v0.16.0

Changes

• ci: make pushing a tag the only manual release step (#901)
• chore(deps): bump github/codeql-action from 1 to 4.37.4 (#886)
• chore(deps): bump actions/checkout from 2 to 7 (#887)
• chore(deps): bump actions/setup-node from 1 to 7 (#888)
• chore(deps): bump softprops/action-gh-release from 2 to 3 (#889)
• chore: configure Dependabot schedule and grouping (#814)
• chore(deps): bump form-data (#843)
• chore(deps): bump axios from 1.16.0 to 1.18.0 (#878)
• feat: upgrade lightning from 10.25.0 to 11.1.0 (#806)
• chore(deps): bump mongoose from 8.24.0 to 8.24.1 (#880)
• feat: persist routing fee paid on community earnings withdrawals (#868)
• feat: add order-take rate limit to prevent spam (#828)
• fix: escape MarkdownV2 reserved chars in Farsi locale strings (#872)
• Fix invoice tracking for retried payments (issue #864) (#876)
• feat(order): persist buyer payout hash and preimage (closes #869) (#875)
• Fix/cancel counterparty locale (#874)
• refactor: split order title i18n keys into no-amount and with-amount variants (#859)
• handle slow payments to buyer (#844)
• docs: require English for all repository artifacts (#865)
• Add counterparty requirements (#853)
• fix: make numberFormat always return a string (#858)
• fix: unify sats wording in Russian order title keys (#857)
• fix: show sats amount on fixed orders (#852)
• Fix/cancelall pending only (#848)
• feat: add configurable user requirements for community creation (#841)
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 (#842)
• security: patch runtime dependency vulnerabilities (mongoose, grpc-js, bn.js) (#839)
• Revalidate community order channel ownership lazily at order creation time (#801)
• fix: serialize order release under per-order mutex with state recheck (#836)
• fix: prevent double withdrawal of community earnings (#835)
• bumps to v0.15.2
• fix: harden authorization checks on freezeorder and paytobuyer (#834)
• fix: verify buyer ownership before entering the setinvoice flow (#833)
• fix: enforce community ownership on earnings withdrawal (#832)
• feat: enforce invoice amount matches order amount on payouts (#831)
• feat: add DISABLE_LN_ADDRESS kill-switch for Lightning Address payouts (#830)
• Bump ip-address and socks (#799)
• Bump axios from 1.15.2 to 1.16.0 (#819)
• feat: add disablecommunity/enablecommunity superadmin commands (#817)
• fix: use maker's language when republishing order on buyer cancel (#821)
• Handle concurrent order taking: User PerOrderIdMutex in takeBuy and takeSell [2/2] (#824)
• Handle concurrent order taking: refactor PerOrderIdMutex, move it to util/index.ts for more clean reusability [1/2] (#823)
• feat: re-enable community creation via COMMUNITY_CREATION_ENABLED env var (#811)
• bumps to v0.15.1
• fix: stabilize Telegram startup on DigitalOcean (#826)
• Fix: Restore 'buying' and 'selling' locales lost in pr #770 (#813)
• Bump axios from 1.15.0 to 1.15.2 (#796)
• Bump protobufjs from 7.5.5 to 7.5.8 (#803)
• Allow community admins to configure payment methods for order wizard - Issue292 (#795)
• chore: disable Golden Honey Badger feature (PR1/2) (#791)
• UX: keep withdrawal session active after failed community earnings payment (#784)
• Bump protobufjs from 7.5.1 to 7.5.5 (#785)
• Bump follow-redirects from 1.15.11 to 1.16.0 (#783)
• chore: update telegram-test-api from 2.6.0 to 4.2.1 (#782)
• Allow users to use the /setinvoice command on order in status "WAITING_BUYER_INVOICE" (#780)
• Improve i18n flexibility for showusername order sentences Issue712 (#770)
• Updated axios dependency to ^1.15.0 (#777)
• Allow blocking an user by its telegram id (#773)
• Bugfix: Distinguish i18n contexts for buyer and seller in cancelShowHoldInvoice() (#763)
• Fix in display of username of creator of an order in /checkorder command (#772)
• Bump picomatch from 2.3.1 to 2.3.2 (#771)
• Add settled_by_admin field in order.ts model and improve getDetailedOrder output. (#747)
• Bump flatted from 3.3.1 to 3.4.2 (#767)
• feat: add job to check for expired hold invoices (#746)
• BugFix: users can cancel an order cooperatively at the same time (#733)
• Community administrators now can use checkorder and checkinvoice commands (#732)
• fix: prevent /release from silently failing when subscriber is dead (#765)
• Bump minimatch (#759)
• feat: interactive wizard for /dispute (#731)
• Removed the hash preimage of the invoice from checkorder command output (#761)
• Fix: Languages ​​changed when opening a dispute (#728)
• Added community name to checkorder command output (#737)
• A complete Persian (FA) translation and some minor corrections in the English file (#711)