== Changelog ==

The most recent releases are listed in readme.txt, on the Changelog tab of the plugin page.
This file keeps the full history of earlier versions.

= 1.2.6 =
* Fix: Public tracking lookup ([wcst_tracking] shortcode) now resolves orders by their visible order number, so it works on stores using sequential or custom order numbers (previously only the internal order ID matched)
* Improvement: Billing email check in the tracking lookup is now trimmed and case-insensitive, and rejects orders with no billing email
* Improvement: Order number field in the lookup form accepts custom formats (prefixes/dashes), not only plain digits
* Improvement: Added the "Track another order" link to the "no tracking yet" screen, so customers can look up a different order without going back

= 1.2.5 =
* Improvement: Added a copy-to-clipboard button next to tracking numbers in the WooCommerce Orders list column
* Improvement: The "Add Tracking Number" button now hides while the tracking form is open and returns after saving or cancelling
* Fix: Removed the unused carrier logo placeholder (empty grey box) from tracking items in the order meta box
* Fix: Removed the top border and extra spacing above the Add Tracking form in the order meta box

= 1.2.3 =
* Fix: Updated 10 broken or outdated carrier URLs in External services section (Blue Express Chile, Yanwen, J&T Express MY, Correos Express, Kerry Express Thailand, PTT Turkey, MNG Kargo Turkey, Fastway Couriers AU now on Aramex AU, EPX SA now points to actual privacy page; China Post/EMS marked unavailable as provider blocks automated access)
* Fix: Removed load_plugin_textdomain() call — not needed for plugins hosted on WordPress.org (WordPress 4.6+)
* Fix: Removed unnecessary wpdb::prepare() wrapping of hardcoded constant in subscriptions renewal query
* Fix: Replaced 9 dead carrier tracking-link domains with current working tracking pages (Kerry Express now KEX th.kex-express.com, Yanwen, ASM now GLS Spain, Correos Ecuador, Shalom, MRW Venezuela, Urbano, Zoom now zoom.red, China Post/EMS)
* Fix: Restored Zoom (Venezuela) Terms and Privacy links now that the provider's new site (zoom.red) is reachable

= 1.2.2 =
* Fix: Updated 5 broken carrier URLs in External services section (4PX, DPD Spain ×2, Correos Express, GlobalPost)
* Fix: REST API POST permission_callback now checks 'edit' capability instead of 'create' when adding tracking to an existing order

= 1.2.1 =
* Fix: Use esc_url_raw() instead of sanitize_text_field() for custom tracking URL fields (meta box, AJAX handlers, REST API)
* Fix: 3 carrier tracking URLs changed from HTTP to HTTPS (Correios Brazil, SAPO South Africa, DB Schenker Sweden)
* Fix: load_plugin_textdomain() moved to init hook (was incorrectly using after_setup_theme)
* Fix: Admin notice updated to use current notice notice-error CSS classes
* Fix: Added uninstall.php with WP_UNINSTALL_PLUGIN guard (tracking data intentionally preserved)
* Fix: Removed donate link pointing to source code repository

= 1.2.0 =
* Fix: Updated all broken carrier Terms of Service and Privacy Policy URLs in the External services section
* Fix: Added explicit documentation for FedEx Sameday (fedexsameday.com), DB Schenker Privpak portal (privpakportal.schenker.nu), and An Post tracking portal (track.anpost.ie)
* Fix: Updated PPL.cz Terms and Privacy links to current working URLs
* Security: Added nonce verification to meta box save, shortcode tracking form, and order lookup
* Security: Resolved unclosed ob_start() pattern flagged by static analyzer
* Fix: REST API /providers endpoint permission_callback documented as intentionally public (read-only carrier catalogue)

= 1.1.1 =
* Fix: Removed external Google favicon calls — carrier icons are no longer loaded from google.com/s2/favicons
* Fix: All built-in carrier tracking URLs are now documented in the readme with Terms of Service and Privacy Policy links
* Fix: REST API permission callbacks now validate against the specific order_id being accessed or modified

= 1.1.0 =
* Improved: Orders list tracking column layout uses flexbox for consistent alignment

= 1.0.9 =
* Initial public release
* Support for 60+ carriers across 20+ countries
* REST API (create, read and delete; update added in 1.3.0)
* HPOS and WooCommerce Blocks compatibility declared
* WooCommerce Subscriptions integration
* Shortcode [wcst_tracking]
* Developer helper functions: wcst_add_tracking(), wcst_delete_tracking()
