Security: Hardened WordPress post-type REST routes with additional access checks.
Filters: Public maps no longer get stuck on a loading spinner when a cached page sends an expired WordPress REST nonce; those reads retry without the stale nonce.
CSV import: File uploads honor the selected ID column so existing region rows update instead of duplicating. "No ID" appends as expected, and Excel BOM headers no longer create blank IDs.
Loading spinner: The spinner sits next to the loading text, empty text is hidden, and the preloader is visible before JavaScript runs.
Mobile toolbar: Map/List icons show correctly when Shadow DOM is enabled.
Pinch-zoom: Pinch-zoom no longer fails on some iPad browsers (including DuckDuckGo).
USA counties map: Corrected the Orange County spelling.