* Fix – Prevented bundled item variation dropdowns from cutting off letters with descenders under block themes.
* Fix – Bounded Store API bundle configuration processing to current bundled items.
* Fix – Refreshed bundle-sell prices in AJAX cart fragments when the parent product is removed from the mini cart, instead of keeping the stale discounted price until the next page load.
* Fix – Prevented the quantity stepper from being crushed in the tabular layout, by keeping the quantity column wide enough for its control.
* Fix – Analytics reports failed to render at all, instead of showing an error message, when their data could not be loaded.
* Fix – Aligned bundled item thumbnails with the bundle container's title and quantity picker in the Cart and Mini-Cart blocks, and restored the gap between thumbnail and title that WooCommerce 10.6 removed.
* Fix – Rejected coupons that exclude sale items when a bundle has no price of its own and all of its bundled items are discounted, instead of accepting them and applying a zero discount.
* Tweak – Left-aligned the "Product" column header and kept the "Quantity" header on a single line in the tabular layout.
* Tweak – Matched the quantity input and Add to Cart button heights under block themes.
* Tweak – Normalized tabular layout table cell padding under block themes.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so the HPOS job actually runs against the HPOS order datastore.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Enabled JavaScript linting in CI and fixed source violations.
* Dev – Migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

* Fix – Added a directory-listing placeholder to add-on file upload directories, and backfilled existing directories in the background.
* Fix – Secured zero-priced product calculations while preserving Smart Coupons credit amounts.
* Fix – Prevented "Translation loading was triggered too early" notices when the installed WooCommerce or PHP version is not supported.
* Fix – Fixed add-on data being dropped when adding products to the cart through the Store API `/batch` endpoint.
* Fix – Prevented a failed Store API add-to-cart validation from leaving a stale error notice behind for later requests.
* Fix – Prevented unauthorized access to order-item add-on configuration.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so coverage config matches this repository, and restored the PHP 8.0 job.
* Dev – Enabled JavaScript linting in the release pipelines.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Updated cross-env to v7 and PHP_CodeSniffer to 3.13.6 (security release).
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Enabled JavaScript linting in CI and migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Removed release credentials from pull request E2E jobs.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

* Dev – Remove orphaned legacy discount class and exclude developer files from the built package.
* Tweak – WC 11.1 compatibility.

* Fix – Fixed a fatal error on the product page and when adding to the cart if a person type cost was stored with a currency symbol or other non-numeric characters.
* Fix – Fixed a person type cost stored with a thousands separator or a decimal comma being priced as only the digits before the separator.
* Fix – Fixed a fatal error when a pricing rule was set to divide by an empty or zero amount.
* Fix – Fixed the admin calendar single-day view defaulting to the server (UTC) date instead of the site timezone, which shifted bookings by a day once UTC and the site were on different calendar dates (for example, past 7 PM in UTC-5).
* Fix – Fixed a false "Error while deleting the item" error when permanently deleting bookings on HPOS stores.
* Dev – Removed the vulnerable extract-zip package from the development toolchain to resolve a Dependabot security alert.
* Fix – Prevented manual booking creation from changing orders without edit permission.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Fix – Prevented team-member updates from changing unauthorized booking products.
* Add – Support for importing accommodation bookings from a CSV file.
* Fix – Fixed a blocking Google Calendar API call being made on every request (front end, REST API, cron, login) when a Google account is connected; the calendar list is now fetched only when the settings form fields are actually used.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Wired the pull request CI checks required by the trunk branch protection rules (PHP coding standards, @version tag validation).
* Dev – Aligned AI-agent docs, ignore rules, and npm script aliases with the sibling extensions.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Fix – Restricted booking product template creation to authorized product editors with a valid request nonce.
* Fix – Fixed the "Booking Person Discount" coupon applying a discount 100 times too large at cart and checkout for currencies with zero decimals (for example JPY).
* Fix – Fixed console errors on admin screens when the WooCommerce Tracks object is unavailable.
* Fix – Fixed the date picker calendar availability announcement not being read by screen readers when the calendar opens on focus.
* Fix – Fixed the admin Add Booking screen and reschedule dialog showing times in the merchant's browser timezone instead of the store timezone when "Display visitor's local time" is enabled.
* Fix – Fixed the admin calendar month and schedule views defaulting an out-of-range year to the server (UTC) year instead of the site timezone, so the calendar could open on the wrong year around New Year.
* Dev – Update the shipped @babel/runtime helpers to resolve a security advisory.
* Dev – Fixed Markdown documentation lint violations and wired the Markdown docs lint into CI.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Removed the dead lint:md:js script.
* Dev – Documented the isolated worktree setup for local development.
* Dev – Stop waiting on networkidle when opening the front-end product page in E2E specs; wait on the date picker's own readiness signal instead.
* Dev – Enabled TLS certificate verification for translation downloads.
* Dev – Seed bookable products for E2E specs through the REST API instead of driving the admin product editor.
* Dev – Suppressed dependency deprecation notices in the PHP unit test suites.
* Dev – Added a CI check that fails when the plugin's own PHP sources raise compile-time deprecation notices.
* Dev – Added a pre-commit check that enforces updating the @version tag to x.x.x on modified PHP classes.
* Dev – Enabled JavaScript linting in CI and fixed source violations.
* Dev – Migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Allow-listed the dev-only GPLv3 dependency `@woocommerce/e2e-utils-playwright` and wired `check-licenses` into CI.
* Dev – Update PHPUnit to 9.6.35 to resolve a security advisory in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Update the shipped phpseclib library to resolve security advisories, and move Strauss and QIT CLI to require-dev.
* Dev – Update the shipped Guzzle libraries and the Symfony YAML development dependency to resolve security advisories.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Fix – Prevented resource REST requests from reading or deleting team members.
* Fix – Enforced global availability permissions for AJAX create, update, and delete requests.
* Fix – Bound booking product exports to the authorized product and global availability permissions.
* Fix – Limited booking order search results to orders the current user can access.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.
* Fix – Prevented fatal errors when a bookable product references a resource that cannot be resolved. Prices can fall back to product-level costs, and bookings reject stale submitted resources.