2.4.3:1
·
8 commits
to master
since this release
What's Changed
Security update — BTCPay Server 2.4.3 — and a fix for a failed update from StartOS 0.3.x.
About this version: it ships BTCPay Server's 2.4.3 pre-release build (rc5) from BTCPay Server's internal image channel; upstream has not yet published a 2.4.3 release, git tag, or changelog. The security changes below were identified by comparing the published rc4 and rc5 images. This package will move to the final 2.4.3 build as soon as it is published.
- Crowdfund — an app's description is no longer rendered as raw HTML, closing a cross-site scripting vector.
- Shopify plugin — BTCPay Server now refuses to load outdated versions of the Shopify plugin and keeps them disabled until they are updated. If you use the Shopify integration, update the Shopify plugin under Server Settings → Plugins after this update; the newer plugin fixes a refund webhook vulnerability.
- Updating from StartOS 0.3.x — the migration copied a plugins folder that only exists if you had installed a plugin. On a server that never did, the copy failed and took the whole update down with it, with no way past it on retry. The migration now skips what isn't there, and no longer reports success when a file copy fails partway, which could previously finish an update with data left behind.
Upstream's full release notes will appear at https://github.com/btcpayserver/btcpayserver/releases once 2.4.3 is published.
Downloads
SHA256 Hashes
d57814037f09152ccf7fef94597598ce1a0881c96637861bff901d2fae48ff06 btcpayserver_aarch64.s9pk
7818dcc773f0c99cde3a42e3fd203554ff4cd01df366b9c87fa2a19c222911ab btcpayserver_x86_64.s9pk