Release Notes

Changed

• Removed an unused storefront endpoint that could change a payment's amount after the order was placed.

Fixed

• On stores without Multi-Source Inventory, the recovery pay page no longer reports products as out of stock when Magento would still sell them: products with Manage Stock set to No, whatever their quantity, and products that accept backorders.

Added

• Payments taken at checkout (Payment Element, Card Element, Standalone, Express Checkout and Express Wallet), recovered orders, and admin MO/TO and Terminal orders now carry the order's line items (product, SKU, quantity, unit price, tax, discount and shipping) and the order number, kept in step when the amount changes before the order is placed; Klarna uses them when deciding whether to approve a purchase and commercial cardholders see the order number on their statement. If the items cannot be built the payment goes ahead without them. Pay by Link payments taken on the store's own pay page do not carry them yet.

Fixed

• Orders paid with Brippo are created directly with the Brippo Incomplete [Do NOT Ship] status instead of passing through Magento's generic Pending first, so an ERP or despatch export polling for pending orders can no longer pick up an order that never received a payment; orders placed through the REST or GraphQL API no longer stay Pending until the monitor cancels them.
• Express Checkout in the minicart now appears when the theme opens the minicart by itself after adding to cart, comes back if the minicart is redrawn, and no longer stops the minicart's Proceed to Checkout button from working.
• An order paying with Express Checkout Element or the Standalone method can no longer be created by a checkout path that bypasses the extension's own order placement (REST or GraphQL placeOrder, a third-party checkout); the submission is refused before the order exists, as it already was for Payment Element, Card Element, Express Wallet and Pay by Link.

Added

• Refund confirmation on credit memos: the Refund button now checks the payment's live refund state first and asks for confirmation when it has already been refunded, showing what the payment holds refunded and what this credit memo would add; a refund the order does not record points to Refund Offline instead. Refund Offline and payments with nothing refunded are unaffected.
• Payments-monitor health: every run is recorded, and a persistent admin message reports a monitor that has stopped running, could not check some orders in its last run, or could not reach the Brippo platform; a stalled monitor is also reported to the platform once a day so the merchant's contacts are emailed.
• Payments-monitor findings the Brippo platform could not be told about are queued and redelivered by later runs for up to a day, and the admin message shows how many are waiting; platform requests now give up connecting after 10 seconds and waiting for an answer after 30.

Changed

• The file-integrity scan now sends the content of a changed or unexpected code file with its report, so a real modification can be told apart from a harmless line-ending or whitespace rewrite; contents go only when the findings change, never for images or fonts.

Fixed

• The payments monitor resumes each run from where the previous one stopped (up to a day back, oldest first), so a late or missed cron slot no longer leaves orders unexamined.
• A Brippo API request that fails before any response (unresolvable host, refused or timed-out connection) is reported with curl's network error, and a non-JSON response with its HTTP status and the start of its body, instead of "Unable to unserialize value"; neither is taken as the platform saying a payment intent does not exist, so the monitor never cancels an order because of one.
• When the Brippo platform gives no answer while the monitor checks an order, the lookup is retried once after a two-second pause instead of the order being reported and never checked again; Brippo API requests give up connecting after 10 seconds and waiting for an answer after 60.
• A Pay by Link email that fails to send when the order is placed is now retried, as intended, for orders between 10 and 30 minutes old.
• The payment-link page no longer logs a stack trace or reports a failure to the platform for requests without a payment link id (crawlers, uptime monitors, test traffic), and a client-side error report naming neither a payment link nor a payment is dropped; failures on a real link are logged and reported as before.
• Recover Checkout reminders follow each store view's own reminder count, first delay and spacing instead of the default store's, so a store view with reminders switched off gets none.

Added

• Recovery and payment-link messages sent by SMS or WhatsApp now tell the Brippo platform which order they are about, so a customer's reply can be shown to the merchant against the right order. The text the customer receives is unchanged.

