Excel export of download statistics replaced with native CSV (ZIP of summary, by-day, by-week, by-month, and detailed CSVs). Single-file download history exports now produce a CSV file. Removes the OpenSpout dependency entirely.
Removed legacy [td_file] and [td_category_files] shortcodes. Use [tooldocs_file] and [tooldocs_category_files] instead.
Tightened REST upload permissions: /upload, /upload/external, and the document replace endpoints now also require the upload_files capability.
Hardened shortcode output: filter-provided icon HTML is now sanitized through wp_kses() with a tight SVG-aware allowlist.
Removed the ini_set(‘memory_limit’, ‘256M’) raise from the document download template; the chunked 8 KB stream keeps memory usage bounded without it.
Added the public source repository URL to the readme Development section.
