.4-noble
+FROM mcr.microsoft.com/dotnet/aspnet:10.0.5-noble
RUN apt-get update && apt-get install -y --no-install-recommends iproute2 openssh-client ca-certificates \
&& rm -rf /var/lib/apt/lists/*
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.