Fixed

• Recover Checkout now recognises a purchase completed under a different email address (the same items to the same address, or the same phone number) as the recovery, so the failed attempt gets no further reminders and its link cannot take the payment again.
• The standalone payment method (Pay by Bank) no longer fails at confirmation with an incompatible-types error: its payment intent is created for the configured method explicitly.
• Checkout and the payment-link page now offer only the payment methods the store's own Brippo account is eligible for, instead of the full set enabled on the platform.
• Extensions that subclass PaymentMethod with the pre-101.0.39 argument list (pos-brippo among them) construct again without a booted ObjectManager, as the refund-preflight dependency is now resolved lazily.
• The integrity scan no longer posts a report the platform can only reject when no account is configured for the active mode, and a rejected report is no longer retried every half hour.
• A file-integrity report that fails because the platform was briefly unreachable or busy is sent again on the next half-hourly scan instead of waiting up to a day.
• The file-integrity scan no longer accepts an empty .git file or a .git directory without a HEAD as proof of a developer checkout, so dropping one on an installed module cannot switch tamper detection off.
• The file-integrity scan no longer reports an untouched install as tampered on servers whose git converts line endings, though an install already on disk with converted endings keeps reporting until it is reinstalled cleanly.
• The Pay button on the recovery and payment-link pages no longer accepts a click before it can act on it, and a click that fails shows a message instead of appearing to do nothing.
• Saving payment settings no longer posts a settings snapshot the platform can only reject when no account is configured for the saved scope's active mode.
• Completing onboarding now sends an initial settings snapshot to the platform, so a freshly onboarded store appears in the settings overview without waiting for the next configuration save.
• The settings snapshot reports Express Wallet Checkout as enabled when at least one placement is switched on, so replacing the legacy Express Wallet Button with a placement shows as a swap rather than as wallets being turned off.
• The Recover Checkout automatic reminders no longer write a "Notification is not due" line into every cancelled order's log every hour, and they go only to Brippo orders cancelled because the payment failed, not to orders cancelled by the admin, refused by the firewall or paid with other methods.
• The recovery page proves the recovery link before reading anything about the order: an invalid link says only that, and the already-completed check now covers only later orders in the same store placed within 30 days.
• The recovery page no longer accepts a payment intent id in the URL, which no recovery link has carried since links became opaque tokens.
• Recovery links in the pre-101.0.31 format now stop working 30 days after the order was placed, the same life a current link has, instead of staying usable indefinitely.
• A Recover Checkout reminder missed because the cron did not run during its hour is sent at the next run instead of being lost, a run repeated within the hour cannot send it twice, and a recovery link already sent by hand from the order view counts as the first reminder.
• Sending a recovery notification by WhatsApp from the order view now uses the approved WhatsApp template so it is delivered, and the order view reports what each channel actually did rather than always reporting success.
• Stores that choose their own payment methods (Payment Methods Available = Manual) can take payments at checkout, on recovery links and in the retry window again: the payment is set up for the same methods the payment form offers instead of failing at confirmation and cancelling the order.
• Pay by Bank can now be one of several methods offered at checkout: the payment is set up for the method the customer actually chose, so the other methods are no longer blocked by Pay by Bank not supporting authorise-then-capture.
• A malformed place-order request can no longer leave an order awaiting payment with an emptied cart: the request is refused before the order is created, and an order that is created is always cancelled and its cart restored when the payment cannot be set up.
• The Apple Pay, Google Pay and Link buttons on a recovery link now refuse the payment when the purchase was already completed through another order, as the card form on that page already did, so a recovery page left open in a tab cannot take the money a second time.
• Onboarding a single website now saves the connected account and returns to that website's own payment configuration, instead of landing on an unrelated website or, on installs with more websites than store views, failing to store the account at all.
