* Tweak – WordPress 7.1 Compatibility.

* Dev – Bump WordPress "Tested up to" to 7.1.
* Dev – Bump WordPress minimum supported version to 6.9.
* Dev – Bump WooCommerce "tested up to" version 11.1.
* Dev – Bump WooCommerce minimum supported version to 10.9.

* Feature – Added AI detection of disposable/throwaway email addresses. Beyond the built-in domain list, it flags brand-new temp-mail domains and abusive patterns (random mailboxes, plus-address abuse) and lets you review and add them to your block list in one click, so spam protection stays current automatically.
* Feature – Added bot-cluster detection. When many signups arrive in a short burst sharing the same device fingerprint and network, the Unverified Users screen flags the cluster and lets you block and delete the whole group in one click — stopping coordinated bot attacks that per-user rules miss.
* Feature – Added AI risk scoring for registrations and guest checkout. Each signup/order is scored from multiple signals (disposable/gibberish email patterns, IP/ASN reputation, signup velocity, device reuse) and the merchant chooses what happens at each risk level — allow, require a one-time code, or block — with a Low/Balanced/Strict sensitivity. A new Risk column on the Unverified Users screen shows the score and reasons.
* Feature – Added a "Require OTP on every login" option in Login Authentication.
* Dev – Tested with WooCommerce 11.0.1
* Dev – Tested with WordPress 7.0.4

* Fix – Applied the Shop Manager gift card code masking policy to refund reversal errors.
* Fix – Applied the Shop Manager gift card code masking policy to analytics reports and exports.
* Fix – Disabled forgeable legacy gift card email links while preserving modern links.
* Fix – Fixed a fatal error when applying a gift card from an email link while the WooCommerce Store API session handler is active.
* Fix – Fixed a fatal error when sending a test of the Gift card received email, or when the gift card is not linked to an order item.
* Fix – Restricted subscription gift card balance changes to the subscription owner or shop managers.
* Fix – Analytics reports failed to render at all, instead of showing an error message, when their data could not be loaded.
* Fix – Prevented Gift Card imports from deleting Shop Manager-selected server files.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Added the plain lint:phpcs script and updated PHP_CodeSniffer to 3.13.6 (security release).
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Isolated pull request tests from release credentials.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Enabled JavaScript linting in CI and fixed source violations.
* Dev – Migrated the ESLint configuration to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.
* Dev – Prevented gift card debits from committing the unit test suite's transaction while preserving atomic production debits.
* Dev – Updated usage tracking to recalculate the first published gift card product date whenever tracking data is invalidated.