bump version v1.4.9

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## Version 1.4.9 - 2026-06-09
+* fix: use random nonce per call in AES-GCM onboarding signature
+
 ## Version 1.4.8 - 2024-10-23
 * Added support for fetch methods on payments
 

README.md

@@ -23,7 +23,7 @@ Add this dependency to your project's POM:
 <dependency>
  <groupId>com.razorpay</groupId>
  <artifactId>razorpay-java</artifactId>
- <version>1.4.8</version>
+ <version>1.4.9</version>
 </dependency>
 ```
 

pom.xml

@@ -4,7 +4,7 @@
 
   <groupId>com.razorpay</groupId>
   <artifactId>razorpay-java</artifactId>
-  <version>1.4.8</version>
+  <version>1.4.9</version>
   <packaging>jar</packaging>
 
   <name>razorpay-java</name>

src/test/java/com/razorpay/UtilsTest.java

@@ -94,11 +94,13 @@ public static String decrypt(byte[] encryptedData, String secret) throws Excepti
         byte[] keyBytes = secret.substring(0, 16).getBytes(StandardCharsets.UTF_8);
         SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES");
         byte[] iv = new byte[12];
-        System.arraycopy(keyBytes, 0, iv, 0, 12);
+        System.arraycopy(encryptedData, 0, iv, 0, 12);
+        byte[] ciphertext = new byte[encryptedData.length - 12];
+        System.arraycopy(encryptedData, 12, ciphertext, 0, ciphertext.length);
         Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
         GCMParameterSpec gcmSpec = new GCMParameterSpec(128, iv);
-        cipher.init(Cipher.ENCRYPT_MODE, keySpec, gcmSpec);
-        byte[] decryptedBytes = cipher.doFinal(encryptedData);
+        cipher.init(Cipher.DECRYPT_MODE, keySpec, gcmSpec);
+        byte[] decryptedBytes = cipher.doFinal(ciphertext);
         return new String(decryptedBytes);
     }