• Recover Checkout no longer mistakes an order still awaiting payment, two customers sharing a delivery address, or two non-Latin street names for a completed purchase, re-checks the recovery it found before each further reminder instead of closing the order for good, and no longer names the matched order on the customer-facing page.
• Checkouts abandoned before a payment was ever made, and orders whose payment was cancelled at the platform, receive the Recover Checkout reminders again: they are now recorded as awaiting payment instead of plainly cancelled.
• A recovery message sent by hand from the order view counts as a reminder whatever channel it went out on, so a customer just sent the link by SMS or WhatsApp is not sent it again by the next automatic reminder.
• The Recover Checkout reminders no longer try to text the placeholder phone number a wallet checkout leaves behind when the customer gave none.
• A Recover Checkout reminder due at the shortest spacing is no longer lost when an hourly run does not happen: the next run still sends it, once.
• Two failed attempts saved in the same second now count as one attempt, so the customer gets a single reminder, and a reminder is matched to the customer by the address it is sent to rather than by the order's email column alone.
• An error raised while one order is being examined no longer ends a Recover Checkout reminder run: the orders behind it, and the later reminders, are still sent.
• The settings snapshot sent to the platform now reads the configuration of the website or store it reports on, so a merchant who configures Brippo at website level is no longer recorded with every integration switched off.
• Resending a payment link from the Payment Links grid now sends the link's own checkout page instead of always the Magento-hosted one, and a link belonging to an order tells the platform which order it is about, as the resend from the order view already did.
• A recovery link is now proved to the server on every request the page makes, not only when the page is drawn, so naming another customer's order number can no longer start a payment for it, read what it is worth, or restore it into a cart.
• Recover Checkout again recognises a retry paid on a store that captures payments manually, so a customer who has paid gets no more reminders and the failed attempt's link cannot take the payment a second time, and two wallet orders that each arrived without a street are no longer read as the same household.
• A recovery page left open in a tab can no longer take the money a second time after the order has been paid somewhere else: the endpoints behind the page now refuse an order that is already paid, invoiced or moved on, as the page itself did, and an order number that names nothing is refused in the same words as an invalid link.
• The Edit Order button on a recovery link restores the order's items to the cart again instead of always reporting every item out of stock, and items that genuinely cannot be added are logged.
• Resending a payment link from the Payment Links grid works again on an upgrade deployed before the compiled code is regenerated, goes out on the order's own store instead of the default store view, and a recovery notification that did go out is no longer reported as failed when recording it as a reminder fails.
• Smart Capture expires held orders, releases their stock and sends reminders on each store view's own settings instead of the default store view's, and Recover Checkout automatic reminders go out for a store view that enables the feature while the default has it off.
• A Pay by Link order is settled only against the payment intent the platform created for it, so a webhook naming any other intent is logged on the order and ignored, and a webhook signing secret can be configured so signed webhooks are verified.
• A Pay by Link email that keeps failing to send stops being retried after five attempts, as intended.
• The cart restored by a recovery link's Edit Order button shows the items' real totals straight away instead of $0.00 until checkout, and the order's addresses and contact details are carried over so checkout is pre-filled.
• The payments monitor cancels unpaid orders again: since 101.0.33 the check that cancels an order whose payment was never completed crashed on every such order, so declined or abandoned checkouts stayed in Brippo Incomplete until cancelled by hand.
• The admin order view no longer opens the Process Payment in Terminal popup, or offers the button, on a Terminal order that is already cancelled, closed, completed or invoiced.
• A recovery link or Pay by Link page no longer intermittently shows a raw parser error in place of the card form when its first requests race the form-key cookie: every request on the page shares one key, both pages are excluded from full-page caching, and a payment form that still cannot load asks the shopper to reload the page.

