2025-09-24T02:34:14Z - 2026-09-24T02:34:14Z
Overview
8 releases published by 2 users
Tag
v0.3.3
Tag
v0.3.2
Tag
v0.3.1
Tag
v0.2.1
Tag
v0.3.0
Tag
v0.2.0
Tag
v0.1.0
Release
0.1.1
0.1.1
17 pull requests merged by 2 users
Merged
#17 feat(guest): guest checkout without login (Swish + QR)
Merged
#16 fix(payment): make Swish QR code scannable by the Swish app
Merged
#15 feat(payment): Swish QR code and pre-filled payment link
Merged
#14 develop
Merged
#13 Autofill deploy version from latest git tag
Merged
#12 fix(admin): restore broken table styling after focused-modules refactor
Merged
#11 Log out users automatically when their JWT expires.
Merged
#10 chore: make dev Dockerfiles self-contained, add bindless dev override
Merged
#9 Add production-only Umami analytics for bilhej.se.
Merged
#8 Refactor admin fulfillment into focused modules.
Merged
#7 Add admin order fulfillment tracking.
Merged
#6 Make customer-facing UI usable on smartphones.
Merged
#5 Add account settings dropdown and verified email change flow.
Merged
#4 feature/cancel-edit-pending-orders
Merged
#3 feature/cancel-edit-pending-orders
Merged
#2 Fix order cancellation by allowing cancelled in the database status constraint.
Merged
#1 feature/cancel-edit-pending-orders
6 pull requests proposed by 1 user
Proposed
#25 fix(guest): make Swish QR scannable on guest payment page (#22)
Proposed
#26 fix(db): add CHECK constraint for userId XOR guestToken invariant (#23)
Proposed
#27 fix(payment): persist amountPaid on payment confirmation (#20)
Proposed
#28 fix(guest): move guest token from URL query to sessionStorage (#21)
Proposed
#29 feat(security): add per-IP rate limiting on guest-order endpoints (#19)
Proposed
#30 fix(security): gate guest self-confirmed orders behind PENDING_REVIEW (#18)
1 issue closed from 1 user
Closed
#24 [Bug] normalizeSwishNumber does not strip leading '+', breaking Swish payment for +46 numbers
7 issues created by 1 user
Opened
#18 [Security] Honor-system payment confirmation: no Swish money verification on guest /pay endpoint
Opened
#19 [Security] No rate limiting / abuse protection on public POST /api/guest-orders
Opened
#20 [Bug] amountPaid never persisted on guest or authenticated payment confirmation
Opened
#21 [Security] Guest token rides in URL query string - leaks via access logs / history / Referer
Opened
#22 [Bug] Swish QR fails to scan on desktop - margin, color, width non-compliant with ISO 18004 / Swish spec
Opened
#23 [Data integrity] No DB-level CHECK constraint for userId XOR guestToken invariant
Opened
#24 [Bug] normalizeSwishNumber does not strip leading '+', breaking Swish payment for +46 numbers