Releases: Start9Labs/btcpayserver-startos
Release list
2.4.3:2
What's Changed
Restores BTCPay Server data left behind by an update from StartOS 0.3.x, and updates BTCPay Server to the 2.4.3 pre-release build rc6.
Updating from StartOS 0.3.x moves your BTCPay Server data — stores, invoices, wallets and settings — onto the storage this package uses. On servers running BTCPay Server 2.4.2 or later under StartOS 0.3.x, that move was skipped, and BTCPay Server started against empty storage: no stores, no accounts, every password rejected, and "No server admins exist" from the Reset Server Admin Password action.
Nothing was deleted. Your data stayed where the previous package kept it. This release moves it across on the first start after updating, so that start takes longer than usual — it is moving a database — and your original login works again once it finishes.
If you already hit this and created a new account in the empty BTCPay Server, that account and anything created with it is moved aside rather than deleted, and your original data takes its place. Contact support before removing what was set aside if you might need it.
Lightning credentials. If BTCPay Server is wired to a Lightning node, this update raises a critical task asking you to replace that node's credentials, and stops BTCPay Server until you clear it. The servers affected above never received that prompt when they should have; the 2.4.2 release notes explain why it matters.
New in rc6:
- Store users — a server admin can no longer be added to a store, nor have their role in a store changed, by someone who is not a server admin themselves. The rule applies both to a store's Users page and to the API.
- Plugins — the check that keeps an outdated plugin disabled until it is updated now covers seven more: Ecwid, SamRock, Stripe, BigCommerce, Mark Paid at Checkout, Ark and Cashu. If you use any of them, update it under Server Settings → Plugins; until then it stays disabled.
If you are updating from a version earlier than 2.4.3, that release was also a security update:
- Crowdfund — an app's description is no longer rendered as raw HTML, closing a cross-site scripting vector.
- Shopify plugin — BTCPay Server now refuses to load outdated versions of the Shopify plugin and keeps them disabled until they are updated. If you use the Shopify integration, update the Shopify plugin under Server Settings → Plugins after this update; the newer plugin fixes a refund webhook vulnerability.
About this version: it ships BTCPay Server's 2.4.3 pre-release build (rc6) from BTCPay Server's internal image channel; upstream has not yet published a 2.4.3 release, git tag, or changelog. The upstream changes above were identified by comparing the published images. Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.
Downloads
SHA256 Hashes
f19346e0698ac0e8af5e30d02ca82ecc433618c384197a4b42185ad547cfcdaa btcpayserver_aarch64.s9pk
b100284d602a4c0354bee505ae728405fe54da0e34caa34c280f0e9a677285b9 btcpayserver_x86_64.s9pk
2.4.3:1
What's Changed
Security update — BTCPay Server 2.4.3 — and a fix for a failed update from StartOS 0.3.x.
About this version: it ships BTCPay Server's 2.4.3 pre-release build (rc5) from BTCPay Server's internal image channel; upstream has not yet published a 2.4.3 release, git tag, or changelog. The security changes below were identified by comparing the published rc4 and rc5 images. This package will move to the final 2.4.3 build as soon as it is published.
- Crowdfund — an app's description is no longer rendered as raw HTML, closing a cross-site scripting vector.
- Shopify plugin — BTCPay Server now refuses to load outdated versions of the Shopify plugin and keeps them disabled until they are updated. If you use the Shopify integration, update the Shopify plugin under Server Settings → Plugins after this update; the newer plugin fixes a refund webhook vulnerability.
- Updating from StartOS 0.3.x — the migration copied a plugins folder that only exists if you had installed a plugin. On a server that never did, the copy failed and took the whole update down with it, with no way past it on retry. The migration now skips what isn't there, and no longer reports success when a file copy fails partway, which could previously finish an update with data left behind.
Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.
