* Enhancement: Escape and sanitize shortcode output.

* Update: WooCommerce compatibility up to 11.0
* Fix: Resolve issue where a crash could occur in specific race conditions during updates

* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* Security – Hardened capability checks around the payment token editor's admin functionality
* Misc – Updated the SkyVerge Plugin Framework to v6.2.4

* Fix – Verified the product search nonce before running the admin component and category product searches.
* Fix – Analytics reports failed to render at all, instead of showing an error message, when their data could not be loaded.
* Fix – Prevented malformed compressed cart query strings from causing unbounded processing.
* Fix – Aligned composited item thumbnails with the composite container's title and quantity picker in the Cart and Mini-Cart blocks, and restored the gap between thumbnail and title that WooCommerce 10.6 removed.
* Fix – Product Add-Ons: Stopped pre-filling the add-on form of a component with the add-on values of another component that has the same option selected, when editing a composite in an order.
* Fix – Product Add-Ons: Preserved the add-on data of component line items whose add-on form is not part of the edit-in-order modal, instead of deleting it when saving the composite.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so the HPOS job actually runs against the HPOS order datastore.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Updated the PHPUnit toolchain (PHPUnit 9.6, polyfills 3.1) and PHP_CodeSniffer to 3.13.6 (security release).
* Dev – Removed duplicate lint scripts from the repository root.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.