PayU Payments (Cards, BLIK, Pay-by-link) changelog
All notable changes to PayU for CS-Cart and Multi-Vendor (kv_payu) are documented here.
The format follows Keep a Changelog and the project uses Semantic Versioning.
[Unreleased]
Section titled “[Unreleased]”- A customer who returns while PayU is still pending is no longer told “transaction cancelled” and offered to pay again: the order moves to a pending status (setting) and a waiting page checks PayU until the payment is final. A second PayU order for the same order is never started while the first is open or paid.
- Marketplace owner mode: vendors can no longer refund (button, controller, automatic refund at a status) money of the owner’s PayU account; vendors cannot run the global queue.
- Refunds: a refund whose answer was lost is retried with the same
extRefundId, amount and description (PayU creates it once); refunds of a payment run under a lock and the refunded total accumulates atomically; refund notifications are matched byextRefundIdtoo and the CANCELLED spelling is accepted. - Return, notification, cron and admin Sync serialize on a lock per payment, so stock movements and e-mails happen once.
- Vendor mode: PayU is offered only when the cart holds products of one vendor with a connected account; mixed carts are not charged to the owner’s account.
- Auto-receive is documented as a requirement (installation, configuration, Connection page); WAITING_FOR_CONFIRMATION is logged and shown on the order tab.
- Names, descriptions and texts are cut by characters, not bytes (Polish letters); the request is never sent with invalid UTF-8.
- Payments made in the other mode (test/live) are not re-read with the wrong credentials; identical notifications at the same moment no longer cause database errors.
- Refund statuses in the order tab are translated. BGN is no longer offered.
[1.0.0] - 2026-11-07
Section titled “[1.0.0] - 2026-11-07”- Initial release.
- PayU payment method (PayU REST API 2.1, PayU GPO Europe): OAuth client credentials, order created with
POST /api/v2_1/orders, customer redirected to theredirectUriof PayU,continueUrlandnotifyUrlsent with every order. - Notifications verified with the
OpenPayu-Signatureheader and the second key of the POS (MD5, SHA-256, SHA-384, SHA-512), stored first and processed by the job queue, idempotent by order id and status. - An order counts as paid only after
GET /api/v2_1/orders/{orderId}returned COMPLETED and order id, external order id, POS id, amount and currency match; lost notifications are recovered by the customer’s return and by the recurring check. - Full and partial refunds from the order page or automatically at an order status (
POST .../refundswith a uniqueextRefundId), refund result read back. - Currencies PLN, EUR, CZK, GBP, USD, HUF, RON, CHF, DKK, NOK, SEK; amounts in minor units; other store currencies converted to PLN.
- Connection page with encrypted credentials (POS ID, OAuth client secret, second key), test and live mode, a connection test.
- Marketplace owner mode or one PayU account per vendor (Multi-Vendor).
- Job queue with retries and back-off, cron (command line and secret address), log viewer with CSV export.