* Fix: Rule group and rule keys are sanitised on save.

* Fix – Retry sending a payment to Xero when the API responds with a 429 rate-limit error, instead of failing silently and leaving the order without a payment.
* Fix – Improved permission checks for Xero branding theme updates.
* Fix – The list of Xero branding themes is no longer cleared when Xero returns an error.
* Fix – Improved handling of sensitive values in the optional OAuth debug log.
* Dev – Add a filter for changing the status assigned to invoices sent to Xero.
* Dev – Add a filter for appending Xero-supported XML elements to invoice line items.
* Dev – Bump WooCommerce "tested up to" version 11.2.
* Dev – Bump WooCommerce minimum supported version to 11.0.
* Dev – Fix E2E coupon tests failing on WooCommerce 11.2 by targeting the visible checkout coupon form.
* Dev – Allow the E2E suite to target a custom tests-site URL through `BASE_URL` or `WP_ENV_TESTS_PORT`.
* Dev – Pin GitHub Actions and their nested dependencies to immutable commit SHAs.

* New: Tested up to WordPress 7.1.2
* New: Tested up to WooCommerce 11.1.2
* Fix: PHP 8.5 deprecation warnings for non-canonical (double) cast and 'ReflectionMethod::setAccessible()'
* Update: Translations

* Fix – Resolved a fatal error on sites running Roots/Acorn or other software bundling PSR-3 Log 2.x or 3.x, caused by the bundled box packing library.

* Fix – Improved permission checks for vendor product management.
* Fix – Improved permission checks for product commission, tax, and shipping settings.
* Fix – Saving a product no longer moves it to a different vendor when a user manages more than one.
* Fix – Products created by a vendor are now always assigned to that vendor, so they earn commission and appear in the vendor's product list.
* Fix – Improved permission checks for vendors in the store admin.
* Fix – Improved filtering of the customers a vendor can see.
* Fix – Improved verification of vendor assignments when switching active vendor.
* Dev – WC_Product_Vendors_Utils::can_user_manage_product() now checks the user ID passed to it. Callers must pass a user ID; a vendor term ID no longer returns the expected result.
* Dev – Add the wcpv_vendor_allowed_wc_ajax_actions filter, which controls which WooCommerce AJAX actions a vendor may run.
* Dev – Vendor switching now checks vendor assignments directly. Custom code that grants vendor admin access through filters may need updating.