chore: bump BTCPay Server to 2.4.2; NBXplorer 2.6.10; 2.4.1:5 → 2.4.2:0

[MattDHill]

Summary

• Bumps BTCPay Server 2.4.1 → 2.4.2, a critical security release upstream reports is being actively exploited: it fixes a TOTP two-factor authentication bypass via the Greenfield API's Basic authentication, and now disables Greenfield Basic auth by default five minutes after account creation (re-enablable in account settings).
• Bumps NBXplorer 2.6.9 → 2.6.10, the version upstream recommends alongside 2.4.2.
• Version 2.4.1:5 → 2.4.2:0, release notes in all five locales; no migration. Postgres (18.4) and the Shopify deployer (1.10) are already at their newest upstream tags and stay put.
• The wrapper is unaffected by the Basic-auth breaking change: its only Basic header is NBXplorer cookie auth in the utxo-sync health check, and the password-reset action writes to Postgres directly.
• Both new image tags verified multi-arch on Docker Hub (amd64 + arm64).

Upstream release: https://github.com/btcpayserver/btcpayserver/releases/tag/v2.4.2

Test plan

• Update in place from 2.4.1:5 (or fresh install) on a box with Bitcoin running; all health checks go green (Web Interface, UTXO Tracker, UTXO Tracker Sync)
• Log into the BTCPay web UI; Server Settings → Maintenance (and the page footer) show 2.4.2
• Service logs show NBXplorer 2.6.10 starting and reaching ready
• Existing stores, users, and wallet balances are intact; create a test invoice and confirm the checkout renders
• On an account with TOTP 2FA enabled, login still enforces the second factor

🤖 Generated with Claude Code