* Dev – Code improvements on class-enr-compatible-wc-subscription-downloads.php.

* Dev – Add AI assistant documentation and configuration for Claude Code and Cursor.
* Dev – Add deploy workflow and release preparation via Woo Deploy.
* Dev – Fix npm dependency vulnerabilities via overrides for serialize-javascript, minimatch, axios, qs, and webpack.
* Update – Require WooCommerce 10.5+.

*Fixed issue where the subscription start date was not automatically set when adding products to the cart from shop (archive) or category pages.
*Added WPML compatibility.

* Fix – Snapshot the cart total at the moment the OTP is sent and store it in the session. At validation time, compare against the snapshot instead of the live cart total. If the cart has changed, require re-verification.
* Fix – Return the same generic response for existing-but-unverified and new-email paths so an attacker cannot distinguish between them. Only keep 'already_verified' as a distinct code since it is needed for UX.
* Fix – Add a nonce check at the top of the resend handler using the same nonce the verify handler uses. Return an error if the nonce fails.
* Fix – "Login Now" Button Not Redirecting to Login Page in CEV PRO Checkout Popup
* Fix – Disable WooCommerce Store API Checkout not blocking Block checkout
* Fix – Logged-in users with unverified emails can no longer bypass checkout email verification
* Improvement – Replace mt_rand() with random_int() in the PIN generation loop. random_int() uses a CSPRNG and is safe for security-sensitive token generation.
* Improvement – Add a per-email or per-session attempt counter. After 5 failed attempts, invalidate the current PIN and force the user to request a new one. Return an error telling the user their code has expired due to too many attempts.
* Dev – Tested with WooCommerce 10.6.1
* Dev – Tested with WordPress 6.9.4