Esewa callback issue

Esewa callback is adding extra query as ?data= instead of &data= which was causing order not found error during my tests. I’ve created a temporary patch for it and sharing it here. Hope it helps when creating a official fix with next version if the issue can be replicated.

payments-esewa-bugs.patch

diff --git a/includes/gateways/class-npwc-gateway-esewa.php b/includes/gateways/class-npwc-gateway-esewa.php
index 558e475..89ebc29 100644
--- a/includes/gateways/class-npwc-gateway-esewa.php
+++ b/includes/gateways/class-npwc-gateway-esewa.php
@@ -140,10 +140,16 @@ class NPWC_Gateway_Esewa extends NPWC_Gateway_Base {
 	}
 
 	protected function decode_return_payload() {
+		// Bug Fix: callback data array
+		if (isset( $_SERVER['QUERY_STRING'] ) ) {
+			parse_str( str_replace( '?data=', '&data=', wp_unslash( $_SERVER['QUERY_STRING'] ) ), $_GET );
+		}
+
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- external redirect from eSewa, which cannot carry a WordPress nonce. resolve_callback_order() gates on a hash_equals() match against our own high-entropy transaction_uuid before any order is returned, and process_callback() additionally verifies the eSewa signature before acting on the payload.
 		if ( ! isset( $_GET['data'] ) ) {
 			return null;
 		}
+
 		$encoded = str_replace( ' ', '+', wp_unslash( $_GET['data'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- external redirect, cannot carry a nonce; this is a base64 payload, so sanitize_text_field() would collapse consecutive '+' characters (decoded from spaces) and corrupt it. Validated below by strict base64_decode() and, in process_callback(), by signature verification.
 		$decoded = base64_decode( strtr( $encoded, '-_', '+/' ), true );
 		if ( false === $decoded ) {