–Security: the delivery type of an order must match the shipping rate that was charged — an office rate can no longer be stored as a delivery to an address (classic and block checkout).
–Security: request limits count atomically, so a burst of parallel requests cannot pass more than the limit.
–Security: Speedy town searches cache invented text, the shop-wide limit for courier lookups is 120 a minute, and searches over the stored office list are limited per visitor.
–Security: the early cash-on-delivery check answers for at most three people per checkout session and can no longer be switched off for the whole shop by outside requests.
–Security: stored courier passwords and secrets are no longer printed into the settings page; a stored value is shown masked and can be cleared with “Forget the stored value”.
–Library development files (build scripts, test configuration) are no longer shipped.