Breaking changes
- Checkout: NFC payments are now disabled by default. Enable them under Store Settings > Checkout Experience. This change was introduced in 2.4.3 but was missing from its release notes. @rockstardev
- Invoices: Block zero-amount invoices by default. Stores can allow them in their settings (#7514) @NicolasDorier
- Boltcards: Remove the desktop smartcard setup and open the Boltcard app instead (#7515) @NicolasDorier
- Store users: Users must accept an invitation before joining a store (#7519) @dstrukt
- Point of Sale: Remove the per-request
notificationUrl. Invoices now use the app's configured notification URL @Kukks - Server administration: Remove legacy SSH settings and add deployment-provided
btcpay-hostintegration, includingbtcpay-host env(documentation) (#7511 #7543) @NicolasDorier - API Keys: Use API key IDs instead of secrets for Greenfield API revocation (#7561) @NicolasDorier
- Bitpay API: Remove legacy BitPay Basic-auth API keys (#7561) @NicolasDorier
New features
- Stores: Add invitations for store users (#7519) @dstrukt
- Email Rules: Add
StoreInvitePendingandStoreUserJoinedtriggers (#7519) @dstrukt
Fixes
- Crowdfund: Keep the main image and last-updated date when contributions change (#7487) @inauman
- Reports: Display short values correctly and hide broken explorer links (#7506) @Psycarlo
- Invoices: Require permission to change an invoice's state (#7514) @NicolasDorier
- Wallet: Show an empty label instead of the wallet derivation scheme (#7521) @TChukwuleta
- Plugins: Show details and install actions for unlisted plugins found through search or direct links (#7524) @thgO-O
- Point of Sale: Fix checkout when products share the same title (#7540) @comwanga
- Rates: Replace the unavailable CryptoMarket provider with Notbank and update existing rate rules (#7526) @NicolasDorier
- Rates: Ignore invalid BTCTurk prices where the bid is higher than the ask @NicolasDorier
- Payment Requests: Do not add empty reference IDs to invoice searches @NicolasDorier
- Log users out immediately when they are demoted, disabled, unapproved, or have their email confirmation revoked (#7529) @NicolasDorier
- Keep monetization subscriptions from re-enabling accounts disabled by an administrator (#7523) @TChukwuleta
- Greenfield: Prevent restricted API keys from creating unrestricted keys (#7531) @NicolasDorier
- Greenfield: Prevent disabling the last active server administrator (#7541) @TChukwuleta
- Greenfield: Honor the server policy that lets store owners add users without invitations (#7565) @NicolasDorier
- Stores: Block unsafe support links to prevent script injection (#7537) @TChukwuleta
- API Keys: Keep new API keys out of authorization redirect URLs (#7542) @TChukwuleta
- Maintenance: Validate hostnames before changing a domain @NicolasDorier
- Account security: Require the current password when changing an account email (low impact, reported by llen)
Improvements
- Reports: Sort invoice report rows from oldest to newest (#7512) @kevin-ta
- Rates: Request only supported currency pairs from Kraken (#7472) @ZenulAbidin
- Plugins: Allow payment methods to validate settings for the current store (#7513) @NicolasDorier
- Greenfield SDK: Safely encode values in API URLs (#7530) @NicolasDorier
- Hide breadcrumbs that only repeat the page title (#7517) @NicolasDorier
- Monetization: Show a useful message instead of a 404 when Manage billing is unavailable (#7516) @NicolasDorier
- API Keys: Store API key hashes instead of plaintext secrets and show key IDs and creation dates (#7561) @NicolasDorier