Downloads
SHA256 Hashes
d57814037f09152ccf7fef94597598ce1a0881c96637861bff901d2fae48ff06 btcpayserver_aarch64.s9pk
7818dcc773f0c99cde3a42e3fd203554ff4cd01df366b9c87fa2a19c222911ab btcpayserver_x86_64.s9pk
2.4.3:0
What's Changed
Security update — BTCPay Server 2.4.3 — and a fix for a failed update from StartOS 0.3.x.
About this version: it ships BTCPay Server's 2.4.3 pre-release build (rc5) from BTCPay Server's internal image channel; upstream has not yet published a 2.4.3 release, git tag, or changelog. The security changes below were identified by comparing the published rc4 and rc5 images. This package will move to the final 2.4.3 build as soon as it is published.
- Crowdfund — an app's description is no longer rendered as raw HTML, closing a cross-site scripting vector.
- Shopify plugin — BTCPay Server now refuses to load outdated versions of the Shopify plugin and keeps them disabled until they are updated. If you use the Shopify integration, update the Shopify plugin under Server Settings → Plugins after this update; the newer plugin fixes a refund webhook vulnerability.
- Updating from StartOS 0.3.x — the migration copied a plugins folder that only exists if you had installed a plugin. On a server that never did, the copy failed and took the whole update down with it, with no way past it on retry. The migration now skips what isn't there, and no longer reports success when a file copy fails partway, which could previously finish an update with data left behind.
Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.
Downloads
SHA256 Hashes
04d278d83600684ff0079961c513d5c7c355b4eac6841578943eae3b17738839 btcpayserver_aarch64.s9pk
be4709fa4bbf7fa955ae9c9eb1c7c3f540c9a6ced44b2cc86257d3185941e2fa btcpayserver_x86_64.s9pk
2.4.3-rc.4:1
What's Changed
Updated NBXplorer to 2.6.11.
A maintenance release with no changes to NBXplorer itself: it rebuilds on the .NET 10.0.11 runtime, which carries this month's .NET security fixes, and on NBitcoin 10.0.9.
BTCPay Server stays on the 2.4.3-rc4 pre-release build shipped in the previous release.
Full changes: btcpayserver/NBXplorer@v2.6.10...v2.6.11
Downloads
SHA256 Hashes
4138178620542c25bc82b5305355a37c5a7e870984f2bd37d0ab01b471d4fbcd btcpayserver_aarch64.s9pk
aa8c58cf32e3fd0f53abf984f71d8d53147cf182561f97b744df13802895117d btcpayserver_x86_64.s9pk
2.4.3-rc.4:0
What's Changed
Security update — BTCPay Server 2.4.3-rc4.
This is a pre-release build. It is packaged from BTCPay Server's internal image channel ahead of upstream's public release: at packaging time, 2.4.3 had no published release, git tag, or changelog, so the specifics of the fix are not yet public.
Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.
Downloads
SHA256 Hashes
480d4251e1b5eb7b5af279c6f3e8494a5fdcf8e8f9db0c68c38e01c15f9fbd20 btcpayserver_aarch64.s9pk
56234cf030338bbedb1d65c2bdf6a0cebf06b8365cebccd37cb6114ddeb44fbc btcpayserver_x86_64.s9pk
2.4.2:1
What's Changed
Prompts you to replace your Lightning node's credentials after the 2.4.2 security update.
The vulnerability patched in 2.4.2 was being actively exploited, so on any server that ran an earlier build, treat everything BTCPay Server could reach as exposed. Updating does not by itself undo access an attacker already took.
If BTCPay Server is wired to a Lightning node, updating raises a critical task and stops BTCPay Server until you clear it:
- LND — run LND's "Revoke Macaroons" action. BTCPay Server reads LND's admin macaroon, which grants full control of the node. This needs LND
0.21.1-beta:11or later, now required as a dependency: earlier releases called the action "Recreate Macaroons" and only deleted the macaroon files, leaving the root key that signs them in place, so nothing was actually revoked. - Core Lightning — run Core Lightning's "Revoke All Runes" action. BTCPay Server reaches CLN over its admin RPC socket, so a compromised server could have issued itself a rune that outlives the patch.
