Fixed a CSRF vulnerability in the OAuth-return handler: the connect flow now embeds a nonce (minted before redirecting to Dashified) that must round-trip and verify before any connection state or push token is trusted, closing a gap where a crafted link could have connected a store’s webhooks to an attacker-controlled Dashified account.
1.2.0
Renamed to Dashified Sync for WooCommerce (from Dashified for WooCommerce) to avoid confusion with the unrelated “Dashify: WooCommerce admin dashboard theme” plugin.
Added the Requires Plugins header to declare the WooCommerce dependency.
1.1.3
Declared compatibility with WooCommerce’s High-Performance Order Storage (custom order tables) and Cart/Checkout blocks. This plugin only ever used the official wc_get_orders()/WC_Order/WC_Product APIs, so it was already compatible — it just hadn’t announced it, which WooCommerce now flags on the Plugins screen until a plugin does.
1.1.2
Fixed a nonce-verification warning on the OAuth push-token read that a prior fix only partially covered (it spans two statements, not one).
1.1.1
Removed the load_plugin_textdomain() call — discouraged for WordPress.org-hosted plugins since translations now load automatically.
Documented (with phpcs:ignore) the handful of $_GET reads that don’t take a nonce: the OAuth-return handler (an external redirect from Dashified, not a same-site form) and a read-only admin-notice flag.
Bumped “Tested up to” to the current WordPress release.
1.1.0
Restructured for WordPress.org submission: added readme.txt, uninstall.php, and the standard includes/languages/assets directory layout.
Renamed plugin slug and text domain to dashified-for-woocommerce.
