WooCommerce Bookings v3.11.0
* Add - Added a filter for customizing the booking start-time selector HTML.
* Fix - Protected booking product data while preserving direct-link access to catalog-hidden products.
* Fix - Applied standard cart validation, password checks and confirmation-cart separation to quick bookings.
* Fix - Kept existing cart bookings when earlier add-to-cart validation rejects a booking.
* Fix - Prevented unauthorized product counts while preserving published results for public callers and partial editors; constrained query-filter status overrides to the requested authorized collection.
* Fix - Displayed the full selected range for fixed multi-month bookings.
* Fix - Prevented fatal errors when cart item data includes a foreign product using the booking type.
* Fix - Limited the desktop booking modal to 500 by 600 pixels and stacked its action buttons at every screen size.
* Fix - Matched the booking modal team-member selector to its design in both left-to-right and right-to-left layouts.
* Fix - Included categories for Accommodation Bookings and other registered bookable product types in REST responses.
* Fix - Kept admin calendar pickers on the selected site date across timezones.
* Fix - Stored booking calendar email attachments in private temporary paths and removed them at request shutdown.
* Fix - Aligned public booked-day lookups to whole calendar months so their persistent caches stay bounded.
* Fix - Kept pagination out of public slot cache keys and capped tracked slot cache entries per product.
* Fix - Deduplicated client-selected public REST slot product IDs to avoid repeated slot calculations.
* Fix - Imported Google Calendar events in bounded pages per poll and resumed large calendars on the next poll.
* Fix - Allowed the Bookings product REST API to preserve editor-saved values.
* Fix - Bounded public time-slot lookups to configured product durations.
* Fix - Required order permissions before a booking editor can relink a booking to another order or trash and delete a linked order through the booking.
* Fix - Removed stored copies of custom Google Calendar encryption keys without disconnecting working calendars.
* Fix - Bounded the work a Google Calendar recurrence can add to availability checks; rules that exceed the limit keep their times unavailable and are logged.
* Fix - Required booking permissions before the CSV importer creates or overwrites a booking.
* Fix - Encrypted custom Google OAuth client secrets and masked the settings field.
* Fix - Deleted temporary bookings and cleanup events when cart items are removed.
* Fix - Revalidated admin booking reschedules against product rules and live availability.
* Fix - Prevented unauthorized admin requests from skipping required database updates.
* Fix - Serialized cart booking reservations and checkout capacity validation.
* Fix - Limited public booking-product responses to storefront fields.
* Fix - Respected the booking window when requesting availability for booking blocks.
* Fix - Protected booking product data while preserving direct-link access to catalog-hidden products and keeping availability cache keys independent of unused timezone offsets.
* Fix - Stored uploaded booking CSV imports in WooCommerce's protected import folder under a random name, and deleted them once the import completes.
* Fix - Kept per-person coupon discounts within the remaining booking price and WooCommerce coupon usage limits.
* Fix - Rejected public availability slot requests that would exhaust server memory, scaling the limit to the host's PHP memory.
* Fix - Checked linked-record restore permissions and preserved trashed bookings during order status updates and scheduled jobs, while invalidating slots for restored bookings.
* Fix - Kept single-product export files in a private temporary directory and limited cleanup to the exported file.
* Fix - Stored booking CSV exports in the protected WooCommerce uploads folder under unguessable names.
* Fix - Validated person-type permissions and product ownership before saving booking products.
* Fix - Stopped public availability requests from growing the booking cache without limit.
* Fix - Checked resource edit permissions when changing product resource assignments through the REST API.
* Fix - Checked the owning order before clearing a booking order-item link.
* Fix - Validated existing booking references and order-item pairs before CSV updates.
* Fix - Restricted Google Calendar connection requests, delayed repeated refresh failures, and improved expired-link and settings-save recovery.
* Fix - Required current product edit access for every team-member relationship added or removed during final synchronization.
* Fix - Booking exports renamed through the woocommerce_bookings_export_get_filename filter download again.
* Fix - Prevented the booking calendar popover from overlapping the WordPress and WooCommerce admin headers.
* Fix - Allowed removing a permanently deleted resource from a bookable product through the REST API and the product screen.
* Fix - Made the View User and View Order buttons in the booking customer meta box translatable.
* Fix - Fixed the v2 quotes REST endpoint failing when a request includes a customer ID.
* Fix - Omitted inaccessible order links from calendar files for guest and orderless bookings.
* Fix - Displayed the full date range for multi-day and multi-month bookings in the cart.
* Fix - Kept booking details visible within month calendar cells on RTL sites.
* Fix - Localized advanced pricing rule values to the store's decimal separator.
* Fix - Prevented Booking Person Discount coupons from breaking empty or mixed-product carts, and from erroring on orders handled without a cart.
* Fix - Displayed the customer-selected booking duration in order details.
* Fix - Kept availability grid controls accessible at narrow widths.
* Fix - Kept deleted product availability rules from returning after later product saves.
* Fix - Logged unexpected booking AJAX failures for easier troubleshooting.
* Fix - Rejected manual bookings that fail product validation instead of creating them at zero cost.
* Fix - Prevented bookings from starting before the product's minimum bookable date.
* Fix - Stopped Google Calendar sync from reporting an error when deleting an event that was already removed.
* Fix - Fixed the fallback link shown after creating a bookable product from a template.
* Fix - Excluded expired custom date-time Store Availability rules from booking calendar responses.
* Fix - Refreshed the highlighted booking date range when a customer changes the duration.
* Tweak - Raised minimum requirements to WordPress 6.9 and WooCommerce 10.9.
* Tweak - Declared compatibility with WordPress 7.1 and WooCommerce 11.2.
* Tweak - Grouped availability range types by behavior and clarified their labels.
* Dev - Switched the version headings in changelog.txt to the WordPress.org format.
* Dev - Updated development dependencies to address security advisories.
* Dev - Built the production ZIP on pull requests.
* Dev - Updated wp-env to restore local PHP 7.4 and 8.0 image builds.
* Dev - Hardened release artifact verification, release pull request checks, and WordPress test metadata.
* Dev - Updated the development toolchain to Node 24.18 and @wordpress/scripts 35.
* Dev - Corrected hook docblocks and other PHPStan findings that do not change behavior.
* Dev - Raised the PHPStan analysis level to 2.
* Dev - Updated dependencies, including the shipped phpseclib library, to address security advisories.
* Dev - Renamed the Store Availability calendar's local year variable to avoid WordPress's reserved name.
* Dev - Added the `woocommerce_delete_booking_transients` action after booking cache invalidation.