* Add – `woocommerce_order_barcodes_scan_result_heading` filter to allow overriding the scan results heading level and text.
* Fix – Add a section heading above the barcode scan results to meet WCAG 2.4.10 (Section Headings). Resolves WooExt-472.
* Fix – Let the scan form notice dismiss button inherit the notice's text colour in every state instead of hardcoding it, so the glyph and its focus ring keep the notice's own contrast at rest, on hover and on focus, meeting WCAG 1.4.3 (Contrast (Minimum)) and 1.4.11 (Non-text Contrast). Resolves WOOORBR-35.
* Tweak – Check barcode scanning permissions before looking up the barcode, so an unauthorised request can no longer tell an unrecognised barcode apart from a valid one.
* Tweak – WooCommerce 11.1 Compatibility.

* Fix: PLUGINS-3345: Fixed an incorrect Anti-Fraud admin warning appearing when manually creating WooCommerce orders.
* Fix: PLUGINS-3347: Improved “Block Unknown Origin†protection across Classic Checkout, Store API, and CardPointe checkout flows for more consistent fraud protection.
* Fix: PLUGINS-3373: Improved “Too Many Order Attempts†protection to reduce false blocks of legitimate customers caused by store-wide and aggregated matching.
* Fix: PLUGINS-3374: Fixed Apple Pay and WooPayments tokenized cart checkout issues caused by WooCommerce Anti-Fraud interference.
* New: ANTIFRAUD-275: Added Anti-Fraud Settings search to make configuration options easier to find.
* Fix: ANTIFRAUD-278: Improved CAPTCHA provider compatibility and corrected reCAPTCHA support.
* Fix: ANTIFRAUD-280: Added WooCommerce 10.9+ compatibility and fixed a fatal error related to email notification handling.
* Update: ANTIFRAUD-288: Improved WooCommerce Anti-Fraud to meet Woo Marketplace Excellence Verified requirements.

* Fix – Security update.
* Tweak – WooCommerce 11.1 Compatibility.

* Fix – Applied existing wildcard shipping restrictions to object-backed dynamic rates without changing substring matching.
* Fix – Required product edit permission before returning product-specific restriction rules through the Abilities API.
* Fix – Validated product restriction metadata imported from CSV before storing or rendering it.
* Fix – Evaluated Store API pay-for-order payment restrictions against the order being paid.
* Fix – Prevented guest-supplied e-mails from satisfying customer allowlist restrictions.
* Fix – Preserved and anchored wildcard patterns in customer e-mail restrictions.
* Fix – Matched coupon-code wildcards against complete coupon codes.
* Fix – Failed closed when Store API payment gateway validation receives an unavailable gateway.
* Fix – Evaluated billing country and state restrictions against the order on pay-for-order pages.
* Fix – Bounded Date/Time condition parsing before expanding numeric ranges.
* Fix – Kept restrictions in place when a Date/Time condition value cannot be read.
* Fix – Restricted queued store-management notices to users who can manage WooCommerce.
* Fix – Prevented repeated deserialization of restriction metadata during product CSV export.
* Fix – Prevented translations from loading before WordPress initialization.
* Dev – Stopped pull request E2E jobs from receiving release credentials.
* Dev – Authenticated browser requests to test-only E2E helpers with a per-run token.
* Dev – Pinned CI dependencies used by jobs with access to sensitive credentials.
* Dev – Pinned GitHub Actions to immutable commit revisions.
* Dev – Removed redundant and low-value tests.
* Dev – Managed changelog entries with Jetpack Changelogger: pull requests add a file under changelog/ instead of editing changelog.txt.

* Fix – Deleting the plugin no longer removes your box definitions, unless WC_REMOVE_ALL_DATA is set to true in wp-config.php.
* Fix – Security updates.
* Tweak – WooCommerce 11.1 Compatibility.