* Fix – Product and variation Minimum/Maximum quantities are now validated against the "Group of" value defined by a category rule, not only against the product's own.
* Fix – The "Group of" warning notice on the product edit screen never appeared on page load.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so coverage config matches this repository.
* Dev – Re-enabled JavaScript linting in the release pipelines.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Removed the dead test:jest script and Jest configuration.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Enabled JavaScript linting in CI and migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Removed release credentials from pull request E2E jobs.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Update PHP development dependencies to resolve security advisories in the test toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

Enhancement: Escape and sanitize shortcode output.

* Fix – Prevented bundled item variation dropdowns from cutting off letters with descenders under block themes.
* Fix – Bounded Store API bundle configuration processing to current bundled items.
* Fix – Refreshed bundle-sell prices in AJAX cart fragments when the parent product is removed from the mini cart, instead of keeping the stale discounted price until the next page load.
* Fix – Prevented the quantity stepper from being crushed in the tabular layout, by keeping the quantity column wide enough for its control.
* Fix – Analytics reports failed to render at all, instead of showing an error message, when their data could not be loaded.
* Fix – Aligned bundled item thumbnails with the bundle container's title and quantity picker in the Cart and Mini-Cart blocks, and restored the gap between thumbnail and title that WooCommerce 10.6 removed.
* Fix – Rejected coupons that exclude sale items when a bundle has no price of its own and all of its bundled items are discounted, instead of accepting them and applying a zero discount.
* Tweak – Left-aligned the "Product" column header and kept the "Quantity" header on a single line in the tabular layout.
* Tweak – Matched the quantity input and Add to Cart button heights under block themes.
* Tweak – Normalized tabular layout table cell padding under block themes.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so the HPOS job actually runs against the HPOS order datastore.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Enabled JavaScript linting in CI and fixed source violations.
* Dev – Migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.

* Fix – Added a directory-listing placeholder to add-on file upload directories, and backfilled existing directories in the background.
* Fix – Secured zero-priced product calculations while preserving Smart Coupons credit amounts.
* Fix – Prevented "Translation loading was triggered too early" notices when the installed WooCommerce or PHP version is not supported.
* Fix – Fixed add-on data being dropped when adding products to the cart through the Store API `/batch` endpoint.
* Fix – Prevented a failed Store API add-to-cart validation from leaving a stale error notice behind for later requests.
* Fix – Prevented unauthorized access to order-item add-on configuration.
* Dev – Restored TLS certificate verification and fail-closed error handling in the release deployment script.
* Dev – Fixed the unit-test CI matrix so coverage config matches this repository, and restored the PHP 8.0 job.
* Dev – Enabled JavaScript linting in the release pipelines.
* Dev – Pinned and checksum-verified the WP-CLI executable used in release builds.
* Dev – Updated cross-env to v7 and PHP_CodeSniffer to 3.13.6 (security release).
* Dev – Added Markdown, dependency license, and WordPress.org Plugin Check gates to the pull request CI.
* Dev – Updated the npm build toolchain to resolve all remaining Dependabot security alerts.
* Dev – Standardized the package license identifier on GPL-3.0-or-later.
* Dev – Exposed the shared `.ai/commands` to agent tooling and documented the isolated worktree setup.
* Dev – Enabled CSS linting in CI and fixed source style violations.
* Dev – Enabled JavaScript linting in CI and migrated the ESLint setup to the flat config format required by ESLint 10, aligning the lint and formatting toolchain with WooCommerce core.
* Dev – Removed release credentials from pull request E2E jobs.
* Dev – Update wp-coding-standards/wpcs to 3.4.1 (security release) in the phpcs lint tooling.
* Dev – Update development Composer dependencies (PHPUnit, Guzzle PSR-7, PsySH, Symfony YAML) to resolve security advisories in the PHP test toolchain.
* Dev – Update development npm dependencies to resolve security advisories in the build toolchain.
* Dev – Hardened the QIT test workflow: pinned the QIT CLI version and stopped workflow inputs from being interpolated into shell source.