Two things this update cannot do for you:
- If you have ever connected BTCPay Server to a Lightning node — even if you have since switched away — rotate that node's credentials anyway. The task is only raised for the node BTCPay Server is wired to right now.
- If you generated a hot on-chain wallet inside BTCPay Server, move those funds to a wallet whose keys BTCPay Server has never held. A hot wallet's keys cannot be rotated.
Downloads
SHA256 Hashes
344ee9b2a1ec62e9c5f73a9b60486b82df5efef8f27b4a710b12f005c018d41a btcpayserver_aarch64.s9pk
3ca788801736972d336fa61f819f3221802146f3c15db57b83712346efb9b174 btcpayserver_x86_64.s9pk
2.4.2:0
What's Changed
Updated BTCPay Server to 2.4.2 and NBXplorer to 2.6.10.
This is a critical security release — upstream reports the vulnerability is being actively exploited, so update as soon as possible.
- Fixed a two-factor authentication (TOTP) bypass through the Greenfield API's Basic authentication
- Basic authentication on the Greenfield API is now disabled by default five minutes after account creation; it can be re-enabled in account settings if an integration needs it
- More reliable multisig PSBT signing and finalization, including with newer HWI and Jade firmware
- Right-to-left (RTL) stylesheets now load correctly
- Wallet transaction table columns can be hidden, shown, and reordered
- Cleaner store settings pages; public invoice creation for payment requests is now rate limited
NBXplorer 2.6.10 is the version upstream recommends alongside this release. Full release notes: https://github.com/btcpayserver/btcpayserver/releases/tag/v2.4.2
Downloads
SHA256 Hashes
fa624a6541af59ac2ae88804d52c6aa22c2f61c048e94327d30bfa74969f8e2f btcpayserver_aarch64.s9pk
4aa460bb9802482db90e281c36282901fcb991781a75a8c9450589b55202d998 btcpayserver_x86_64.s9pk
v2.4.2.1
016e4d3 
Updated BTCPay Server to 2.4.2 and NBXplorer to 2.6.10.
This is a critical security release — upstream reports the vulnerability is being actively exploited, so update as soon as possible.
Full Changelog: v2.3.4...v2.4.2.1
SHA256 Sum
93d2e76be57520eade2b84c20202340e26f56aa286f283af1ad0e4a7e690cc69 btcpayserver.s9pk
2.4.1:5
What's Changed
Updated the Shopify integration to 1.10.
While a customer's invoice is being created, the checkout now shows a "please wait" message next to the spinner instead of a bare spinner. This only affects stores using the optional Shopify integration; BTCPay Server itself is unchanged.
Full changes: btcpayserver/shopify-app@1.9...1.10
Downloads
SHA256 Hashes
93bcf2cc8f301a2054c68af349071efc03546298510b76927eb413af9167444b btcpayserver_aarch64.s9pk
20ac1c9c0f36108b3da3709dbf703e04786ad5a45a7fd08f72b205510bb771e7 btcpayserver_x86_64.s9pk
2.4.1:4
What's Changed
Uses a dedicated, trusted connection to Bitcoin Core for downloading blocks.
BTCPay Server's block indexer, NBXplorer, pulls blocks from Bitcoin Core over the peer protocol. It was connecting on the same port as anonymous peers from the internet, so Bitcoin Core could drop the connection to make room for another peer, or cut it off under the limits that protect your upload bandwidth. It now uses a separate, local-only port that Bitcoin Core trusts. This requires Bitcoin Core or Bitcoin Knots to be updated first; StartOS will prompt you.
Downloads
SHA256 Hashes
f17218e51908c0852b2b41ef9eb1559fbf8aa1649c73750ea3ba42975434ece5 btcpayserver_aarch64.s9pk
e7a7b8034bd20bdb0b1aa8a16cfbacbd927b252f87126cdcf082270f594b9fa3 btcpayserver_x86_64.s9pk