Bump to 1.37.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.37.0] - 2026-10-23
+
 ### Added
 
 - **PayFast.** A second online payment provider (card, instant EFT and more). Switch it on in Site settings → Payments, then enter the merchant ID, merchant key and salt passphrase from your PayFast (or Sandbox) dashboard and choose Sandbox or Live. Payments are confirmed by PayFast's notification (ITN) at `/api/webhooks/payfast`, which is checked the way PayFast requires: the signature, that it came from PayFast, that PayFast confirms it, and that the amount matches the checkout. PayFast starts switched off.

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.36.0",
+      "version": "1.37.0",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-23, after **1.36.0**. The plan itself is in
+Last updated: 2026-10-23, after **1.37.0**. The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -12,19 +12,21 @@ features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 | 1.33.0 | Multi-day events phase A — sessions, late joining + late pricing, per-session check-in, attendance register, session reminders, certificates (4 templates, verify page) |
 | 1.34.0 | Background jobs on pg-boss (admin Background jobs page), Playwright e2e tests, Gitea CI workflow, `scripts/deploy.sh` |
 | 1.35.0 | Multi-day events phase B — "pick sessions" (per-session tickets and prices, session capacity) |
+| 1.37.0 | PayFast (signed form, ITN checks), `ProviderCheckout` with amount checks, the "Pay online" page (`/pay/<id>`) where payers choose a provider |
 | 1.36.0 | Payment provider interface (`backend/src/payments`) with Yoco behind it, `ProviderTransaction`, `Payment.provider`, Site settings → Payments (on/off and order per provider), R15 minimum |
 | 1.35.1 | Waitlist per session, session picker at the door, "All sessions" tickets let people tick sessions at one price; fixes (per-session stock limits, offline service worker serving stale scripts) |
 
 ## Next up
 
-1. **1.37.0 PayFast → 1.38.0 SnapScan → 1.39.0 Zapper** (one release each), each as a
-   provider in `backend/src/payments` (see "Where the payment code lives" below). Get the
-   current API documentation links from Joshua before building each one, and don't
-   guess at an API — sandbox/test credentials needed for SnapScan and Zapper. With a second
-   provider the checkout needs a provider picker (the public `GET /api/payments/providers`
-   lists the enabled ones), and "pay online" buttons should hide below R15 / when none is on.
-   Decisions: fees are **never** deducted or passed on (people handle fees at cashup);
-   minimum online payment **R15** for all providers.
+1. **1.38.0 SnapScan → 1.39.0 Zapper** (one release each), each as a provider in
+   `backend/src/payments` (see "Where the payment code lives" below). Get the current API
+   documentation links from Joshua before building each one, and don't guess at an API —
+   sandbox/test credentials needed. They're QR/app payments: the `/pay/<id>` page is where the
+   QR shows (desktop) or the app deep link opens (mobile), polling until the webhook lands.
+   Still open from the roadmap: hide "pay online" buttons below R15 / when no provider is on
+   (today the server refuses with a clear message), and a "check payment status" /
+   reconcile job for webhooks that never arrive. Decisions: fees are **never** deducted or
+   passed on (people handle fees at cashup); minimum online payment **R15** for all providers.
 2. **1.40.0–1.41.0 — POPIA toolkit** (spec §3 in the roadmap).
 3. **1.42.0 + Hub v1** — install/update tooling and the Hope Events Hub (separate repo
    `joshua/hope-events-hub`).

docs/ROADMAP-v2.md

@@ -17,7 +17,8 @@ reminders, certificates); 1.34.0 job queue (pg-boss), Playwright E2E tests, Gite
 workflow (waiting for a runner) and deploy script; 1.35.0 multi-day events phase B
 (pick sessions, per-session capacity), with 1.35.1 adding the per-session waitlist, the session
 picker at the door and session choice on "All sessions" tickets; 1.36.0 payment provider interface
-(Yoco moved behind it, Site settings → Payments). **Next: 1.37.0 PayFast, then SnapScan, Zapper.**
+(Yoco moved behind it, Site settings → Payments); 1.37.0 PayFast and the "Pay online" page.
+**Next: 1.38.0 SnapScan, then Zapper.**
 
 **Repositories:**
 

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.36.0",
+      "version": "1.37.0",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.36.0",
+      "version": "1.37.0",
       "license": "ISC",
       "devDependencies": {
         "@playwright/test": "^1.64.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",