BTCPay Server has released version 2.4.5, focusing on enhanced security and improved invoice processing. The update introduces protections against Server-Side Request Forgery (SSRF) for Lightning, LNURL outbound requests, and invoice webhooks. Additionally, the platform has implemented stricter permissions for approving refunds to mitigate insider risks.
Privacy improvements include hiding public invoice details one month after issuance. The update also cleans up Docker integrations and retires support for Bitcoin Plus, Trezarcoin, and JoinMarket. A new command, btcpay-routes, provides administrators with increased control over Lightning API routes.
Tor support is now a manual opt-in feature, requiring existing users to re-enable it after updating. The release also features improved sandboxing for the Plugin Builder and updates to the Greenfield API. Developers are advised to review the GitHub release notes for breaking changes before upgrading production systems.
