chore: bump BTCPay Server to 2.4.3-rc4 - #106
Merged
Merged
Conversation
Security update. 2.4.3-rc4 is a prerelease: upstream publishes release candidates to btcpayserver/btcpayserver-internal, and at packaging time 2.4.3 had no GitHub release, git tag, or changelog, so the pin changes image repo as well as tag. Move it back to btcpayserver/btcpayserver when the final release lands. Two things the version string and file layout encode: exver rejects a prerelease segment mixing letters and digits, so upstream's 2.4.3-rc4 is written 2.4.3-rc.4:0 here. Ordering is unaffected: 2.4.2:1 < 2.4.3-rc.4:0 < 2.4.3:0. 2.4.2:1 is spun off to its own version file rather than bumped in place, because it carries the migration that raises the critical Lightning credential-rotation task. Bumping in place would collapse the range vertex into current to `>=2.4.0:2 && <2.4.3-rc.4:0` with no migration on the edge, so every user still on 2.4.0:2..2.4.2:0 would reach 2.4.3 in one hop and silently skip that task. As a declared node, they route through it instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security update to BTCPay Server 2.4.3-rc4. Package version
2.4.2:1→2.4.3-rc.4:0.Prerelease, from a different image repo
Upstream publishes release candidates to
btcpayserver/btcpayserver-internal, not the publicbtcpayserver/btcpayserver, so this bump changes the image repo as well as the tag:At packaging time 2.4.3 had no GitHub release, git tag, or changelog, and
masterwas not ahead ofv2.4.2— consistent with an embargoed fix staged ahead of disclosure. The release notes therefore state that the specifics are not yet public rather than describing the vulnerability; they should be filled in once upstream publishes.UPDATING.mddocuments the internal channel and says to move the pin back to the public repo when the final release lands.For the same reason I could not check whether 2.4.3 calls for matching NBXplorer or PostgreSQL versions, per
UPDATING.md. Those stay at2.6.10and18.4.Version string:
2.4.3-rc.4, not2.4.3-rc4exver rejects a prerelease segment that mixes letters and digits —
rc4fails to parse at the4, caught at compile time byValidateExVer. The package version needs the dot, so it deliberately differs from the upstream Docker tag. Ordering is unaffected:Why
2.4.2:1gets its own version file2.4.2:1carries the migration that raises the critical Lightning credential-rotation task, so it is spun off tostartos/versions/v2.4.2_1.tsrather than bumped in place. Dumping both candidate graphs shows why:current>=2.4.2:1 && <2.4.3-rc.4:02.4.2:1, whose edge carries the migration>=2.4.0:2 && <2.4.3-rc.4:0currentBumping in place would mean every user still on
2.4.0:2..2.4.2:0reaches 2.4.3 in a single hop and silently skips the rotation task, with the update itself reporting success. The spun-off file is byte-identical to the previouscurrent.tsapart from the export name.Verified
tsc --noEmitclean; prettier cleandocker manifest inspect btcpayserver/btcpayserver-internal:2.4.3-rc4resolves withlinux/amd64+linux/arm64, covering the manifest's declared arches🤖 Generated with Claude Code