- Keep a refund address the payer types the moment the swap refund panel appears. The React checkout reset its per-attempt refund draft from a mount effect, which flushes after the panel is on screen, so the first address typed into a freshly shown panel could be wiped; the reset now happens during render, only when the attempt actually changes.
- Document plugin installation with screenshots in the BTCPay Server README and
on the
/btcpaypage: four new steps walk the Plugins menu, the plugin directory, the OpenReceive search result and the install button, so the setup and try-it screenshots now run 5–12. - Use the host's checkout description as the default invoice memo on the mounted
HTTP routes in every engine (Node, Ruby, PHP, Python). The display string
amountForreturns beside the price now reachesmake_invoice, so hosts that write no invoice code no longer mint BOLT11s with an empty description and payer wallets show what was bought. An explicit request-bodymemostill wins, and a host that returns no description still mints without one. - Close the September payment-safety review gaps: reject refunds without a saved supported network in Node, retain PHP paid observations after fulfillment rollback, accept legacy Node wallet-deadline snapshots, and let newer payments progress past failed historical scan batches without postponing older retries under continuous arrivals. Enforce Python/Ruby scan deadlines inside wallet requests and sanitize direct Node/Ruby provider diagnostic hooks.
- Run the Knex PostgreSQL transaction and binding acceptance suite on every CI push.
- Separate swap deposit expiry from wallet settlement lifetime; retain payment and refund monitoring after instruction expiry and cancel stale browser actions when the checkout identity changes.
- Make fulfillment commit atomically with settlement, defer Django post-commit callbacks to host commit, and verify stored settlement before acknowledging it. Node custom repositories must adopt the transactional callback and durable lookup.
- Persist fair, bounded reconciliation progress across requests and workers; resume capped scans without treating incomplete history as proof of absence. Add reviewed, audited repair APIs for early closures and attention attempts.
- Fix PostgreSQL Knex binding/transaction handling, recursive diagnostic redaction, wallet normalization, refund-network checks, and PHP relay failover without automatically replaying an uncertain invoice mint.
- BTCPay Server plugin 0.4.11: recover historical LN/LNURL settlements, retain
retired swap and refund access, serialize replacements and provider poll
claims, and authorize wallet endpoints before network access. This release
publishes the plugin; see
packages/dotnet/CHANGELOG.mdfor its full notes andpackages/dotnet/BTCPayServer.Plugins.OpenReceive/PAYMENT-SAFETY-UPGRADE.mdfor the migration and existing-row review it requires. - Coordinated upgrade and existing-row review are required; see payment safety upgrade and repair.
- Fix a wallet scan that could end early. The walk decided the wallet had run
out of rows from the page length after unusable rows were dropped, so one
malformed row on a full page ended it as complete and a paid invoice on a
later page could be closed as not found. Every engine (Node, Ruby, PHP,
Python, and the BTCPay plugin source) now counts the rows the wallet sent.
Ruby, PHP and Python also keep the skipped-row count when a page is
normalized a second time, which the walk does after the wallet client.
Two new cases in
spec/test-vectors/wallet-scan-truncation.json. - Python: a wallet reply whose
resultis a bare list no longer reads as an empty scan. The receive client hands the result to the normalizer as sent, and a non-objecterrorraises. - BTCPay Server plugin: minted invoices are stored in a new
openreceive_invoicestable so a restart keeps each invoice's scan window, a failed whole-history walk is retried, andpackages/dotnet/docker/restart-e2e.shproves "paid while BTCPay was down". - BTCPay Server plugin: the notification subscription opens its own relay socket. NNostr's shared pool disposed the leased client after five quiet minutes, which silently ended push and left settlement to the 60-second sweep.
- Print the demo's address in a highlighted banner.
npm run demo <target>draws a boxedhttp://localhost:<port>block when it starts and again the moment the published port first answers, so the URL is not lost under the Docker Compose log stream. A detached run (-- -d) now waits for the port before returning, and the BTCPay demo's ready message uses the same banner. - Release verification: the nine Buy a Button examples (
django,fastapi,fastify,laravel,nextjs-fullstack,node-express,php-plain,rails,static-html-small-api) were rebuilt against the 0.4.11 workspace packages and gems. The live wallet smoke ran against a Rizful NWC connection: preflight plus a real invoice mint and a production reconcile pass in all four engines (Node, Ruby, Python, PHP). No invoice was paid manually, so settlement of a live payment was not exercised in this release.
OpenReceive Files
Open-source Bitcoin checkout, paid to your own wallet
Brought to you by:
openreceive
