v2.5.0

2.5.0 (2026-08-06)

Added

• admin: configurable driver-tracking settings + imperial geofence display (962ea17)
• admin: make driver-tracking settings editable from the tracking dashboard (a5c5a8b)
• calculator: complete Try Hungry vendor pricing — 9% band, email fallback, DB parity (5beae88)
• driver: pickup/drop-off map markers + arrival geofence (ae3726f)
• driver: pickup/drop-off map markers + arrival geofence (ef1d827)

Fixed

• calculator: review fixes — auth-email trust anchor, cent rounding, sentinel-guard pinning tests (3a18e1b)
• deps: patch critical audit vulnerabilities in websocket-driver and tar (41710ba)
• driver: harden tracking settings from pre-landing + red-team review (6711480)
• driver: show the arrival-geofence distance in feet/miles, not meters (38d0579)
• driver: unblock pickup confirmation — storage path + optional signature with received-by name (1d01913)
• driver: unblock pickup confirmation — storage path + optional signature with received-by name (e360ffe)
• driver: walk-test follow-ups — signature pad reliability + fullscreen, sign-in bounce, end-shift guard (93e304a)
• driver: walk-test follow-ups — signature pad reliability + fullscreen, sign-in bounce, end-shift guard (8fb58aa)
• remove redundant #vendor-hero URL fragment from CTA links (16b1a1f)

Security

• bound all unbounded pnpm overrides and patch brace-expansion (phase 3) (b2c8ca0)
• bump fast-uri override 4.1.1 -> 4.1.2 (GHSA-7p8r-x3mc-p8w7) (f5b5691)
• lift brace-expansion to 5.0.8 — clears the last fixable audit highs (0e7baff)
• repair rotted pnpm overrides — audit highs 20 -> 4, 0 critical (9e48519)

Changed

• improve heading line spacing and break "Companies" to its own line (fb6c63b)
• improve ServedPartners logo sizing, copy, and mobile layout (928827f)
• tasks board redesign per design handoff (1d32125)

Documentation

• correct MILEAGE_* env supersession wording — env overrides are dead unconditionally (442abe6)
• document admin-configurable tracking settings in CLAUDE.md and ARCHITECTURE.md (5cfacc2)