* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* New – New product video types.
* New – Support for Instagram videos.
* New – Support for TikTok videos.
* Added – A preview option for Play Button styling.
* Fixed – A fatal error on product pages when using Elementor.

* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* Fix – Restricted product rule toggles to users who can edit the target product.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Fix – Applied billing-period restrictions to manual subscription renewals.
* Dev – Re-enabled PHP 8.4 unit tests and fixed the CI matrix so the HPOS job actually runs against the HPOS order datastore.
* Dev – Fixed the build:js script and updated cross-env to v7.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Enabled JavaScript linting in CI and migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Fix – Fixed an issue where the Checkout block could receive an undefined payment method callback configuration when no payment gateway restrictions were active.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Fix – Fixed a fatal error that could take down sites running a WooCommerce version older than the required minimum.
* Fix – Corrected all-item package tag rules that use AND matching.
* Dev – Verified the ChromeDriver download against its published checksum in the E2E CI job.
* Fix – Fixed an issue where payment gateway restrictions could stop applying for the remainder of a request after the Cart/Checkout blocks cart data was generated.
* Fix – Fixed an issue where payment gateway and shipping method restrictions could stop applying for the remainder of a request when the debug mode was enabled.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Pinned and verified WP-CLI before release packaging.
* Fix – Corrected all-item package brand rules that use AND matching.
* Fix – Applied instance-specific shipping method restrictions on order-pay pages.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.
* Fix – Prevented "Translation loading was triggered too early" notices when the installed WooCommerce or PHP version is not supported.
* Fix – Prevented unauthorized users from toggling global checkout restrictions.

* New – Added an "Allowed file types" setting for 'file' profile fields. Configure this in Settings > Memberships after upgrading.
* New – Added rate limiting to profile field uploads.
* Fix – Harden security and validation checks around profile field uploads