Skip to content

2.4.3:0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Aug 16:28
· 9 commits to master since this release
v2.4.3_0
044efe8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security update — BTCPay Server 2.4.3 — and a fix for a failed update from StartOS 0.3.x.

About this version: it ships BTCPay Server's 2.4.3 pre-release build (rc5) from BTCPay Server's internal image channel; upstream has not yet published a 2.4.3 release, git tag, or changelog. The security changes below were identified by comparing the published rc4 and rc5 images. This package will move to the final 2.4.3 build as soon as it is published.

  • Crowdfund — an app's description is no longer rendered as raw HTML, closing a cross-site scripting vector.
  • Shopify plugin — BTCPay Server now refuses to load outdated versions of the Shopify plugin and keeps them disabled until they are updated. If you use the Shopify integration, update the Shopify plugin under Server Settings → Plugins after this update; the newer plugin fixes a refund webhook vulnerability.
  • Updating from StartOS 0.3.x — the migration copied a plugins folder that only exists if you had installed a plugin. On a server that never did, the copy failed and took the whole update down with it, with no way past it on retry. The migration now skips what isn't there, and no longer reports success when a file copy fails partway, which could previously finish an update with data left behind.

Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.

Downloads

SHA256 Hashes

04d278d83600684ff0079961c513d5c7c355b4eac6841578943eae3b17738839  btcpayserver_aarch64.s9pk
be4709fa4bbf7fa955ae9c9eb1c7c3f540c9a6ced44b2cc86257d3185941e2fa  btcpayserver_x86_64.s9pk
Assets 4
Loading