Redsys Payments (Cards, Bizum, Spain) changelog
All notable changes to Redsys for CS-Cart and Multi-Vendor (kv_redsys) are documented here.
The format follows Keep a Changelog and the project uses Semantic Versioning.
[Unreleased]
Section titled “[Unreleased]”[1.0.0] - 2026-11-07
Section titled “[1.0.0] - 2026-11-07”- Initial release.
- Redsys redirection payments: signed form (HMAC_SHA512_V2 or HMAC_SHA256_V1), unique 12-character order numbers, card and Bizum payment methods (Ds_Merchant_PayMethods z).
- Verification of the signed notification (signature, answer code, amount, currency) before an order is paid; repeated, late and out-of-order notifications are safe.
- Customer return while the payment is pending: the order is shown, the cart and the saved cart rows stay empty.
- Refunds through the REST interface (type 3), full or partial, with unconfirmed-refund handling.
- Connection page with encrypted terminal key, test and live mode and a connection test.
- Job queue with retries and back-off, cron (command line and secret address), log viewer with CSV export.
Fixed (release-gate audit 2026-11-07, before the first release)
Section titled “Fixed (release-gate audit 2026-11-07, before the first release)”- Currency minor units follow the complete ISO 4217 table: XOF, XAF, XPF, PYG, BIF, DJF, KMF, RWF, VUV (0 decimals) and IQD, JOD, LYD (3 decimals) were sent with 2 decimals. Obsolete BGN and VEB were removed (140 currencies).
- Multi-Vendor owner mode: a cart with several vendors is paid on the parent order; the child orders now show the payment, refund their own share (form and status trigger) and the transactions list links them.
- Every payment attempt is listed on the order tab with its own refund form (duplicate payments are refundable there); “already paid” checks every attempt; the status refund refunds every paid attempt.
- A paid notification is also compared with the order’s current total: when the order was edited while the payment was pending, the payment is booked but the order is not marked paid.
- The customer’s return for a paid payment whose order is not yet in a paid status is treated as pending (no “transaction cancelled”, cart emptied).
- Notifications and refunds use the terminal key of the mode the payment was made in (test or live); Ds_Currency is required.
- Vendors cannot retry or discard queue jobs in owner mode and see only their own job counts; Redsys order numbers are unique in the database; the order tab button is called “Reload” (Redsys has no status query).