Added

• Paid Payment Detection setting for Pay by Link: instant platform webhook (default), a 5-minute polling cron for stores not reachable from the internet, or both combined.
• Payment links carry the store's webhook URL and detection mode in their metadata, replacing the dashboard-side webhook-mapping registration.
• Orders parked awaiting a payment outcome are settled by a new hourly sweep: paid intents complete the order, unpaid ones cancel it, in-flight ones wait for the next run.

Fixed

• Paid orders are no longer cancelled when the browser-side payment confirmation is lost: the payment status is verified before any frontend-initiated cancellation, paid orders are completed instead, and a retried cancel cannot invoice or email twice.
• Refreshing or navigating away mid-payment no longer cancels an order whose real payment state cannot be determined.
• Payments still processing after confirmation (bank redirects) are no longer cancelled as failed; the order completes once the payment succeeds.
• Pay by Bank no longer fails at checkout with a capture-method error.
• Online captures and refunds use the currency the payment was actually taken in; zero-decimal currencies such as JPY are no longer captured at 100 times the amount.
• Pay by Link and Terminal payments in zero-decimal currencies are no longer captured at one hundredth of the amount.
• MO/TO and Terminal orders on Base Currency stores now charge the base amount in the base currency.
• Smart Capture expiry defers instead of cancelling when an order's payment status cannot be determined, and completes orders whose payment actually went through.
• Recovery payments whose completion callback never reached the store are completed on the next cron run, with their stock reservation restored.
• Soft-fail recovery reminders are sent at most once per notification number.
• The payments monitor and orders grid no longer re-save fraud details on every check, and the 3D Secure column and destination-charge reference are captured again.
• The Standalone promotion discount row no longer shows an empty label in the checkout order summary.
• The Standalone promotion requires a Minimum Order Total greater than zero and no longer advertises a discount no order can earn.
• A partial invoice smaller than the promotion discount no longer saves with a negative grand total; the remainder carries to the next invoice.
• A re-issued invoice after a cancelled one receives the promotion discount again instead of capturing more than the authorised amount.
• The discount code input on the express product page no longer zeroes the payment sheet.
• The express wallet no longer answers with a server error when the shopper has no active cart.
• The express-checkout wallet button now appears on stores that enforce a Content Security Policy: the storefront's inline scripts, event handlers and styles go through Magento's secure renderer.
• The admin panel no longer reports Content Security Policy violations.
• Payment links, checkout links and recovery links sent by SMS or WhatsApp use short underscore-free URLs so phone apps keep the whole link tappable, including admin resends.
• Pay by Link fails with the platform's own error message instead of handing the customer a bare paywith.brippo.com link when link creation misfires.
• Send Payment Link is refused on orders that are already paid, and the orders-grid action says so when no payment link is stored.
• The "Recover with" popup on the admin order view tolerates apostrophes, backslashes and line breaks in names and links.
• The file-integrity monitor no longer reports server-side image optimization as tampering.
• Admin support links now point to support@help.brippo.com.
• Completing an order whose payment is awaiting capture no longer crashes on the capture-method lookup, which was killing the payments monitor, the cancellation guard and the recovery sweeps.
• A single order failing with a PHP engine error no longer aborts a whole sweep or payments-monitor run; the failure is logged and the run continues with the next order.
• A retried online refund can no longer refund the same money twice: every online refund reconciles against the payment's refunded total first and is aborted if Stripe already holds more.
• Orders paid with the Standalone method now carry the promotion discount, so invoices and credit memos are raised for the discounted total instead of the full one.
• Recovery pages no longer boot the pay-checkout placement scripts, so they stop throwing a console error and re-requesting configuration on every load.
• Pay by Link orders paid on the Brippo hosted payment page are now completed as soon as the payment goes through, whether or not the payment is captured straight away; until now only links paid through Stripe-hosted checkout reached the store.
• SMS and WhatsApp messages are sent again in test mode: the test-mode flag never reached the platform, so nothing was delivered. Live mode was unaffected.

Added

• New "Brippo MO/TO from Backend" payment method: admins take phone and mail orders by keying the card into a Stripe Payment Element on the order-create page, so card details never pass through Magento.
• Optional payment-method promotion for the Standalone checkout: automatic order discount (first-order and repeat amounts, minimum order total, end date, own totals line everywhere, configurable badge next to the payment method title) applied when the customer pays with the standalone method — no voucher code needed.
• Send Payment Link button on the admin order view for Pay by Link orders, delivering the payment link by email, SMS and/or WhatsApp, also reachable as a row action in the orders grid.
• Custom Title setting for the wallets entry in the checkout payments list, overriding the name auto-generated from the available wallets.

Fixed

• Pay by Link with the "Brippo Hosted" checkout type now sends the customer to Brippo's own hosted checkout page instead of Stripe's payment-link page, on the order email, the order view and the admin resend alike.
• The file-integrity scan now evaluates composer source installs (git clone in vendor/) instead of classifying them as developer checkouts and never checking their files.

Added

• File-integrity scan every 30 minutes: installed module files are compared against the official release manifest and tampering (modified, missing or dropped files) is reported to the Brippo platform.
• The client-side PaymentMethod id is forwarded at payment-intent creation so the Brippo firewall can apply card-fingerprint block rules.
• A "Keep the Checkout Shipping Address" setting (on by default) in the wallets express checkout Checkout placement, to control whether the wallet may replace the address the shopper entered in the checkout.

