Changes
- ci: make pushing a tag the only manual release step (#901)
- chore(deps): bump github/codeql-action from 1 to 4.37.4 (#886)
- chore(deps): bump actions/checkout from 2 to 7 (#887)
- chore(deps): bump actions/setup-node from 1 to 7 (#888)
- chore(deps): bump softprops/action-gh-release from 2 to 3 (#889)
- chore: configure Dependabot schedule and grouping (#814)
- chore(deps): bump form-data (#843)
- chore(deps): bump axios from 1.16.0 to 1.18.0 (#878)
- feat: upgrade lightning from 10.25.0 to 11.1.0 (#806)
- chore(deps): bump mongoose from 8.24.0 to 8.24.1 (#880)
- feat: persist routing fee paid on community earnings withdrawals (#868)
- feat: add order-take rate limit to prevent spam (#828)
- fix: escape MarkdownV2 reserved chars in Farsi locale strings (#872)
- Fix invoice tracking for retried payments (issue #864) (#876)
- feat(order): persist buyer payout hash and preimage (closes #869) (#875)
- Fix/cancel counterparty locale (#874)
- refactor: split order title i18n keys into no-amount and with-amount variants (#859)
- handle slow payments to buyer (#844)
- docs: require English for all repository artifacts (#865)
- Add counterparty requirements (#853)
- fix: make numberFormat always return a string (#858)
- fix: unify sats wording in Russian order title keys (#857)
- fix: show sats amount on fixed orders (#852)
- Fix/cancelall pending only (#848)
- feat: add configurable user requirements for community creation (#841)
- chore(deps): bump js-yaml from 4.1.1 to 4.2.0 (#842)
- security: patch runtime dependency vulnerabilities (mongoose, grpc-js, bn.js) (#839)
- Revalidate community order channel ownership lazily at order creation time (#801)
- fix: serialize order release under per-order mutex with state recheck (#836)
- fix: prevent double withdrawal of community earnings (#835)
- bumps to v0.15.2
- fix: harden authorization checks on freezeorder and paytobuyer (#834)
- fix: verify buyer ownership before entering the setinvoice flow (#833)
- fix: enforce community ownership on earnings withdrawal (#832)
- feat: enforce invoice amount matches order amount on payouts (#831)
- feat: add DISABLE_LN_ADDRESS kill-switch for Lightning Address payouts (#830)
- Bump ip-address and socks (#799)
- Bump axios from 1.15.2 to 1.16.0 (#819)
- feat: add disablecommunity/enablecommunity superadmin commands (#817)
- fix: use maker's language when republishing order on buyer cancel (#821)
- Handle concurrent order taking: User PerOrderIdMutex in takeBuy and takeSell [2/2] (#824)
- Handle concurrent order taking: refactor PerOrderIdMutex, move it to util/index.ts for more clean reusability [1/2] (#823)
- feat: re-enable community creation via COMMUNITY_CREATION_ENABLED env var (#811)
- bumps to v0.15.1
- fix: stabilize Telegram startup on DigitalOcean (#826)
- Fix: Restore 'buying' and 'selling' locales lost in pr #770 (#813)
- Bump axios from 1.15.0 to 1.15.2 (#796)
- Bump protobufjs from 7.5.5 to 7.5.8 (#803)
- Allow community admins to configure payment methods for order wizard - Issue292 (#795)
- chore: disable Golden Honey Badger feature (PR1/2) (#791)
- UX: keep withdrawal session active after failed community earnings payment (#784)
- Bump protobufjs from 7.5.1 to 7.5.5 (#785)
- Bump follow-redirects from 1.15.11 to 1.16.0 (#783)
- chore: update telegram-test-api from 2.6.0 to 4.2.1 (#782)
- Allow users to use the /setinvoice command on order in status "WAITING_BUYER_INVOICE" (#780)
- Improve i18n flexibility for showusername order sentences Issue712 (#770)
- Updated axios dependency to ^1.15.0 (#777)
- Allow blocking an user by its telegram id (#773)
- Bugfix: Distinguish i18n contexts for buyer and seller in cancelShowHoldInvoice() (#763)
- Fix in display of username of creator of an order in /checkorder command (#772)
- Bump picomatch from 2.3.1 to 2.3.2 (#771)
- Add settled_by_admin field in order.ts model and improve getDetailedOrder output. (#747)
- Bump flatted from 3.3.1 to 3.4.2 (#767)
- feat: add job to check for expired hold invoices (#746)
- BugFix: users can cancel an order cooperatively at the same time (#733)
- Community administrators now can use checkorder and checkinvoice commands (#732)
- fix: prevent /release from silently failing when subscriber is dead (#765)
- Bump minimatch (#759)
- feat: interactive wizard for /dispute (#731)
- Removed the hash preimage of the invoice from checkorder command output (#761)
- Fix: Languages changed when opening a dispute (#728)
- Added community name to checkorder command output (#737)
- A complete Persian (FA) translation and some minor corrections in the English file (#711)