* UPDATE: The redsys_modify_data_to_send filter now receives 'context' => 'add_payment_method' and 'user_id' in the data array for the "Add payment method" flow, so custom snippets and conditional rules can route the tokenization to the right terminal (terminal + SHA256) without relying on an order that does not exist in this flow.
* FIX: Adding a card from My Account ("Add payment method") on multicurrency stores could be rejected by Redsys with a currency error. The request was sent with the customer's session currency (e.g. ARS, 32) but the default terminal, which is configured for another currency (e.g. EUR, 978). Card tokenization is a zero-amount operation with no order behind it, so if no filter or conditional rule routes the request to another terminal, the store base currency is now sent, always matching the default terminal configuration.
* FIX: Adding a card from My Account (or via the profile email link) always registered the card at Redsys as one-click (DS_MERCHANT_COF_TYPE 'C'), even when the customer selected the subscriptions option. The token type was read from the wrong internal key, so 'R' was never sent. The token was stored correctly as R in WooCommerce, but the COF agreement was created as C at Redsys, which could cause some issuers to decline later subscription renewals (MIT) made with those tokens. Cards added with the subscriptions option now correctly send DS_MERCHANT_COF_TYPE 'R'. Tokens created while the bug was present cannot be reclassified; if a renewal is declined, ask the customer to re-add the card.
* FIX: Payments made with a saved card (token R) and subscription renewals did not honor the preauthorization settings. With "Preauthorize all orders" enabled (or a product marked for preauthorization), the charge was executed as a regular sale (type 0) but the order was still marked as "Preauthorized", so confirming the preauthorization later failed at Redsys with SIS0059 ("No operation exists on which to perform the confirmation"). Both flows now send a real type 1 preauthorization that can be confirmed later, and an order is only marked as "Preauthorized" when a real preauthorization was executed. This also enables preauthorized subscription renewals (for example goods sold by weight, where each renewal is adjusted before the final charge).
* UPDATE: Updated all translations.
* SECURITY: The merchant SHA-256 secret key is no longer written in plain text to the WooCommerce debug logs. All debug entries now mask the key, showing only its last 4 characters, via the new WCRed()->mask_secret() helper. Applied across all gateways (Redirection, InSite, Bizum, Google Pay, Apple Pay, PayGold, Direct Debit and the Blocks support classes).
* SECURITY: Redsys notification (IPN) signatures are now verified with hash_equals() (constant-time comparison) in all notification handlers, unifying them with the verification already used by InSite and the REST client. Hardening against timing attacks.
* SECURITY: The single-token delete AJAX handler in the tokens management screen now requires the manage_woocommerce capability in addition to the nonce, matching the bulk-delete handler.
