Merge the changelogs

[ci skip]

Author: brandonkelly

CHANGELOG-WIP.md

@@ -1,5 +1,23 @@
 # Release Notes for Craft Commerce
 
+## Unreleased
+
+### Store Management
+- PDF download URLs are now generated with time-limited security tokens.
+- Anonymous users attempting to download a PDF with an expired or missing token are now shown an email verification form.
+- Added a new system message for customizing PDF download emails.
+
+### Administration
+- Added the “Link Duration” setting to PDF settings.
+
+### Extensibility
+- Added `craft\commerce\controllers\DownloadsController::actionEmailChallenge()`.
+- Added `craft\commerce\controllers\DownloadsController::actionPdfChallenge()`.
+- Added `craft\commerce\controllers\DownloadsController::actionPdfSent()`.
+- Added `craft\commerce\elements\Order::getMaskedEmail()`.
+- Added `craft\commerce\models\Pdf::$linkExpiry`.
+- Added `craft\commerce\services\Pdfs::getPdfUrl()` now generates secure tokenized URLs with expiry timestamps.
+
 ## 4.9.4 - 2025-10-15
 
 - Fixed a SQL error that could occur when deleting a shipping method.