Fixed

• Recover Checkout now recognises a recovery even when the recovered order's total changed (coupon, different shipping method, offline payment), and the duplicate-order check compares the right customer.
• The checkout wallet buttons (express checkout element and the legacy payment request button) no longer ask for, nor apply, the wallet account's shipping address when the shopper already entered one in the checkout, so orders ship to the typed address.
• Closing the admin send-to-terminal popup now cancels the pending handoff, so the terminal app stops waiting for a card on an order the admin walked away from.

Added

• Complete German, Spanish and Dutch translations, and full coverage for the existing French and Italian ones (storefront, checkout, emails and admin).

Fixed

• Recovery and Pay by Link emails, and recovery SMS/WhatsApp messages, now render fully in the store's language — the action buttons, greetings and default message bodies were previously hardcoded in English.
• Express Checkout orders no longer lose the phone number provided by the Apple Pay / Google Pay wallet.

Added

• CSP violation reports from the checkout and Pay by Link pages are now sent to the Brippo platform for central whitelist-gap detection.

Fixed

• The recovery pay page no longer reports bundle or configurable orders as out of stock when their child products are in stock.
• Smart Capture expiry now also cancels overdue trying-to-recover orders left in state new or pending payment, releasing the stock they were holding.
• Express Checkout frontend TypeError when initializing on an out-of-stock product page.
• PHP deprecation warning when placing a backend Pay by Link MOTO order.
• Restored PHP 7.4 compatibility and added a PHP 7.4 CI compatibility check.
• Consistent escaping in the payment-links admin grid across PHP versions.
• Trimmed the CSP whitelist so the store's CSP header stays under Apache's 8KB limit, avoiding empty 500 responses on some hosting stacks.
• Smart Capture expiry now retries orders whose cancellation previously failed, so stuck backlogs drain automatically.
• Platform-service notifications (order fulfillment, receipts, monitors) no longer fail with 400 errors after a JSON platform call in the same process.

Fixed

• Smart Capture expired orders on hold now cancelled correctly instead of staying on hold forever.

Fixed

• Fatal error when saving an order that has no status yet (e.g. PayPal orders on first save).

Fixed

• Admin pages rendering unstyled when CSS merging is enabled.

Added

• Recover Checkout: admin settings to customise the default email and SMS body in the "Recover with Brippo" popup.
• Fraud firewall: customer risk profile attached to payments so the Brippo API can step up 3D Secure or block high-risk payments.
• Checkout funnel analytics events sent to the Brippo reporting service.
• Payment settings snapshot reported on configuration save for drift detection.

Changed

• 2026 brand refresh for the admin UI and transactional emails.
• Recover Checkout links now use opaque tokens instead of order parameters in the URL.
• Improved built-in default recover email body wording.
• "Recover with Brippo" popup: clarified SMS message field and WhatsApp template behaviour.
• Removed obsolete uncaptured-payments count cron and table.
• Payment analytics now post directly to the Brippo reporting service.
• All recovery attempts (automatic, soft fail, manual) now tracked per channel for reporting.
• Recovery decline code carried through the recovery flow for reporting attribution.

Fixed

• Security: order-cancellation endpoints now verify the order belongs to the current checkout session.
• Intermittent Express Checkout (Apple Pay / Google Pay) button mount error on first load.
• Apple Pay / Google Pay wallets charging without tax when a deferred tax provider (e.g. AvaTax) is in use.
• Apple Pay / Google Pay wallet sheet now shows an itemised breakdown with explicit tax rows.

Added

• Terminal: new "Card Input Method" admin setting to pre-select or lock Card Present / MO/TO in the "Process Payment in Terminal" popup.

Fixed

• 3D Secure failures caused by missing *.stripe.network host in CSP whitelist (added to connect-src and frame-src).
• Amasty Gift Card amounts not applied at order submit; totals are now recollected before submit so gift card address attributes reach sales_model_service_quote_submit_before observers. Also applies to Pay by Link.
• Terminal: duplicate customer email and card input option in the admin "Process Payment in Terminal" popup.
• Stripe loading now skipped for search-engine bots, improving SEO crawl performance; polling timeout raised from 3s to 6s for real users so slow connections don't bail early.
• Bot user-agent regex tightened to avoid false matches on real browsers.

Added

• Custom checkout selector for 3rd party checkout extensions.

