* Fix – Verified the product search nonce before running the admin component and category product searches.
* Fix – Analytics reports failed to render at all, instead of showing an error message, when their data could not be loaded.
* Fix – Prevented malformed compressed cart query strings from causing unbounded processing.
* Fix – Aligned composited item thumbnails with the composite container's title and quantity picker in the Cart and Mini-Cart blocks, and restored the gap between thumbnail and title that WooCommerce 10.6 removed.
* Fix – Product Add-Ons: Stopped pre-filling the add-on form of a component with the add-on values of another component that has the same option selected, when editing a composite in an order.
* Fix – Product Add-Ons: Preserved the add-on data of component line items whose add-on form is not part of the edit-in-order modal, instead of deleting it when saving the composite.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so the HPOS job actually runs against the HPOS order datastore.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Updated the PHPUnit toolchain (PHPUnit 9.6, polyfills 3.1) and PHP_CodeSniffer to 3.13.6 (security release).
* Dev – Removed duplicate lint scripts from the repository root.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

* Fix – A Media Mail restriction pointing at a deleted shipping class silently blocked Media Mail while the settings screen showed no restriction. The deleted class now appears in the setting so it can be seen and removed.
* Tweak – Add readme.txt to fix a QIT validation warning.

* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* Fix – Product and variation Minimum/Maximum quantities are now validated against the "Group of" value defined by a category rule, not only against the product's own.
* Fix – The "Group of" warning notice on the product edit screen never appeared on page load.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so coverage config matches this repository.
* Dev – Re-enabled JavaScript linting in the release pipelines.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Removed the dead test:jest script and Jest configuration.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Enabled JavaScript linting in CI and migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Removed release credentials from pull request E2E jobs.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Update PHP development dependencies to resolve security advisories in the test toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

Enhancement: Escape and sanitize shortcode output.