JLinux Code

Commit a5420f75f5a for woocommerce

commit a5420f75f5aee8712f92cfdf0ee075ec55d4704c
Author: woocommercebot <30233865+woocommercebot@users.noreply.github.com>
Date:   Thu Sep 24 17:06:10 2026 +0700

    Prepare Packages for Release (#69028)

    Automated change: Prep @automattic/woocommerce-analytics for release.

    Co-authored-by: woocommercebot <woocommercebot@users.noreply.github.com>

diff --git a/packages/php/woocommerce-analytics/CHANGELOG.md b/packages/php/woocommerce-analytics/CHANGELOG.md
index ca6bffc52be..a3446a65fb4 100644
--- a/packages/php/woocommerce-analytics/CHANGELOG.md
+++ b/packages/php/woocommerce-analytics/CHANGELOG.md
@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 0.18.0 - 2026-09-24
+### Security
+- Always initialize the front-end `window.wcAnalytics` object from scratch and only accept a string as the webpack public path. [#68346]
+- Bound what the unauthenticated tracking proxy endpoint accepts: events per request, properties per event, array members, value and name lengths, an encoded payload budget per event, and a ceiling on the pixel URL that is fired. [#68314]
+- Keep the tracking proxy route registered once a site has used proxy tracking and answer 403 while the feature is off, so events from pages still held in a cache fail visibly instead of disappearing into a 404. Mirrors the speed module's authorization into an option it can read before plugins load, and has an unauthorized module fall through to the REST route rather than refuse on its own. [#68315]
+- Stop the tracking proxy endpoint from accepting client-supplied values for server-derived event properties, and register it only on sites with proxy tracking enabled. Adds `WC_Analytics_Tracking::record_client_event()` and a third `$is_client_supplied` argument to the `jetpack_woocommerce_analytics_event_props` filter. [#68313]
+
+### Added
+- Send the package version on every event as `package_version`, so Tracks data can be attributed to the package release that emitted it. The published copy has `PACKAGE_VERSION` stamped from `composer.json` at build time. [#68908]
+
+### Fixed
+- Rename the store search event so Tracks ingest stops rejecting it. [#68313]
+- Stop URL-encoding array event properties twice so Tracks stores the plain comma-joined value. [#69027]
+
 ## 0.17.0 - 2026-08-24
 ### Security
 - Update wp-coding-standards/wpcs to 3.4.1 (security release). [#67036]
diff --git a/packages/php/woocommerce-analytics/changelog/fix-dotcom-18362-search-event-name b/packages/php/woocommerce-analytics/changelog/fix-dotcom-18362-search-event-name
deleted file mode 100644
index bb2e9e1a0bc..00000000000
--- a/packages/php/woocommerce-analytics/changelog/fix-dotcom-18362-search-event-name
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: patch
-Type: fixed
-
-Rename the store search event so Tracks ingest stops rejecting it.
diff --git a/packages/php/woocommerce-analytics/changelog/fix-wooa7s-2110-array-prop-encoding b/packages/php/woocommerce-analytics/changelog/fix-wooa7s-2110-array-prop-encoding
deleted file mode 100644
index 130600e7ccc..00000000000
--- a/packages/php/woocommerce-analytics/changelog/fix-wooa7s-2110-array-prop-encoding
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: patch
-Type: fixed
-
-Stop URL-encoding array event properties twice so Tracks stores the plain comma-joined value.
diff --git a/packages/php/woocommerce-analytics/changelog/wooa7s-1803-tracking-proxy-hardening b/packages/php/woocommerce-analytics/changelog/wooa7s-1803-tracking-proxy-hardening
deleted file mode 100644
index 10880be4665..00000000000
--- a/packages/php/woocommerce-analytics/changelog/wooa7s-1803-tracking-proxy-hardening
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: minor
-Type: security
-
-Stop the tracking proxy endpoint from accepting client-supplied values for server-derived event properties, and register it only on sites with proxy tracking enabled. Adds `WC_Analytics_Tracking::record_client_event()` and a third `$is_client_supplied` argument to the `jetpack_woocommerce_analytics_event_props` filter.
diff --git a/packages/php/woocommerce-analytics/changelog/wooa7s-2042-config-global-hardening b/packages/php/woocommerce-analytics/changelog/wooa7s-2042-config-global-hardening
deleted file mode 100644
index 84aa4c4bcf3..00000000000
--- a/packages/php/woocommerce-analytics/changelog/wooa7s-2042-config-global-hardening
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: patch
-Type: security
-
-Always initialize the front-end `window.wcAnalytics` object from scratch and only accept a string as the webpack public path.
diff --git a/packages/php/woocommerce-analytics/changelog/wooa7s-2110-package-version-prop b/packages/php/woocommerce-analytics/changelog/wooa7s-2110-package-version-prop
deleted file mode 100644
index 8f0ba8b298c..00000000000
--- a/packages/php/woocommerce-analytics/changelog/wooa7s-2110-package-version-prop
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: minor
-Type: added
-
-Send the package version on every event as `package_version`, so Tracks data can be attributed to the package release that emitted it. The published copy has `PACKAGE_VERSION` stamped from `composer.json` at build time.
diff --git a/packages/php/woocommerce-analytics/changelog/wooa7s-client-input-bounds b/packages/php/woocommerce-analytics/changelog/wooa7s-client-input-bounds
deleted file mode 100644
index 37f1c0672ab..00000000000
--- a/packages/php/woocommerce-analytics/changelog/wooa7s-client-input-bounds
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: minor
-Type: security
-
-Bound what the unauthenticated tracking proxy endpoint accepts: events per request, properties per event, array members, value and name lengths, an encoded payload budget per event, and a ceiling on the pixel URL that is fired.
diff --git a/packages/php/woocommerce-analytics/changelog/wooa7s-proxy-route-lifecycle b/packages/php/woocommerce-analytics/changelog/wooa7s-proxy-route-lifecycle
deleted file mode 100644
index 8d490667fc2..00000000000
--- a/packages/php/woocommerce-analytics/changelog/wooa7s-proxy-route-lifecycle
+++ /dev/null
@@ -1,4 +0,0 @@
-Significance: minor
-Type: security
-
-Keep the tracking proxy route registered once a site has used proxy tracking and answer 403 while the feature is off, so events from pages still held in a cache fail visibly instead of disappearing into a 404. Mirrors the speed module's authorization into an option it can read before plugins load, and has an unauthorized module fall through to the REST route rather than refuse on its own.
diff --git a/packages/php/woocommerce-analytics/composer.json b/packages/php/woocommerce-analytics/composer.json
index e7945957bed..079ed0b87e8 100644
--- a/packages/php/woocommerce-analytics/composer.json
+++ b/packages/php/woocommerce-analytics/composer.json
@@ -3,7 +3,7 @@
 	"description": "Enhanced analytics for WooCommerce users.",
 	"type": "jetpack-library",
 	"license": "GPL-2.0-or-later",
-	"version": "0.17.0",
+	"version": "0.18.0",
 	"require": {
 		"php": ">=7.4",
 		"automattic/jetpack-assets": "^4.3 || ^5.0",