Fixed

• Apple Pay and Google Pay GB postcode handling for full postcodes without spaces (e.g. "YO266LB") and lowercase postcodes.
• "Include Wallets" setting now hides Apple Pay and Google Pay on the main checkout when disabled.
• Friendly error message when placing an order with an empty cart.
• Currency stored correctly on order payment information.

Added

• Standalone Pay by Link email template for payment links sent without an order context.

Fixed

• Apple Pay GB postal code fix not triggering when postcode has trailing space.

Added

• Pay by Link new standalone option and admin manager.
• Brippo pay checkout for paying pay by links.

Added

• Sanitise addresses to avoid invalid characters.
• Recover checkout stats and improvements.

Added

• Failsafe for billing/shipping address telephone field.

Added

• Security validations to admin controllers and configuration endpoint.
• Refactor Checkout Form with improved security and performance improvements.
• Implement customer event logging system.
• Add Mageside OSC support for Wallets express.
• Improved place order button locks while re-rendering.

Added

• Legacy Checkout Card Element.
• Filter card brands for ECE and Checkout Form.

Fixed

• Resolved possible double rendering for Checkout Form and performance issues.

Added

• Automatic Async capture mode.

Added

• Automatic processing of uncaptured payment orders in NEW state.
• Failsafe and notification for orders going straight to complete instead of processing.

Fixed

• Frontend serialization issues.
• City errors with restricted characters.
• Admin get config issues.

Fixed

• Klarna serialization issues on occasional instances.
• Fix cancelled quantities when recovering an order.
• Retry frontend confirmation when "object in use" error.
• Invalid website id when website and store have uncorrelated ids.

Added

• added setting to specify which logos are displayed for PayByLink

Fixed

• PayByLink error "enter a valid payment method and try again"

Added

• Support for latest Hyvä Themes and Hyvä Checkout.

Added

• Wallet Express Checkout payment list mode.
• Take delivery estimate from cart page for Wallet Express Checkout.
• Admin tool for manually setting order as processing.

Fixed

• Configuration endpoint 404 error when store domain includes folder.

Added

• Receipt for Backend Terminal orders.
• Billing data ported to Brippo Portal for Backend Terminal orders.

Fixed

• PHP 7.3 support issues.

Added

• Standalone Checkout, with Pay by Bank, Klarna and Billie support.

Fixed

• API key being overridden by **** if config re-saved.

Added

• Improved general order flow and payment logs/analytics.
• Recover checkout signature to avoid exposing customer addresses.

Fixed

• Form key error on product page loaded the first time for Wallets Express Checkout.
• PHP 8.4 compilation warnings.

Added

• Wallets Express Checkout regenerate button if removed.
• Recover Checkout general improvements.
• Pickup input values feature.

Fixed

• Fix for Deprecated Error: explode() Passing Null to Parameter #2

Added

• Soft Fail recovery.

Changed

• Improved Recover Checkout analytics and general fixes.

Fixed

• GetPaymentMethods error in admin when service not ready.

Added

• Wallet button not showing on mobile

Added

• PHP 8.4 and Magento 2.4.8 support.

Fixed

• GB postal code failsafe for cutted codes fix.

Fixed

• CSP issues with 3ds popup on some browser versions.
• Multi-currency setting not being picked up.
• Fixes on customer refresh failsafe.

Added

• Checkout form payment methods configuration.

Fixed

• Amasty rewards points compatibility

Fixed

• errors related to missing shipping data

Changed

• checkout form initialization (retry)

Added

• MageSide support.
• Block customers by group.

Fixed

• Recover checkout not loading.
• Error on specific use case: can't make payment missing data.

Added

• Terminal payment method now supports card present mode as well as MO/TO.

Changed

• Merged frontend package.

Fixed

• Shipping restrictions issue.

Added

• New Terminal MOTO payment method.

Fixed

• Recover orders cron failing on some PHP versions.

Fixed

• Recover checkout automatic notifications disabled by default. Require service to be ready.

Fixed

• 2FA not working for admin.

Added

• Recover checkout.

Fixed

• Rounding issue in amount monitor check.

Changed

• Curl library fixes for some magento stores.

Changed

• New Connected Account setup flow.

Changed

• Order status new scheme. Brippo custom statuses introduced.

Added

• 3DS result column in Order Grid.

Added

• Authorize-only order status change option.
• Klarna & ClearPay support.