Melhoria
- Compatibility with WordPress 7.1 and PHP 8.4.
Correção
- Restored design-system styling when Pro is active (pm-pro.css now bundles the Free base CSS).
Segurança
- Fixed a Subscriber-level SQL injection via the list "orderby" parameter in Sprint, Sub-task, Time Tracker and Label lists. Reported by Patchstack (dutafi).
- Gated every report REST route and removed report user-impersonation, closing unauthenticated report exfiltration.
- Enforced project membership and bound request IDs across Sprint, Invoice, Sub-task, Custom Field, Gantt, Search and Calendar endpoints (cross-project access / IDOR).
- Fixed a stored XSS in invoice client notes and a path traversal in invoice PDF export; stored data is now deserialized without instantiating objects.