{"url":"https://api.github.com/repos/btcpayserver/btcpayserver/releases/404667038","assets_url":"https://api.github.com/repos/btcpayserver/btcpayserver/releases/404667038/assets","upload_url":"https://uploads.github.com/repos/btcpayserver/btcpayserver/releases/404667038/assets{?name,label}","html_url":"https://github.com/btcpayserver/btcpayserver/releases/tag/v2.4.5","id":404667038,"author":{"login":"NicolasDorier","id":3020646,"node_id":"MDQ6VXNlcjMwMjA2NDY=","avatar_url":"https://avatars.githubusercontent.com/u/3020646?v=4","gravatar_id":"","url":"https://api.github.com/users/NicolasDorier","html_url":"https://github.com/NicolasDorier","followers_url":"https://api.github.com/users/NicolasDorier/followers","following_url":"https://api.github.com/users/NicolasDorier/following{/other_user}","gists_url":"https://api.github.com/users/NicolasDorier/gists{/gist_id}","starred_url":"https://api.github.com/users/NicolasDorier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NicolasDorier/subscriptions","organizations_url":"https://api.github.com/users/NicolasDorier/orgs","repos_url":"https://api.github.com/users/NicolasDorier/repos","events_url":"https://api.github.com/users/NicolasDorier/events{/privacy}","received_events_url":"https://api.github.com/users/NicolasDorier/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOBgC-Ks4YHrqe","tag_name":"v2.4.5","target_commitish":"master","name":"2.4.5","draft":false,"immutable":false,"prerelease":false,"created_at":"2026-10-06T12:06:14Z","updated_at":"2026-10-06T12:12:14Z","published_at":"2026-10-06T12:12:14Z","assets":[],"tarball_url":"https://api.github.com/repos/btcpayserver/btcpayserver/tarball/v2.4.5","zipball_url":"https://api.github.com/repos/btcpayserver/btcpayserver/zipball/v2.4.5","body":"### Breaking changes\r\n\r\n* **Outbound HTTP requests**: Block private-network destinations for Lightning connections, LNURL requests, invoice notification URLs, and webhooks by default to prevent SSRF. Operators using private services must [allow them with `ssrfexceptions`](https://docs.btcpayserver.org/Operators/#allow-private-outbound-destinations) (#7581 #7626 #7627 #7635 #7636 #7637 #7638 #7644 #7646) @NicolasDorier\r\n* **Refunds**: Employees without permission to create approved pull payments can no longer auto-approve invoice overpayment refunds; another user must approve the payout (#7649) @NicolasDorier\r\n* **Invoices**: Hide checkout, status, and receipt information from public endpoints one month after monitoring ends; users with invoice-view permission retain access (#7651) @NicolasDorier\r\n\r\n### New features\r\n\r\n* **Greenfield**: Add APIs for discovering and running store reports (#7608) @NicolasDorier\r\n* **Plugins**: Simplify registering and migrating plugin-owned EF Core database contexts (#7611) @NicolasDorier\r\n* **Invoices**: Add the `btcpay.store.canmanageinvoicestatus` permission for marking invoices as settled or invalid (#7643) @NicolasDorier\r\n* **Access Tokens**: Add the `btcpay.store.canmanagelegacyaccesstokens` permission for managing legacy BitPay-compatible tokens and pairing requests (#7502 #7612 #7631) @okjodom @NicolasDorier\r\n\r\n### Fixes\r\n\r\n* **Invoices**: Avoid invoice creation crashes when a payment method reuses another invoice's destination ([btcpayserver-monero-plugin#57](https://github.com/btcpay-monero/btcpayserver-monero-plugin/issues/57), #7483) @CaMoPeZzz\r\n* **Invoices**: Keep invoice searches scoped to the current store (#7599) @NicolasDorier\r\n* **Invoices**: Require antiforgery validation when changing invoice status in the browser (#7643) @NicolasDorier\r\n* **Payouts**: Complete payouts and send update webhooks when an RBF replacement confirms (#7625 #7641) @NicolasDorier\r\n* **Payouts**: Scope payout payment actions to the current store (#7642) @NicolasDorier\r\n* **Refunds**: Calculate refundable and overpaid amounts only from settled payments (#7600) @NicolasDorier\r\n* **Refunds**: Require permission to create approved pull payments before auto-approving invoice overpayment refunds (#7649) @NicolasDorier\r\n* **Reports**: Correct All Time and rolling date ranges (#7608) @NicolasDorier\r\n* **Lightning**: Persist replacement invoices before canceling previous invoices to keep payments available when replacement fails (#7630) @NicolasDorier\r\n* **Lightning**: Use LND's WebSocket invoice subscription instead of long polling (#7621) @NicolasDorier\r\n* **Lightning**: Use only the authorized store when redisplaying setup and settings forms (#7618) @Team1-dev\r\n* **Generated links**: Use the configured server Base URL for account, password-reset, and store-invitation links, and reject non-HTTP(S) Base URLs (#7590 #7628) @NicolasDorier\r\n* **Store settings**: Accept only absolute HTTP or HTTPS Store Website URLs in the UI and Greenfield API (#7604) @NicolasDorier, reported by @gn00295120\r\n* **API Keys**: Show an error instead of a server error when confirming a removed API key (#7568 #7570) @monasco\r\n* **Access Tokens**: Keep failed token revocations scoped to the authorized store (#7629) @NicolasDorier\r\n* **Server users**: Return Not Found instead of a server error when sending a verification email to a deleted user (#7571 #7572) @monasco\r\n* **Plugins**: Run registered plugin database migrations reliably during startup (#7588) @NicolasDorier\r\n\r\n### Improvements\r\n\r\n* **Invoices**: Create invoices noticeably faster by avoiding unnecessary Lightning node and on-chain fee lookups (#7632 #7633 #7634) @NicolasDorier, reported by @bigg-bb\r\n* **Access Tokens**: Warn against using legacy BitPay-compatible tokens for new integrations (#7624) @NicolasDorier\r\n* **Server settings**: Organize administration pages into clearer labeled sections (#7501) @dstrukt\r\n* **Server administration**: Refresh `btcpay-host` deployment capabilities on `SIGHUP` without restarting BTCPay Server (#7576) @NicolasDorier\r\n* **LND**: Warn administrators when Docker's LND REST or gRPC endpoint is available but its reverse-proxy route is disabled (#7593) @NicolasDorier\r\n* **Receipts**: Show the original invoice amount alongside the amount paid on overpaid receipts (#7595 #7597) @NicolasDorier\r\n* **Documentation**: Rewrite the plugin development guides to make plugins easier to build with coding agents (#7598) @NicolasDorier\r\n\r\n### Miscellaneous\r\n\r\n* **Invoices**: Deprecate invoice notification URLs in favor of webhooks and remove the notification URL from manual invoice creation (#7647) @NicolasDorier","reactions":{"url":"https://api.github.com/repos/btcpayserver/btcpayserver/releases/404667038/reactions","total_count":2,"+1":2,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"mentions_count":8}