What the developer wrote
Authored by Nicolas Dorier
Update Changelog
What changed, and why it matters
This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation and contains no security fix.
Treat this commit as documentation-only. To assess actual security risk, review the code changes in the BTCPay Server 2.4.2 release and any associated security advisory. Do not rely on this changelog edit for technical details of the vulnerability.
Security signals we found
Changelog language changed to describe a critical, actively exploited vulnerability in release 2.4.2
No code, configuration, or dependency changes present in the commit
Security issue is referenced but not fixed or explained in this diff
Evidence from the diff
The diff is a single-line change in Changelog.md, replacing the phrase ‘Although these security fixes are not critical, we recommend updating at your earliest convenience.’ with ‘This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.’ No source code, build scripts, dependencies, or configuration are modified. The underlying security issue is referenced but not described or fixed in this commit.
Changed components
Changelog.mdInspect captured patch +1 / −1
diff --git a/Changelog.md b/Changelog.md
index 686869d..53afda1 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -2,7 +2,7 @@
## 2.4.2
-Although these security fixes are not critical, we recommend updating at your earliest convenience.
+This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.
We recommend integrators to also update NBXplorer to version 2.6.10.
Those have been reported to us by @brunoerg and @benthecarman from the Bitcoin Red Team effort.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.