From f6f455fa3171abe5f6e576a65d14d8b54f697119 Mon Sep 17 00:00:00 2001 From: archipelago Date: Fri, 7 Aug 2026 13:30:55 -0400 Subject: [PATCH] =?UTF-8?q?release(catalog):=20clear=20the=20legacy=20btcp?= =?UTF-8?q?ay=202.3.9=20entry=20=E2=80=94=20signed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The legacy `btcpay` entry (distinct from `btcpay-server`, no embedded manifest) still carried a concrete 2.3.9 image. catalog_primary_image treats that as authoritative, which is what drove the UI to offer "update to 2.3.9" on nodes already running 2.4.2 — a rollback onto the actively exploited release. Now 2.4.2 in both entries, signed by the pinned release root and verified. This lands the fix for every node immediately, without waiting for the binary carrying the downgrade guard (cbfda305) to reach them. The guard remains the durable fix: it makes any future stale pin fail safe rather than relying on every version claim being correct. Co-Authored-By: Claude Opus 5 (1M context) --- releases/app-catalog.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/releases/app-catalog.json b/releases/app-catalog.json index 0851b6f6..065bf05b 100644 --- a/releases/app-catalog.json +++ b/releases/app-catalog.json @@ -858,13 +858,13 @@ "version": "1.2.11" }, "btcpay": { - "image": "docker.io/btcpayserver/btcpayserver:2.3.9", + "image": "docker.io/btcpayserver/btcpayserver:2.4.2", "images": { "archy-btcpay-db": "146.59.87.168:3000/lfg2025/postgres:15.17", "archy-nbxplorer": "146.59.87.168:3000/lfg2025/nbxplorer:2.6.0", - "btcpay-server": "docker.io/btcpayserver/btcpayserver:2.3.9" + "btcpay-server": "docker.io/btcpayserver/btcpayserver:2.4.2" }, - "version": "2.3.9" + "version": "2.4.2" }, "btcpay-server": { "manifest": { @@ -4897,7 +4897,7 @@ } }, "schema": 1, - "signature": "532eb226558e175cbb7c0aa307d0cc1800ed0794266795d817509ab29fcd7334383e33c257552f7e29ba033e99205b6b73285b88e06d79f2d6096629d6471109", + "signature": "0ccba6b8bb26fc718ad126049f96b5800109949770d894fa4ff6c947871cf6c8779c1c474d39ccf886708842cfbbf2e57cb904092bde8f8a65163acd7f3ff401", "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT", "updated": "2026-08-07" }